# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.81.211.221
country_id: 6252001
description:
2026-01-05 13:46:01 dovecot_login authenticator failed for H=vps-45907be8.vps.ovh.us [51.81.211.221]:37672: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.32.33.161
country_id: 3686110
description:
Jan  5 13:45:31 host2 sshd[456654]: Disconnected from invalid user scanner 179.32.33.161 port 44366 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.186.40.250
country_id: 3895114
description:
Jan  5 13:45:40 host2 sshd[456767]: Disconnected from invalid user loki 201.186.40.250 port 33234 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.32.33.161
country_id: 3686110
description:
Jan  5 13:46:13 host2 sshd[457774]: Disconnected from invalid user holu 179.32.33.161 port 57824 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.40.63
country_id: 1819730
description:
2026-01-05 13:46:20 dovecot_login authenticator failed for H=063.40.246.220.static.netvigator.com [220.246.40.63]:57839: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.186.40.250
country_id: 3895114
description:
Jan  5 13:46:59 host2 sshd[458452]: Disconnected from invalid user al 201.186.40.250 port 55904 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.32.33.161
country_id: 3686110
description:
Jan  5 13:48:04 host2 sshd[459521]: Disconnected from invalid user test1 179.32.33.161 port 41742 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.186.40.250
country_id: 3895114
description:
Jan  5 13:48:47 host2 sshd[460242]: Disconnected from invalid user salon 201.186.40.250 port 33442 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.186.40.250
country_id: 3895114
description:
Jan  5 13:48:11 host2 sshd[459607]: Disconnected from invalid user claude 201.186.40.250 port 50342 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 13:49:32 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<CDjmt59HmJiuijvy>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 87.236.176.202
country_id: 2635167
description:
Jan  5 13:50:02 host2 pure-ftpd[461727]: (?@87.236.176.202) [INFO] New connection from 87.236.176.202


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 13:51:02 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<BkI3vZ9HmlsjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  5 13:50:51 host2 sshd[462619]: Disconnected from invalid user admin 2.57.121.112 port 14226 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.123.109.114
country_id: 732800
description:
Jan  5 13:57:19 host2 sshd[470504]: Invalid user sivagnanamfoundation from 93.123.109.114 port 42184


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 13:58:02 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<FoVD1p9HfudA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 13:58:42 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<Mpqh2J9HEpeOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 13:59:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<DadF3J9HMMNnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.36.254
country_id: 3469034
description:
Jan  5 14:00:14 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=191.240.36.254, lip=66.85.158.91, TLS, session=<iusj3Z9HXNS/8CT+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.32
country_id: 3175395
description:
Jan  5 14:00:31 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<charanaw>, method=PLAIN, rip=185.197.9.32, lip=66.85.158.91, TLS, session=<XPZR3p9Hp565xQkg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  5 14:04:09 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<+7Y97J9HMOMDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  5 14:06:46 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<u7Kg9Z9HrKADgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.152
country_id: 6252001
description:
Jan  5 14:07:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.152, lip=66.85.158.92, session=<iXHC959H7YlAPsWY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  5 14:08:01 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<nwIf+p9HJOUDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  5 14:08:12 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<GoC/+p9Hoo4DgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 14:09:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<SF8c/p9H2o9CdMzo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  5 14:10:35 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<LTVCA6BHGMEDgmBb>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  5 14:10:37 host2 dovecot[1170291]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<JQNhA6BHJMEDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2026-01-05 14:10:41 dovecot_plain authenticator failed for H=c-98-227-25-115.hsd1.il.comcast.net (sessenne) [98.227.25.115]:58746: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  5 14:13:31 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<ALq/DaBHsI4DgmBb>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  5 14:16:17 host2 pure-ftpd[489039]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.202.108.124
country_id: 798544
description:
Jan  5 14:17:15 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=85.202.108.124, lip=66.85.158.91, TLS, session=<3+YhGqBH485Vymx8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.151
country_id: 3469034
description:
Jan  5 14:17:36 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=177.44.96.151, lip=66.85.158.91, TLS, session=<ZwhFG6BHqpyxLGCX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 14:17:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<aKZLHaBHjIlCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 14:21:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<mzVpKKBHlviuijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Jan  5 14:21:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<tu3TKKBHGNAFhH+s>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  5 14:21:34 host2 sshd[494167]: Disconnected from invalid user user 2.57.121.25 port 38671 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 14:23:05 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<aS3WL6BHQmAjupN+>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.83.39.144
country_id: 690791
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 77.83.39.144 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 77.83.39.144
country_id: 690791
description:
Jan  5 14:24:27 host2 sshd[497170]: Invalid user cloudtourssrilan_travel from 77.83.39.144 port 60374


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.174.244.235
country_id: 6252001
description:
Jan  5 14:25:52 host2 pure-ftpd[498906]: (?@172.174.244.235) [INFO] New connection from 172.174.244.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2026-01-05 14:28:10 dovecot_plain authenticator failed for H=c-73-168-136-150.hsd1.il.comcast.net (kupanemism) [73.168.136.150]:39394: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 14:29:01 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<rEwZRaBHAqmOq2dI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-05 14:30:09 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:52181: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.22
country_id: 1733045
description:
2026-01-05 14:32:30 dovecot_login authenticator failed for H=([49.124.153.22]) [49.124.153.22]:55014: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 14:33:35 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<gV9iVaBHypxA46ZK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.123.109.114
country_id: 732800
description:
Jan  5 14:34:36 host2 sshd[507845]: Invalid user sivagnanamfoundation from 93.123.109.114 port 60118


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  5 14:35:50 host2 sshd[509030]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 14:35:42 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<TaTzXKBHIoFnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 14:43:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<qlqbd6BHCp5CdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 14:51:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<6SVdlqBH2rxCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 14:52:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<GD+kmKBHfmquijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 14:55:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<7xWwo6BHeNUjupN+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.161
country_id: 2993457
description:
Jan  5 14:57:27 host2 pure-ftpd[530102]: (?@194.165.16.161) [INFO] New connection from 194.165.16.161


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2026-01-05 14:57:45 dovecot_plain authenticator failed for H=c-73-196-144-25.hsd1.nj.comcast.net (nousher) [73.196.144.25]:45290: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.63
country_id: 1733045
description:
2026-01-05 14:58:16 dovecot_login authenticator failed for H=([49.124.153.63]) [49.124.153.63]:41308: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.199.168.119
country_id: 1880251
description:
Jan  5 14:58:28 host2 sshd[531082]: Disconnected from invalid user test 128.199.168.119 port 59216 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.3.203.151
country_id: 1694008
description:
2026-01-05 14:58:40 dovecot_login authenticator failed for H=(122.3.203.151.static.pldt.net) [122.3.203.151]:58807: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 14:59:40 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<+WytsqBHdr+Oq2dI>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 128.199.168.119
country_id: 1880251
description:
Jan  5 14:59:18 host2 sshd[531965]: Disconnected from invalid user test 128.199.168.119 port 44444 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.213.160.153
country_id: 1269750
description:
Jan  5 15:01:05 host2 sshd[533976]: Disconnected from invalid user claude 4.213.160.153 port 47780 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.199.168.119
country_id: 1880251
description:
Jan  5 15:00:53 host2 sshd[533774]: Disconnected from invalid user claude 128.199.168.119 port 43142 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.213.160.153
country_id: 1269750
description:
Jan  5 15:01:43 host2 sshd[534490]: Disconnected from invalid user test 4.213.160.153 port 50436 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 4.213.160.153
country_id: 1269750
description:
Jan  5 15:03:08 host2 sshd[535888]: Disconnected from invalid user admin 4.213.160.153 port 32878 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.213.160.153
country_id: 1269750
description:
Jan  5 15:05:16 host2 sshd[538048]: Disconnected from invalid user claude 4.213.160.153 port 55846 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.123.109.114
country_id: 732800
description:
Jan  5 15:05:59 host2 sshd[538615]: Invalid user sivagnanamfoundation from 93.123.109.114 port 59466


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2026-01-05 15:08:14 dovecot_plain authenticator failed for H=c-73-183-74-177.hsd1.pa.comcast.net (thodionis) [73.183.74.177]:58236: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
country_id: 290557
description:
2026-01-05 15:08:12 dovecot_plain authenticator failed for H=(snamy) [94.206.93.90]:51185: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 15:09:39 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<cnxf1qBHfs5A46ZK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.54.99.236
country_id: 294640
description:
2026-01-05 15:10:42 dovecot_login authenticator failed for H=(2-54-99-236.orange.net.il) [2.54.99.236]:34275: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.110
country_id: 1269750
description:
2026-01-05 15:10:56 dovecot_login authenticator failed for H=(dsl-ncr-dynamic-169.179.23.125.airtelbroadband.in) [125.23.155.110]:40312: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 15:12:26 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<Rl1U4KBHNIZnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.237.113.106
country_id: 587116
description:
2026-01-05 15:14:50 dovecot_login authenticator failed for H=([109.237.113.106]) [109.237.113.106]:55649: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2026-01-05 15:15:15 dovecot_login authenticator failed for H=([189.59.210.1]) [186.215.245.175]:50926: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.219.54
country_id: 1269750
description:
2026-01-05 15:15:45 dovecot_login authenticator failed for H=([125.21.200.57]) [128.185.219.54]:35770: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.194
country_id: 1269750
description:
2026-01-05 15:15:50 dovecot_login authenticator failed for H=([182.95.115.194]) [182.95.115.194]:36338: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.139.77
country_id: 3144096
description:
2026-01-05 15:16:22 dovecot_login authenticator failed for H=([188.124.139.77]) [188.124.139.77]:34827: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.102
country_id: 1269750
description:
2026-01-05 15:16:42 dovecot_login authenticator failed for H=(nsg-corporate-9.90.186.122.airtel.in) [182.95.228.102]:60926: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 15:17:49 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<shop@seyawin.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<d46Q86BHRKtCdMzo>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  5 15:18:36 host2 sshd[552149]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 119.18.52.5
country_id: 1269750
description:
Jan  5 15:18:41 host2 sshd[552205]: Disconnected from invalid user claude 119.18.52.5 port 37790 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  5 15:20:23 host2 pure-ftpd[554023]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.70.82.95
country_id: 1282988
description:
Jan  5 15:20:44 host2 sshd[554277]: Disconnected from invalid user claude 202.70.82.95 port 62882 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.70.82.95
country_id: 1282988
description:
Jan  5 15:21:29 host2 sshd[554865]: Disconnected from invalid user javad 202.70.82.95 port 32608 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.123.109.114
country_id: 732800
description:
Jan  5 15:22:01 host2 sshd[555304]: Invalid user sivagnanamfoundation from 93.123.109.114 port 49284


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.70.82.95
country_id: 1282988
description:
Jan  5 15:22:17 host2 sshd[555503]: Disconnected from invalid user debian 202.70.82.95 port 24128 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 15:23:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<Vi/GB6FHBOyuijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 15:26:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shop@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<inehEaFHiI9CdMzo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2026-01-05 15:27:19 dovecot_plain authenticator failed for H=c-73-168-136-150.hsd1.il.comcast.net (sking) [73.168.136.150]:40868: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 15:27:47 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<rY0rF6FHWJIjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 15:29:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<AouvHqFHVquOq2dI>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.206.225.82
country_id: 6252001
description:
Jan  5 15:39:52 host2 pure-ftpd[572143]: (?@172.206.225.82) [INFO] New connection from 172.206.225.82


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 15:45:37 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<BvjxVqFHiMBA46ZK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.72
country_id: 2186224
description:
2026-01-05 15:46:57 dovecot_login authenticator failed for H=([121.73.163.72]) [121.73.163.72]:55086: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.30.170
country_id: 3144096
description:
2026-01-05 15:47:14 dovecot_login authenticator failed for H=([178.232.30.170]) [178.232.30.170]:40887: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2026-01-05 15:48:05 dovecot_plain authenticator failed for H=(scousnon) [102.53.15.180]:20852: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 15:48:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<nYkBYKFHBsVnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2026-01-05 15:50:34 dovecot_plain authenticator failed for H=c-24-1-200-187.hsd1.il.comcast.net (adjus) [24.1.200.187]:58074: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 15:50:34 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<9bq2aKFHgqNCdMzo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2026-01-05 15:53:27 dovecot_plain authenticator failed for H=c-73-195-211-98.hsd1.nj.comcast.net (myxont) [73.195.211.98]:43254: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 15:54:05 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<AgJKdaFHmt6uijvy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.185.233
country_id: 6252001
description:
Jan  5 15:57:05 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=44.220.185.233, lip=66.85.158.91, TLS handshaking: Connection closed, session=<DZwsgKFHzpks3Lnp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.185.233
country_id: 6252001
description:
Jan  5 15:57:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=44.220.185.233, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Z795gKFHFuIs3Lnp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2026-01-05 15:57:55 dovecot_plain authenticator failed for H=(taragenes) [90.161.217.228]:57028: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 15:59:02 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<bzYAh6FHoIBCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 15:59:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<GZq8iaFHaoOOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 15:59:27 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<PbCDiKFHOksjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  5 15:59:48 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<ZAy3iaFHyt4FhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.242.2
country_id: 1269750
description:
Jan  5 16:08:43 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=103.18.242.2, lip=66.85.158.91, TLS, session=<WZGpqKFHNtZnEvIC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.216.88.150
country_id: 3469034
description:
Jan  5 16:09:05 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=186.216.88.150, lip=66.85.158.91, TLS, session=<z+rqqaFHupi62FiW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 16:21:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<Kpsb2KFHdJBA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 16:23:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<yMzm3aFHbpdCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 16:23:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<yY7y36FHEotnmud6>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  5 16:25:24 host2 sshd[614787]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 16:25:48 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<sy255qFH6oSuijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 16:30:05 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<UcAJ9qFHUOyOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 16:30:58 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<mYs3+aFHdpsjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 16:31:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<XCn8+6FHdspCdMzo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  5 16:36:33 host2 sshd[625292]: Disconnected from invalid user admin 2.57.121.112 port 37225 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.192.123.12
country_id: 6252001
description:
2026-01-05 16:48:31 dovecot_plain authenticator failed for H=(tonst) [199.192.123.12]:43216: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.40.117.9
country_id: 357994
description:
Jan  5 16:50:47 host2 sshd[640748]: Disconnected from invalid user staging 41.40.117.9 port 10080 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.40.117.9
country_id: 357994
description:
Jan  5 16:51:48 host2 sshd[641704]: Disconnected from invalid user dev 41.40.117.9 port 64591 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.40.117.9
country_id: 357994
description:
Jan  5 16:53:29 host2 sshd[643325]: Disconnected from invalid user vijay 41.40.117.9 port 9265 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.40.117.9
country_id: 357994
description:
Jan  5 16:54:17 host2 sshd[644566]: Disconnected from invalid user postgres 41.40.117.9 port 51814 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 16:55:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<M+dsUaJH5JZCdMzo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.108.134
country_id: 1819730
description:
Jan  5 16:55:20 host2 sshd[645677]: Disconnected from invalid user simon 101.36.108.134 port 38804 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 16:57:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<s0D3WKJH0KlA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 16:57:32 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<tXc9WKJHNO+uijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 16:58:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<cQVvWqJHKIRnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.130.148.217
country_id: 1512440
description:
2026-01-05 16:58:21 dovecot_login authenticator failed for H=([45.130.148.217]) [45.130.148.217]:59222: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.246.106
country_id: 1269750
description:
2026-01-05 16:58:51 dovecot_login authenticator failed for H=([125.16.255.97]) [125.20.246.106]:50198: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.108.134
country_id: 1819730
description:
Jan  5 16:58:58 host2 sshd[648842]: Disconnected from invalid user smbuser 101.36.108.134 port 55484 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-05 16:59:28 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (imathet) [87.103.126.54]:24948: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 17:00:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<fxKGYqJHTuWOq2dI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.108.134
country_id: 1819730
description:
Jan  5 17:01:09 host2 sshd[651170]: Disconnected from invalid user tutor 101.36.108.134 port 43628 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 17:03:02 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<MeDna6JHkpojupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 17:03:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<BQ3XbqJHYrVCdMzo>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  5 17:08:28 host2 sshd[658125]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.54
country_id: 1269750
description:
2026-01-05 17:16:43 dovecot_login authenticator failed for H=(nsg-corporate-54.202.186.122.airtel.in) [122.186.202.54]:36072: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
country_id: 99237
description:
2026-01-05 17:16:27 dovecot_login authenticator failed for H=([65.20.191.12]) [65.20.191.12]:54854: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.192.85.86
country_id: 3175395
description:
2026-01-05 17:18:25 dovecot_login authenticator failed for H=([2.192.85.86]) [2.192.85.86]:57364: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.111.140
country_id: 1269750
description:
2026-01-05 17:18:54 dovecot_login authenticator failed for H=(abts-mum-static-140.111.170.122.airtelbroadband.in) [122.170.111.140]:44074: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  5 17:21:29 host2 sshd[671971]: Disconnected from invalid user user 2.57.121.25 port 27337 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.135.131
country_id: 6252001
description:
Jan  5 17:24:29 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=71.6.135.131, lip=66.85.158.92, session=<5u60uKJHAupHBoeD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.66
country_id: 6252001
description:
Jan  5 17:25:36 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=216.218.206.66, lip=66.85.158.92, TLS handshaking: Connection closed, session=<fL6uvKJHYLjY2s5C>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.66
country_id: 6252001
description:
Jan  5 17:26:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=216.218.206.66, lip=66.85.158.92, TLS: Connection closed, session=<nyjvvqJHEqrY2s5C>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 17:27:42 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<jhgTxKJHWplCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 17:29:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<pxJlyqJH9KWuijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 17:30:51 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<R6Niz6JHSumOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 17:31:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=</p9K0KJHxphnmud6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 13.86.113.214
country_id: 6252001
description:
Jan  5 17:31:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=13.86.113.214, lip=66.85.158.92, session=<3nge06JH4McNVnHW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  5 17:32:09 host2 sshd[682270]: Disconnected from invalid user admin 2.57.121.112 port 25779 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  5 17:32:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<w6Lv1KJHyJQFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 17:34:17 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<q6mi26JHcsVA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 17:35:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=</+qY36JH1iwjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 17:36:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<y8zu4aJH0OdCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.114
country_id: 3865483
description:
Jan  5 17:39:32 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=179.0.252.114, lip=66.85.158.91, TLS, session=<bfVO7aJHVdWzAPxy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.248.32
country_id: 798544
description:
Jan  5 17:39:50 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<charanaw>, method=PLAIN, rip=109.125.248.32, lip=66.85.158.91, TLS, session=<5sOi7qJHnuFtffgg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 119.18.55.118
country_id: 1269750
description:
Jan  5 17:41:28 host2 sshd[691468]: Disconnected from invalid user localuser 119.18.55.118 port 38408 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.132.68.222
country_id: 3932488
description:
Jan  5 17:43:58 host2 sshd[693522]: Disconnected from invalid user claude 161.132.68.222 port 50562 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.68.222
country_id: 3932488
description:
Jan  5 17:43:11 host2 sshd[692939]: Disconnected from invalid user admin 161.132.68.222 port 40502 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.68.222
country_id: 3932488
description:
Jan  5 17:44:40 host2 sshd[694241]: Disconnected from invalid user compiler 161.132.68.222 port 33646 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.68.222
country_id: 3932488
description:
Jan  5 17:45:22 host2 sshd[695127]: Disconnected from invalid user abc 161.132.68.222 port 60008 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.247.47.169
country_id: 3175395
description:
2026-01-05 17:45:28 dovecot_login authenticator failed for H=host-95-247-47-169.retail.telecomitalia.it [95.247.47.169]:45478: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 57.128.182.5
country_id: 2635167
description:
Jan  5 17:45:48 host2 sshd[695938]: Disconnected from invalid user support 57.128.182.5 port 47158 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.89.227.161
country_id: 192950
description:
Jan  5 17:46:30 host2 sshd[696485]: Disconnected from invalid user rocky 41.89.227.161 port 58918 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.89.227.161
country_id: 192950
description:
Jan  5 17:48:01 host2 sshd[697839]: Disconnected from invalid user amir 41.89.227.161 port 51344 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-05 17:52:39 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:51661: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 18:00:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<iUEgOaNHOoBCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 18:00:14 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<401yOKNHYFauijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 18:01:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<2eGOPKNHxOyOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 18:04:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<vZMNR6NHGJZnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.239.41.74
country_id: 3469034
description:
2026-01-05 18:07:22 dovecot_login authenticator failed for H=(201-28-33-49.customer.tdatabrasil.net.br) [186.239.41.74]:39581: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.129.57.71
country_id: 6252001
description:
2026-01-05 18:07:22 dovecot_plain authenticator failed for H=c-73-129-57-71.hsd1.md.comcast.net (oushiturop) [73.129.57.71]:52024: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 18:07:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<iJQOUqNHhKQjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.56
country_id: 99237
description:
2026-01-05 18:07:38 dovecot_login authenticator failed for H=([65.20.133.56]) [65.20.133.56]:47605: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.19.165.90
country_id: 3469034
description:
2026-01-05 18:08:08 dovecot_login authenticator failed for H=(secovi-rs.pae.gvt.net.br) [177.19.165.90]:33067: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 18:08:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<4dfPVqNH/uxCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 18:10:34 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shop@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<gGJhXaNHvq5A46ZK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.129.57.71
country_id: 6252001
description:
2026-01-05 18:11:07 dovecot_plain authenticator failed for H=c-73-129-57-71.hsd1.md.comcast.net (pleaton) [73.129.57.71]:44326: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  5 18:15:29 host2 sshd[728803]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.44.40
country_id: 1522867
description:
2026-01-05 18:16:38 dovecot_plain authenticator failed for H=(detally) [5.76.44.40]:34980: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.144.27.228
country_id: 6252001
description:
2026-01-05 18:22:10 dovecot_plain authenticator failed for H=c-73-144-27-228.hsd1.mi.comcast.net (bizessess) [73.144.27.228]:45268: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Jan  5 18:23:49 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.91, TLS: Connection closed, session=<6d/jjKNH6pqLonHU>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  5 18:27:55 host2 sshd[740224]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.172
country_id: 1733045
description:
2026-01-05 18:27:34 dovecot_login authenticator failed for H=([49.124.154.172]) [49.124.154.172]:40930: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.66
country_id: 1733045
description:
2026-01-05 18:28:14 dovecot_login authenticator failed for H=([49.125.201.66]) [49.125.201.66]:41652: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 18:30:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<nOfJo6NH2Pyuijvy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2026-01-05 18:30:53 dovecot_login authenticator failed for H=(visaotur.sdr.gvt.net.br) [186.215.245.175]:36013: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 18:31:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<vSJSqKNHlJqOq2dI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.19.112
country_id: 298795
description:
2026-01-05 18:31:50 dovecot_login authenticator failed for H=([188.59.19.112]) [188.59.19.112]:52682: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.38
country_id: 1269750
description:
2026-01-05 18:31:19 dovecot_login authenticator failed for H=(nsg-corporate-38.230.187.122.airtel.in) [122.187.230.38]:34340: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 18:32:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<haHNrKNHwNVCdMzo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.192.66
country_id: 6252001
description:
Jan  5 18:37:06 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.65.192.66, lip=66.85.158.91, session=<3vpovKNHzuoUQcBC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 18:37:14 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<rJzBvKNHlodnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 18:39:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<Kde6xKNHjOojupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan  5 18:40:02 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<6lfrxqNHqK4DlTsa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 18:40:58 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<Js8cyqNHeo9CdMzo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan  5 18:41:07 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<Pg/ByqNHgLUDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan  5 18:42:06 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: Connection closed, session=<lXBFzqNHXMkDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan  5 18:42:53 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<ujgU0aNH8rYDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan  5 18:43:22 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS, session=<2yrZ0qNHstIDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan  5 18:44:24 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS, session=<DsJ/1qNHkrQDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan  5 18:45:55 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<B2P426NHZKEDlTsa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 18:46:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<nrqJ3aNHgt9A46ZK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan  5 18:46:26 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: Connection closed, session=<bdfF3aNHVLkDlTsa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.231.121.22
country_id: 798544
description:
Jan  5 18:47:17 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=91.231.121.22, lip=66.85.158.91, TLS, session=<TAfX36NHxsxb53kW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.230.228.16
country_id: 6252001
description:
2026-01-05 18:47:30 dovecot_plain authenticator failed for H=c-71-230-228-16.hsd1.de.comcast.net (ratercines) [71.230.228.16]:58656: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.201.109
country_id: 3469034
description:
Jan  5 18:47:38 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw>, method=PLAIN, rip=179.189.201.109, lip=66.85.158.91, TLS, session=<5Uj64KNHg+Wzvclt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan  5 18:47:46 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS, session=<KrqQ4qNHQLMDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan  5 18:48:39 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS, session=<0yaz5aNH8IADlTsa>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  5 18:54:10 host2 sshd[766535]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 216.218.206.68
country_id: 6252001
description:
Jan  5 18:55:47 host2 pure-ftpd[768482]: (?@216.218.206.68) [INFO] New connection from 216.218.206.68


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.52
country_id: 6252001
description:
Jan  5 18:56:39 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.52, lip=66.85.158.92, TLS: Connection closed, session=<F2pNAqRHsEOnXpI0>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  5 18:58:45 host2 sshd[771222]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 19:01:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<9CHHEaRHlKSuijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.5.89
country_id: 690791
description:
Jan  5 19:01:05 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=176.103.5.89, lip=66.85.158.91, TLS, session=<qU0ZEaRHd7mwZwVZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 19:02:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<pqqBFaRHnr2Oq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.167.160
country_id: 99237
description:
Jan  5 19:01:24 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=65.20.167.160, lip=66.85.158.91, TLS, session=<2mJBEqRHOOFBFKeg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.135
country_id: 6252001
description:
Jan  5 19:02:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.135, lip=66.85.158.92, TLS: Connection closed, session=<nhU4FqRHnsVChJmH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 19:05:04 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<XANIIKRHiNdCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 19:10:39 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<32xINKRH5q1nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 19:11:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<P2sfOKRHhjMjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.255.45
country_id: 597427
description:
2026-01-05 19:13:04 dovecot_plain authenticator failed for H=(yN3pxYynSq_mail.txt) [104.28.255.45]:19332: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 19:13:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<Xm0aPqRHALxCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 19:22:49 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<R7PFX6RHZoBA46ZK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.144.27.228
country_id: 6252001
description:
2026-01-05 19:31:51 dovecot_plain authenticator failed for H=c-73-144-27-228.hsd1.mi.comcast.net (defeatia) [73.144.27.228]:48276: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 19:31:59 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<CC2RgKRHZp+uijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 19:32:41 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<iQ0Yg6RHQLqOq2dI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2026-01-05 19:35:32 dovecot_plain authenticator failed for H=c-24-1-200-187.hsd1.il.comcast.net (hyped) [24.1.200.187]:40134: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-05 19:36:39 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (ivellfics) [87.103.126.54]:42549: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 19:37:35 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<ciKTlKRHfJVCdMzo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.164.134.19
country_id: 1835841
description:
Jan  5 19:38:32 host2 sshd[816030]: Disconnected from invalid user claude 43.164.134.19 port 41756 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.38.101.192
country_id: 130758
description:
Jan  5 19:38:38 host2 sshd[816140]: Disconnected from invalid user ali 95.38.101.192 port 51544 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.164.134.19
country_id: 1835841
description:
Jan  5 19:39:14 host2 sshd[816912]: Disconnected from invalid user nikola 43.164.134.19 port 55510 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.194.4.255
country_id: 1880251
description:
Jan  5 19:39:24 host2 sshd[817162]: Disconnected from invalid user nikola 4.194.4.255 port 55430 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.144.233.139
country_id: 2921044
description:
Jan  5 19:40:45 host2 sshd[819241]: Disconnected from invalid user qadmin 45.144.233.139 port 47428 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.164.134.19
country_id: 1835841
description:
Jan  5 19:41:26 host2 sshd[819969]: Disconnected from invalid user cesar 43.164.134.19 port 40344 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.144.233.139
country_id: 2921044
description:
Jan  5 19:42:24 host2 sshd[821041]: Disconnected from invalid user administrator 45.144.233.139 port 36334 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.144.233.139
country_id: 2921044
description:
Jan  5 19:43:27 host2 sshd[822021]: Disconnected from invalid user ftpuser 45.144.233.139 port 56304 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.38.101.192
country_id: 130758
description:
Jan  5 19:43:40 host2 sshd[822230]: Disconnected from invalid user newuser 95.38.101.192 port 51778 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 19:43:53 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<LY0Xq6RH1uMjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 19:43:58 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<jkFpq6RHlJBnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.38.101.192
country_id: 130758
description:
Jan  5 19:44:42 host2 sshd[823504]: Disconnected from invalid user claude 95.38.101.192 port 51874 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.165
country_id: 6252001
description:
Jan  5 19:44:51 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 22 secs): user=<>, rip=147.185.133.165, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<JWCzrqRH6NmTuYWl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.165
country_id: 6252001
description:
Jan  5 19:45:48 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 15 secs): user=<>, rip=147.185.133.165, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<0ecZsqRHCPWTuYWl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  5 19:46:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<eErdsqRHHsAFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 19:46:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<nQTcsqRHrqJCdMzo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.154
country_id: 1269750
description:
2026-01-05 19:46:06 dovecot_login authenticator failed for H=([128.185.223.87]) [182.95.178.154]:48862: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.165
country_id: 6252001
description:
Jan  5 19:46:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 13 secs): user=<>, rip=147.185.133.165, lip=66.85.158.92, TLS: read(size=429) failed: Connection reset by peer, session=<8oyzs6RH7vCTuYWl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2026-01-05 19:46:33 dovecot_login authenticator failed for H=(163.pool90-160-139.dynamic.orange.es) [90.160.139.163]:56549: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 4.194.4.255
country_id: 1880251
description:
Jan  5 19:48:34 host2 sshd[828823]: Disconnected from invalid user joseph 4.194.4.255 port 51364 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.194.4.255
country_id: 1880251
description:
Jan  5 19:49:17 host2 sshd[829751]: Disconnected from invalid user ubuntu 4.194.4.255 port 38592 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.202.9.133
country_id: 6252001
description:
Jan  5 19:50:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.202.9.133, lip=66.85.158.92, TLS: Connection closed, session=<A+H6wqRH2tsjygmF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.165
country_id: 6252001
description:
Jan  5 19:52:59 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.133.165, lip=66.85.158.92, TLS, session=<b/jDy6RHsPmTuYWl>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  5 20:00:02 host2 sshd[841143]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 19:59:35 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<FIFN46RHyKpA46ZK>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 159.65.206.235
country_id: 2750405
description:
Jan  5 20:01:11 host2 pure-ftpd[842566]: (?@159.65.206.235) [INFO] New connection from 159.65.206.235


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 20:03:29 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<WLw48aRHGtiOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 20:03:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<CihI8aRHlnauijvy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.199.210.33
country_id: 130758
description:
2026-01-05 20:05:48 dovecot_plain authenticator failed for H=(T31NGXPI6836) [185.199.210.33]:50436: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 212.87.243.85
country_id: 798544
description:
Jan  5 20:09:00 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<hr>, method=PLAIN, rip=212.87.243.85, lip=66.85.158.91, TLS, session=<c1IPBKVHiLLUV/NV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.130.168.211
country_id: 3469034
description:
Jan  5 20:09:05 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<hr>, method=PLAIN, rip=177.130.168.211, lip=66.85.158.91, TLS, session=<gMQSBKVHOoOxgqjT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.39.39
country_id: 953987
description:
Jan  5 20:08:41 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=102.64.39.39, lip=66.85.158.91, TLS, session=<GyDAAqVHI5lmQCcn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.42.59
country_id: 953987
description:
Jan  5 20:08:42 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=102.64.42.59, lip=66.85.158.91, TLS, session=<tP+/AqVH165mQCo7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 20:10:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<zULJCqVHTrhCdMzo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  5 20:15:56 host2 sshd[858859]: Disconnected from invalid user admin 2.57.121.112 port 31498 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 20:15:59 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<kqrlHaVH3p8jupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 20:17:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<HQWII6VHLoRnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 20:19:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<1rdEKaVH4LNCdMzo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.21
country_id: 6252001
description:
Jan  5 20:21:01 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=162.216.149.21, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<VO8GMKVHbsyi2JUV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.21
country_id: 6252001
description:
Jan  5 20:21:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 10 secs): user=<>, rip=162.216.149.21, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<JKFZMaVH4v2i2JUV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.21
country_id: 6252001
description:
Jan  5 20:27:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.21, lip=66.85.158.91, TLS, session=<4E0ERqVHyvei2JUV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 20:34:01 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<w09dXqVHApKuijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 20:34:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<HOoYX6VH0KqOq2dI>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  5 20:36:18 host2 sshd[880054]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 20:36:17 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<qQWDZqVHIINA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 20:44:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@seyawin.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<dw6ygqVHbJxCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 20:47:57 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<m1pGkKVHtm4jupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 20:50:42 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<Rn4NmqVHHqZnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.47.162.51
country_id: 719819
description:
Jan  5 20:51:08 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=185.47.162.51, lip=66.85.158.91, TLS, session=<MkSzmqVHZ6C5L6Iz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.45.167.121
country_id: 2510769
description:
Jan  5 20:51:25 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<charanaw>, method=PLAIN, rip=5.45.167.121, lip=66.85.158.91, TLS, session=<c6DOm6VHQ7QFLad5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 20:52:57 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<zVIloqVHqM1CdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 21:04:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<C5jizKVH1uCOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.66.114.43
country_id: 1269750
description:
Jan  5 21:05:00 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=103.66.114.43, lip=66.85.158.91, TLS, session=<rAU6zKVH0ONnQnIr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.200.26.39
country_id: 3175395
description:
Jan  5 21:05:20 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=193.200.26.39, lip=66.85.158.91, TLS, session=<Sft3zaVH+c3ByBon>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 21:05:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<i/MDz6VHAG2uijvy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-05 21:13:21 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:51141: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 21:13:37 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<sfcH7KVHAshA46ZK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.221.87
country_id: 1880251
description:
Jan  5 21:17:36 host2 sshd[924260]: Disconnected from invalid user claude 45.78.221.87 port 58616 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 207.90.244.14
country_id: 6252001
description:
Jan  5 21:17:41 host2 dovecot[1170291]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=207.90.244.14, lip=66.85.158.92, session=<aea0+qVHIMHPWvQO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.14
country_id: 6252001
description:
Jan  5 21:17:43 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=207.90.244.14, lip=66.85.158.92, session=<lbjL+qVH4OLPWvQO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.202.9.133
country_id: 6252001
description:
Jan  5 21:18:34 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.202.9.133, lip=66.85.158.92, TLS: Connection closed, session=<5ZjY/aVHAN4jygmF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 21:18:35 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<03/O/aVHaolCdMzo>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  5 21:19:43 host2 sshd[926750]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.198.215.66
country_id: 241170
description:
Jan  5 21:19:56 host2 sshd[926995]: Disconnected from invalid user deploy 154.198.215.66 port 59406 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 21:20:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<UVN6A6ZH/pcjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.198.215.66
country_id: 241170
description:
Jan  5 21:20:39 host2 sshd[927906]: Disconnected from invalid user claude 154.198.215.66 port 43004 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.198.215.66
country_id: 241170
description:
Jan  5 21:21:51 host2 sshd[929420]: Disconnected from invalid user claude 154.198.215.66 port 38392 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.190.11.45
country_id: 1210997
description:
Jan  5 21:22:29 host2 sshd[930051]: Disconnected from invalid user soc 203.190.11.45 port 35386 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.144.167
country_id: 1861060
description:
Jan  5 21:22:22 host2 sshd[929953]: Disconnected from invalid user bitrix 152.32.144.167 port 45144 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.198.215.66
country_id: 241170
description:
Jan  5 21:22:26 host2 sshd[930011]: Disconnected from invalid user patrick 154.198.215.66 port 50194 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.190.11.45
country_id: 1210997
description:
Jan  5 21:24:09 host2 sshd[932223]: Disconnected from invalid user elasticsearch 203.190.11.45 port 46862 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.144.167
country_id: 1861060
description:
Jan  5 21:23:42 host2 sshd[931576]: Disconnected from invalid user pzuser 152.32.144.167 port 34054 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.198.215.66
country_id: 241170
description:
Jan  5 21:24:13 host2 sshd[932310]: Disconnected from invalid user milad 154.198.215.66 port 57386 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 21:24:16 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<LishEqZHbMhnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.144.167
country_id: 1861060
description:
Jan  5 21:24:19 host2 sshd[932575]: Disconnected from invalid user claude 152.32.144.167 port 60886 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.131.63
country_id: 99237
description:
2026-01-05 21:25:05 dovecot_login authenticator failed for H=([65.20.131.63]) [65.20.131.63]:53868: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.17.38
country_id: 3469034
description:
2026-01-05 21:25:24 dovecot_login authenticator failed for H=([186.239.246.145]) [187.8.17.38]:33589: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.144.35
country_id: 1643084
description:
Jan  5 21:26:26 host2 sshd[934847]: Disconnected from invalid user hi 103.217.144.35 port 49370 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.190.11.45
country_id: 1210997
description:
Jan  5 21:27:20 host2 sshd[935912]: Disconnected from invalid user patrick 203.190.11.45 port 58542 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 21:27:17 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<kl/lHKZHRoFCdMzo>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 203.190.11.45
country_id: 1210997
description:
Jan  5 21:29:55 host2 sshd[938985]: Disconnected from invalid user dev1 203.190.11.45 port 44996 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.190.11.45
country_id: 1210997
description:
Jan  5 21:30:37 host2 sshd[940361]: Disconnected from invalid user postgres 203.190.11.45 port 60014 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.221.87
country_id: 1880251
description:
Jan  5 21:33:06 host2 sshd[943179]: Disconnected from invalid user daisy 45.78.221.87 port 58624 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.221.232.44
country_id: 878675
description:
Jan  5 21:33:26 host2 sshd[943516]: Disconnected from invalid user claude 197.221.232.44 port 36888 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.144.35
country_id: 1643084
description:
Jan  5 21:35:00 host2 sshd[947906]: Disconnected from invalid user claude 103.217.144.35 port 51214 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.221.89
country_id: 1880251
description:
Jan  5 21:34:15 host2 sshd[944358]: Disconnected from invalid user claude 45.78.221.89 port 57286 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.221.87
country_id: 1880251
description:
Jan  5 21:34:17 host2 sshd[944428]: Disconnected from invalid user claude 45.78.221.87 port 51888 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.154.125.60
country_id: 6251999
description:
Jan  5 21:35:33 host2 sshd[954847]: Disconnected from invalid user claude 66.154.125.60 port 57154 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 21:35:47 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<cU1OO6ZHtseOq2dI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.47.217
country_id: 6252001
description:
Jan  5 21:36:44 host2 sshd[959934]: Disconnected from invalid user dev 209.141.47.217 port 34786 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.221.87
country_id: 1880251
description:
Jan  5 21:36:48 host2 sshd[959847]: Disconnected from invalid user elasticsearch 45.78.221.87 port 54188 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 21:37:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<7S+6QKZHxCuuijvy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.47.217
country_id: 6252001
description:
Jan  5 21:38:45 host2 sshd[962487]: Disconnected from invalid user claude 209.141.47.217 port 58500 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.221.232.44
country_id: 878675
description:
Jan  5 21:38:47 host2 sshd[962491]: Disconnected from invalid user claude 197.221.232.44 port 55576 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 66.154.125.60
country_id: 6251999
description:
Jan  5 21:39:01 host2 sshd[962805]: Disconnected from invalid user cmm 66.154.125.60 port 57310 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.144.35
country_id: 1643084
description:
Jan  5 21:38:12 host2 sshd[961781]: Disconnected from invalid user soc 103.217.144.35 port 33780 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.154.125.60
country_id: 6251999
description:
Jan  5 21:38:25 host2 sshd[962084]: Disconnected from invalid user postgres 66.154.125.60 port 57242 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.122.23
country_id: 1819730
description:
Jan  5 21:39:18 host2 sshd[963079]: Disconnected from invalid user claude 101.36.122.23 port 42312 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.132.137
country_id: 1819730
description:
Jan  5 21:40:28 host2 sshd[965032]: Disconnected from invalid user vijay 128.1.132.137 port 44624 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.221.232.44
country_id: 878675
description:
Jan  5 21:40:16 host2 sshd[964674]: Disconnected from invalid user claude 197.221.232.44 port 43810 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 18.224.184.103
country_id: 6252001
description:
Jan  5 21:40:27 host2 pure-ftpd[965021]: (?@18.224.184.103) [INFO] New connection from 18.224.184.103


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.224.184.103
country_id: 6252001
description:
Jan  5 21:40:27 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=18.224.184.103, lip=66.85.158.91, TLS handshaking: Connection closed, session=<vNAjTKZHrpkS4Lhn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.14
country_id: 6252001
description:
Jan  5 21:40:33 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=207.90.244.14, lip=66.85.158.91, session=<a1+BTKZHxuDPWvQO>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 207.90.244.14
country_id: 6252001
description:
Jan  5 21:40:33 host2 dovecot[1170291]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 2 secs): user=<>, rip=207.90.244.14, lip=66.85.158.91, session=<B9t1TKZHrODPWvQO>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.122.23
country_id: 1819730
description:
Jan  5 21:40:43 host2 sshd[965319]: Disconnected from invalid user claude 101.36.122.23 port 50956 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.47.217
country_id: 6252001
description:
Jan  5 21:41:32 host2 sshd[966431]: Disconnected from invalid user claude 209.141.47.217 port 48728 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.221.232.44
country_id: 878675
description:
Jan  5 21:41:43 host2 sshd[966659]: Disconnected from invalid user claude 197.221.232.44 port 37400 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.154.125.60
country_id: 6251999
description:
Jan  5 21:41:24 host2 sshd[966199]: Disconnected from invalid user dev 66.154.125.60 port 57578 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 128.1.132.137
country_id: 1819730
description:
Jan  5 21:43:15 host2 sshd[968559]: Disconnected from invalid user staging 128.1.132.137 port 47756 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 21:50:59 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<9QapcaZH1NxA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 21:52:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@seyawin.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<VrZ6dqZHJJ9CdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 21:52:26 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<+7jbdqZHnFcjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.5.189.129
country_id: 241170
description:
Jan  5 21:54:16 host2 sshd[994891]: Disconnected from invalid user tester 69.5.189.129 port 44734 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.45.100.0
country_id: 3469034
description:
Jan  5 21:54:25 host2 sshd[995034]: Disconnected from invalid user ftpuser 187.45.100.0 port 54116 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.73.135.75
country_id: 3865483
description:
Jan  5 21:55:31 host2 sshd[996275]: Disconnected from invalid user ubuntu 200.73.135.75 port 55060 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 72.240.125.133
country_id: 6252001
description:
Jan  5 21:55:21 host2 sshd[996094]: Disconnected from invalid user claude 72.240.125.133 port 47198 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.226.65
country_id: 1880251
description:
Jan  5 21:55:30 host2 sshd[996269]: Disconnected from invalid user admin 45.78.226.65 port 35640 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.73.135.75
country_id: 3865483
description:
Jan  5 21:56:52 host2 sshd[997684]: Disconnected from invalid user claude 200.73.135.75 port 49640 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 72.240.125.133
country_id: 6252001
description:
Jan  5 21:56:58 host2 sshd[997773]: Disconnected from invalid user vpnuser 72.240.125.133 port 54010 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.5.189.129
country_id: 241170
description:
Jan  5 21:58:28 host2 sshd[999295]: Disconnected from invalid user deploy 69.5.189.129 port 52122 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.3.182
country_id: 1269750
description:
Jan  5 21:58:48 host2 sshd[999615]: Disconnected from invalid user claude 139.59.3.182 port 54878 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 21:58:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<FJfPi6ZH/s5nmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.73.135.75
country_id: 3865483
description:
Jan  5 21:58:23 host2 sshd[999234]: Disconnected from invalid user claude 200.73.135.75 port 44226 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.3.182
country_id: 1269750
description:
Jan  5 21:59:28 host2 sshd[1000224]: Disconnected from invalid user oracle 139.59.3.182 port 59730 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 69.5.189.129
country_id: 241170
description:
Jan  5 21:59:32 host2 sshd[1000287]: Disconnected from invalid user john 69.5.189.129 port 60062 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 72.240.125.133
country_id: 6252001
description:
Jan  5 22:00:09 host2 sshd[1001203]: Received disconnect from 72.240.125.133 port 39390:11: Bye Bye [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 22:00:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<uE92lKZHpMZCdMzo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.33.210.213
country_id: 3686110
description:
Jan  5 22:00:58 host2 sshd[1002056]: Disconnected from invalid user claude 179.33.210.213 port 43386 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.21.178
country_id: 1880251
description:
Jan  5 22:01:19 host2 sshd[1002429]: Disconnected from invalid user michael 103.210.21.178 port 47720 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.33.210.213
country_id: 3686110
description:
Jan  5 22:01:42 host2 sshd[1002733]: Disconnected from invalid user claude 179.33.210.213 port 56954 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.202.197.108
country_id: 6252001
description:
2026-01-05 22:01:09 dovecot_plain authenticator failed for H=(asted) [50.202.197.108]:48131: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 72.240.125.133
country_id: 6252001
description:
Jan  5 22:01:10 host2 sshd[1002291]: Disconnected from invalid user claude 72.240.125.133 port 34522 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.3.182
country_id: 1269750
description:
Jan  5 22:02:53 host2 sshd[1003876]: Disconnected from invalid user ubuntu 139.59.3.182 port 54506 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.21.178
country_id: 1880251
description:
Jan  5 22:03:34 host2 sshd[1004700]: Disconnected from invalid user claude 103.210.21.178 port 33634 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 208.69.84.112
country_id: 6252001
description:
Jan  5 22:03:42 host2 sshd[1004900]: Disconnected from invalid user git 208.69.84.112 port 41320 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.45.100.0
country_id: 3469034
description:
Jan  5 22:04:24 host2 sshd[1005734]: Disconnected from invalid user ubuntu 187.45.100.0 port 58927 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.210.21.178
country_id: 1880251
description:
Jan  5 22:04:41 host2 sshd[1005946]: Disconnected from invalid user bruno 103.210.21.178 port 58878 [preauth]


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 43.241.36.24
country_id: 1269750
description:
[2026-01-05 22:05:26 +0530] info [cpaneld] 43.241.36.24 - yashiholdings "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yashiholdings (has_cpuser_file failed)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 43.241.36.24
country_id: 1269750
description:
Login Blocked: IP reached maximum auth failures [Service]=[cpaneld] [Local IP Address]=[66.85.158.91] [Local Port]=[2083] [Remote IP Address]=[43.241.36.24] [Remote Port]=[11647] [Authentication Database]=[system] [Username]=[yashiholdings] (5/5 failures) (blocked until [Mon Jan  5 16:50:23 2026 UTC/Mon Jan  5 22:20:23 2026 LOCAL])


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.241.36.24
country_id: 1269750
description:
[2026-01-05 22:05:19 +0530] info [cpaneld] 43.241.36.24 - yashiholdings "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yashiholdings (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 22:06:32 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<LcpGqaZHtJGOq2dI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.182.83.231
country_id: 2510769
description:
Jan  5 22:07:25 host2 sshd[1009312]: Disconnected from invalid user test 5.182.83.231 port 40220 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 5.182.83.231
country_id: 2510769
description:
Jan  5 22:08:23 host2 sshd[1010566]: Disconnected from invalid user ftptest 5.182.83.231 port 45730 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 208.69.84.112
country_id: 6252001
description:
Jan  5 22:08:48 host2 sshd[1011041]: Disconnected from invalid user ts 208.69.84.112 port 34610 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 22:09:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<GwvcsqZH8vWuijvy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.160.152
country_id: 6252001
description:
Jan  5 22:09:45 host2 sshd[1012289]: Disconnected from invalid user claude 107.173.160.152 port 42398 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 105.247.69.196
country_id: 953987
description:
Jan  5 22:09:49 host2 sshd[1012263]: Disconnected from invalid user yang 105.247.69.196 port 36000 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.182.83.231
country_id: 2510769
description:
Jan  5 22:10:13 host2 sshd[1013175]: Disconnected from invalid user ec2-user 5.182.83.231 port 49276 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 208.69.84.112
country_id: 6252001
description:
Jan  5 22:11:06 host2 sshd[1014474]: Disconnected from invalid user jerry 208.69.84.112 port 52582 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.226.65
country_id: 1880251
description:
Jan  5 22:10:11 host2 sshd[1013121]: Disconnected from invalid user toto 45.78.226.65 port 43592 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 208.69.84.112
country_id: 6252001
description:
Jan  5 22:13:31 host2 sshd[1017584]: Disconnected from invalid user asep 208.69.84.112 port 52018 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.45.100.0
country_id: 3469034
description:
Jan  5 22:14:26 host2 sshd[1018543]: Disconnected from invalid user support 187.45.100.0 port 49317 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.173.160.152
country_id: 6252001
description:
Jan  5 22:15:15 host2 sshd[1019659]: Disconnected from invalid user myuser 107.173.160.152 port 57352 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 71.75.43.232
country_id: 6252001
description:
Jan  5 22:16:33 host2 dovecot[1170291]: imap-login: Disconnected: Aborted login by logging out (auth failed, 1 attempts in 2 secs): user=<training@v-deploy.com>, method=PLAIN, rip=71.75.43.232, lip=66.85.158.91, TLS, session=<9DIbzaZHJOhHSyvo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.164.81.65
country_id: 1819730
description:
Jan  5 22:18:38 host2 sshd[1022707]: Disconnected from invalid user claude 103.164.81.65 port 51442 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.161.56.210
country_id: 6252001
description:
Jan  5 22:18:56 host2 sshd[1023094]: Disconnected from invalid user test 203.161.56.210 port 54466 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 203.161.56.210
country_id: 6252001
description:
Jan  5 22:19:35 host2 sshd[1023621]: Disconnected from invalid user openstack 203.161.56.210 port 46980 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.164.81.65
country_id: 1819730
description:
Jan  5 22:21:29 host2 sshd[1025676]: Disconnected from invalid user alex 103.164.81.65 port 42584 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.161.56.210
country_id: 6252001
description:
Jan  5 22:21:51 host2 sshd[1025991]: Disconnected from invalid user carla 203.161.56.210 port 55236 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.80.200.216
country_id: 6252001
description:
Jan  5 22:22:14 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=40.80.200.216, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<txGG4aZH0qUoUMjY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.19
country_id: 798549
description:
Jan  5 22:22:48 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.19, lip=66.85.158.92, session=<wgSO46ZHjqhV2ZUT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.202.197.108
country_id: 6252001
description:
2026-01-05 22:23:11 dovecot_plain authenticator failed for H=(thess) [50.202.197.108]:35016: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.118
country_id: 6252001
description:
Jan  5 22:23:23 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.118, lip=66.85.158.92, TLS: Connection closed, session=<cOyr5aZHKqFChJl2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 22:24:39 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<kGAY6qZHPEQjupN+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.196.9.133
country_id: 2635167
description:
Jan  5 22:24:42 host2 sshd[1028935]: Disconnected from invalid user gitlab-runner 185.196.9.133 port 49876 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 22:25:06 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<JoCq66ZHpK1CdMzo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.9.133
country_id: 2635167
description:
Jan  5 22:24:14 host2 sshd[1028488]: Disconnected from invalid user claude 185.196.9.133 port 58114 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-05 22:24:38 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (sanes) [87.103.126.54]:48302: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.9.133
country_id: 2635167
description:
Jan  5 22:25:17 host2 sshd[1029867]: Disconnected from invalid user postgres 185.196.9.133 port 46826 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.9.133
country_id: 2635167
description:
Jan  5 22:26:19 host2 sshd[1031086]: Disconnected from invalid user example 185.196.9.133 port 42098 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.202
country_id: 1149361
description:
2026-01-05 22:27:05 dovecot_login authenticator failed for H=([180.94.75.202]) [180.94.75.202]:43721: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  5 22:27:27 host2 sshd[1032020]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 22:27:51 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<CC+B9aZHUtVA46ZK>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.94.210.79
country_id: 2750405
description:
Jan  5 22:33:04 host2 pure-ftpd[1037623]: (?@158.94.210.79) [INFO] New connection from 158.94.210.79


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 22:32:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<iWOKBadHvuhnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 22:33:32 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<UvrPCadH/KZCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.140.123.15
country_id: 6290252
description:
Jan  5 22:35:51 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=95.140.123.15, lip=66.85.158.91, TLS, session=<InczEadHIJNfjHsP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.109.166.27
country_id: 3469034
description:
Jan  5 22:36:11 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw>, method=PLAIN, rip=187.109.166.27, lip=66.85.158.91, TLS, session=<tmxbEqdH6J+7baYb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 22:37:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<9xIDGKdHttuOq2dI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.195.121
country_id: 6252001
description:
Jan  5 22:37:30 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.65.195.121, lip=66.85.158.91, TLS handshaking: Connection closed, session=<A0kkGKdH1qAUQcN5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  5 22:39:44 host2 sshd[1043980]: Disconnected from invalid user user 2.57.121.25 port 38918 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.164.76
country_id: 2661886
description:
2026-01-05 22:39:41 dovecot_login authenticator failed for H=ip076.net-81-16-164.koping.net [81.16.164.76]:58726: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.22.140
country_id: 1269750
description:
2026-01-05 22:40:32 dovecot_login authenticator failed for H=([103.68.22.140]) [103.68.22.140]:40588: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 22:41:04 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<dkTJJKdHOmuuijvy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.70
country_id: 6252001
description:
Jan  5 22:45:03 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.139.70, lip=66.85.158.92, session=<iEwnM6dHCO+4aYtG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.57
country_id: 6252001
description:
Jan  5 22:45:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.57, lip=66.85.158.91, TLS: Connection closed, session=<WjWyM6dHBOenXpI5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.70
country_id: 6252001
description:
Jan  5 22:45:17 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=184.105.139.70, lip=66.85.158.92, TLS: Connection closed, session=<Ol37M6dHaBu4aYtG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-01-05 22:46:52 dovecot_plain authenticator failed for H=(stathial) [154.144.243.93]:47600: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.46.45.121
country_id: 290557
description:
2026-01-05 22:52:47 dovecot_login authenticator failed for H=([20.46.45.121]) [20.46.45.121]:54641: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.34
country_id: 1269750
description:
2026-01-05 22:54:05 dovecot_login authenticator failed for H=(nsg-corporate-34.230.187.122.airtel.in) [122.187.230.34]:51711: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 22:57:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<H0WFYKdHoNMjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 22:58:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shop@seyawin.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<ABv/YqdHWthCdMzo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2026-01-05 22:58:43 dovecot_login authenticator failed for H=([189.59.210.1]) [186.215.245.175]:57063: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.27.139
country_id: 6252001
description:
2026-01-05 22:59:02 dovecot_login authenticator failed for H=c-71-235-27-139.hsd1.vt.comcast.net [71.235.27.139]:35370: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.208.42
country_id: 1269750
description:
2026-01-05 22:59:37 dovecot_login authenticator failed for H=([128.185.208.42]) [128.185.208.42]:35610: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.102
country_id: 1269750
description:
2026-01-05 23:04:37 dovecot_login authenticator failed for H=([27.123.104.102]) [27.123.104.102]:38598: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.245
country_id: 6252001
description:
Jan  5 23:04:45 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 1 secs): user=<>, rip=172.236.228.245, lip=66.85.158.92, session=<CTaWeadH6tGs7OT1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.105.128.11
country_id: 6252001
description:
Jan  5 23:04:45 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 1 secs): user=<>, rip=172.105.128.11, lip=66.85.158.91, session=<ck2TeadH5PasaYAL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.134
country_id: 1269750
description:
2026-01-05 23:04:58 dovecot_login authenticator failed for H=([182.95.230.134]) [182.95.230.134]:56618: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.79
country_id: 6252001
description:
Jan  5 23:05:10 host2 pure-ftpd[1071269]: (?@205.210.31.79) [INFO] New connection from 205.210.31.79


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 23:06:02 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<IgQNfqdHqKpA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 23:07:04 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shop@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<zbTDgadH3olCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 23:07:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<6wzmgqdH+Olnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 23:09:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=</+zNiadHCOuOq2dI>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  5 23:10:33 host2 sshd[1076723]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 23:14:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<MjW+mqdHwnuuijvy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.137
country_id: 6252001
description:
Jan  5 23:19:56 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.137, lip=66.85.158.91, TLS: Connection closed, session=<Jrvtr6dH9oFChJmJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 23:31:01 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<ELNq16dHEEYjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 23:31:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<hlp52qdHxt1CdMzo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  5 23:38:05 host2 sshd[1102241]: Disconnected from invalid user admin 2.57.121.112 port 54587 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.230.55.55
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 157.230.55.55 - info@cloudtourssrilanka.com "POST /login HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 23:40:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<Sm/a+KdHvpBCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 23:40:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<lLs++qdHXOiOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 23:40:56 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<Ykni+qdH8IJnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.214.49.194
country_id: 6252001
description:
2026-01-05 23:43:09 dovecot_login authenticator failed for H=wsip-72-214-49-194.hr.hr.cox.net [72.214.49.194]:35716: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.122
country_id: 1269750
description:
2026-01-05 23:42:50 dovecot_login authenticator failed for H=([59.145.116.161]) [182.95.230.122]:39354: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 23:44:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<xfrVBahH/odA46ZK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2026-01-05 23:44:24 dovecot_plain authenticator failed for H=c-98-193-112-85.hsd1.il.comcast.net (symicia) [98.193.112.85]:57056: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2026-01-05 23:44:27 dovecot_plain authenticator failed for H=(thomelle) [50.217.40.11]:49184: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 23:46:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<Q3DFDahHzkCuijvy>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.253.27.219
country_id: 1880251
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 103.253.27.219 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.185.231
country_id: 6252001
description:
Jan  5 23:51:22 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.220.185.231, lip=66.85.158.91, TLS handshaking: Connection closed, session=<gGpMIKhHbOgs3Lnn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  5 23:55:31 host2 sshd[1121963]: Disconnected from invalid user admin 2.57.121.112 port 62066 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.203.34.136
country_id: 6252001
description:
2026-01-05 23:59:27 dovecot_plain authenticator failed for H=c-98-203-34-136.hsd1.fl.comcast.net (dotomyst) [98.203.34.136]:37092: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.106.188
country_id: 3865483
description:
Jan  6 00:04:10 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=45.238.106.188, lip=66.85.158.91, TLS, session=<xIwCTahHAaIt7mq8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 84.234.125.38
country_id: 798544
description:
Jan  6 00:03:50 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=84.234.125.38, lip=66.85.158.91, TLS, session=<Uv7ZS6hH+LdU6n0m>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  6 00:03:58 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<wPM6TahHYFcjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 00:05:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<LuJ9UahHQKhCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  6 00:12:06 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<uslYaqhHApOOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 00:13:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<X+c8cKhHdrVCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  6 00:14:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<Hurcc6hHUJxnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  6 00:16:49 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<eSwze6hHbFWuijvy>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 00:17:51 host2 sshd[1147083]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2026-01-06 00:22:40 dovecot_login authenticator failed for H=([185.255.212.178]) [185.255.212.178]:61729: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.121.193.126
country_id: 3595528
description:
2026-01-06 00:22:48 dovecot_login authenticator failed for H=(126.193.121.190.ispguatemala.com.gt) [190.121.193.126]:39594: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.14.36
country_id: 3144096
description:
2026-01-06 00:23:47 dovecot_login authenticator failed for H=(cm-84.211.14.36.get.no) [84.211.14.36]:58383: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.21
country_id: 1733045
description:
2026-01-06 00:24:04 dovecot_login authenticator failed for H=([49.124.151.21]) [49.124.151.21]:42970: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.199.118.234
country_id: 1880251
description:
2026-01-06 00:23:24 dovecot_login authenticator failed for H=(448990.cloudwaysapps.com) [128.199.118.234]:53740: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.116.220.11
country_id: 3865483
description:
Jan  6 00:30:17 host2 sshd[1160863]: Disconnected from invalid user claude 181.116.220.11 port 50943 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.188.172.6
country_id: 3923057
description:
Jan  6 00:33:18 host2 sshd[1163665]: Disconnected from invalid user claude 181.188.172.6 port 53526 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.188.172.6
country_id: 3923057
description:
Jan  6 00:34:12 host2 sshd[1164651]: Disconnected from invalid user minecraft 181.188.172.6 port 60306 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.116.220.11
country_id: 3865483
description:
Jan  6 00:36:12 host2 sshd[1166575]: Disconnected from invalid user wan 181.116.220.11 port 33400 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.49.129.67
country_id: 3175395
description:
Jan  6 00:38:52 host2 sshd[1169077]: Disconnected from invalid user claude 151.49.129.67 port 36712 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.49.129.67
country_id: 3175395
description:
Jan  6 00:38:20 host2 sshd[1168665]: Disconnected from invalid user claude 151.49.129.67 port 48210 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.49.129.67
country_id: 3175395
description:
Jan  6 00:39:24 host2 sshd[1169570]: Disconnected from invalid user oracle 151.49.129.67 port 50470 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.49.129.67
country_id: 3175395
description:
Jan  6 00:40:25 host2 sshd[1170987]: Disconnected from invalid user ljsoft 151.49.129.67 port 54344 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Jan  6 00:40:50 host2 sshd[1171426]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 53635


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Jan  6 00:41:11 host2 sshd[1171702]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 57131


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.116.220.11
country_id: 3865483
description:
Jan  6 00:43:55 host2 sshd[1174093]: Disconnected from invalid user ts3 181.116.220.11 port 46816 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  6 00:46:47 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@melanifinefood.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<zxxf5qhH3K4yBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  6 00:46:56 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<M0Hk5qhHkO+i8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-06 00:47:56 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (perto) [87.103.126.54]:40539: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 00:47:57 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<OauR6qhHPq6i8KbF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.116.220.11
country_id: 3865483
description:
Jan  6 00:49:26 host2 sshd[1179723]: Disconnected from invalid user rocketmq 181.116.220.11 port 46857 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  6 00:49:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@lankaherbalsolutions.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<ip+I8ahHMoSygBt7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  6 00:49:13 host2 sshd[1179526]: Disconnected from invalid user admin 2.57.121.112 port 38567 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.196
country_id: 6252001
description:
Jan  6 00:51:42 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.196, lip=66.85.158.91, TLS, session=<f8gO+KhHxPvN0h/E>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.236.66
country_id: 6252001
description:
2026-01-06 00:51:24 dovecot_plain authenticator failed for H=c-73-213-236-66.hsd1.va.comcast.net (penated) [73.213.236.66]:45166: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  6 00:51:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<d9Me96hH9Mai8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-06 00:51:30 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:50748: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.116.220.11
country_id: 3865483
description:
Jan  6 00:53:29 host2 sshd[1183700]: Disconnected from invalid user claude 181.116.220.11 port 58097 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Jan  6 00:53:41 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<7PcG/6hHEUZetwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Jan  6 00:54:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<6DHwAalHbrCPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.63.133.243
country_id: 3175395
description:
Jan  6 00:54:51 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=185.63.133.243, lip=66.85.158.91, TLS, session=<r7lPAqlHZrO5P4Xz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 00:54:51 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<5pE6A6lHmMii8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.58.65.156
country_id: 1269750
description:
Jan  6 00:55:12 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<env_eng>, method=PLAIN, rip=103.58.65.156, lip=66.85.158.91, TLS, session=<fq98A6lHSZtnOkGc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 00:55:16 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<69ayBKlHuLAyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  6 00:56:27 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@lankaherbalsolutions.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<IhzwCKlHJqkvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Jan  6 00:58:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@venee.lk>, method=PLAIN, rip=157.230.24.207, lip=66.85.158.91, session=<oY4FEalHoMad5hjP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 00:59:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<GZYQFKlHdMxCdMzo>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 01:01:04 host2 sshd[1191142]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  6 01:00:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@sobaherbal.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<JTPGFqlHSr0vWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 01:01:48 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<8B0OHKlH1Ltm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  6 01:04:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@sobaherbal.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<3xi7JalHWM+ygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 01:05:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<zCKzKKlHlrQIijoY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  6 01:06:36 host2 sshd[1196319]: Disconnected from invalid user admin 2.57.121.112 port 23325 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Jan  6 01:06:37 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<LINULalH8JWB4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan  6 01:08:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<WAMCM6lHYp0v/lVz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Jan  6 01:08:37 host2 sshd[1198444]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 56646


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.14.169.244
country_id: 3017382
description:
2026-01-06 01:09:52 dovecot_plain authenticator failed for H=lstlambert-656-1-118-244.w80-14.abo.wanadoo.fr (unacul) [80.14.169.244]:58790: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-01-06 01:09:57 dovecot_plain authenticator failed for H=(hemegon) [24.187.213.29]:43512: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 01:11:36 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<VLwbP6lH4IIifrCV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 01:12:06 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<xybnQKlHQI0IijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 01:14:06 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<hCUQSKlHus8vWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 01:14:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<uoFjSalHzoAvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 01:14:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<zg/5SalH3NF100Db>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.5
country_id: 6252001
description:
Jan  6 01:14:19 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=74.82.47.5, lip=66.85.158.91, session=<DxD7SKlHXpFKUi8F>


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 69.66.133.89
country_id: 6252001
description:
Jan  6 01:14:27 host2 sshd[1205246]: error: maximum authentication attempts exceeded for root from 69.66.133.89 port 56775 ssh2 [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 69.66.133.89
country_id: 6252001
description:
Jan  6 01:14:27 host2 sshd[1205246]: Disconnecting authenticating user root 69.66.133.89 port 56775: Too many authentication failures [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 61.23.38.245
country_id: 1861060
description:
Jan  6 01:16:03 host2 sshd[1206789]: Disconnected from invalid user postgres 61.23.38.245 port 53278 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 01:16:26 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<WBJnUKlHVJlm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 01:16:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<vle1UKlHTs9A46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  6 01:17:58 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@bostonlanka.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<23TqValH5Nei8Jp9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 61.23.38.245
country_id: 1861060
description:
Jan  6 01:17:31 host2 sshd[1208129]: Disconnected from invalid user claude 61.23.38.245 port 46970 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  6 01:18:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<EqqTWKlHDK4yBvlc>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 61.23.38.245
country_id: 1861060
description:
Jan  6 01:18:12 host2 sshd[1208829]: Disconnected from invalid user postgres 61.23.38.245 port 60898 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 01:19:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<2Yc2WqlHhN4IhpC/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 01:19:34 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<yZeiW6lH2Iui8KbF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.155.171.171
country_id: 1835841
description:
Jan  6 01:19:46 host2 sshd[1210377]: Disconnected from invalid user prueba 43.155.171.171 port 37720 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2026-01-06 01:22:04 dovecot_plain authenticator failed for H=c-73-168-136-150.hsd1.il.comcast.net (ephessic) [73.168.136.150]:34592: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  6 01:22:05 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<9lGgZKlHAtqygBt7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.155.171.171
country_id: 1835841
description:
Jan  6 01:21:18 host2 sshd[1212065]: Disconnected from invalid user lenovo 43.155.171.171 port 48388 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-01-06 01:21:23 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:42562: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.201.62
country_id: 1269750
description:
2026-01-06 01:21:48 dovecot_login authenticator failed for H=(nsg-corporate-226.215.186.122.airtel.in) [122.186.201.62]:57262: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.155.171.171
country_id: 1835841
description:
Jan  6 01:21:56 host2 sshd[1212945]: Disconnected from invalid user minecraft 43.155.171.171 port 44238 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  6 01:22:35 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@nsteeleng.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<gkVlZqlHspOi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Jan  6 01:23:39 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<1BI5aqlHYI2PbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.155.171.171
country_id: 1835841
description:
Jan  6 01:23:47 host2 sshd[1214571]: Disconnected from invalid user testuser 43.155.171.171 port 36070 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Jan  6 01:23:53 host2 sshd[1214634]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 57819


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 01:24:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<ReM5bqlHVJai8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Jan  6 01:25:02 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<q24lb6lHmGJetwuC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Jan  6 01:25:02 host2 sshd[1215518]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 56760


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.155.171.171
country_id: 1835841
description:
Jan  6 01:24:24 host2 sshd[1215102]: Disconnected from invalid user rdp 43.155.171.171 port 43652 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 01:25:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<YKrvb6lH4pkyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Jan  6 01:25:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<M84jcKlHUu0vT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  6 01:26:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<yyBOc6lHRuwvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.12
country_id: 3175395
description:
Jan  6 01:28:03 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.197.9.12, lip=66.85.158.91, TLS, session=<PqIfealH/oi5xQkM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.133
country_id: 6252001
description:
Jan  6 01:27:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.133, lip=66.85.158.91, TLS handshaking: Connection closed, session=<S74YeKlHSchAPpyF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.177.113.32
country_id: 3175395
description:
Jan  6 01:27:35 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=195.177.113.32, lip=66.85.158.91, TLS, session=<zLhwd6lHHefDsXEg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.132
country_id: 6252001
description:
Jan  6 01:27:48 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.132, lip=66.85.158.91, TLS handshaking: Connection closed, session=<0w0wealHcE5APpyE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 01:29:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<Nn9SgKlHmsxCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.37.11.109
country_id: 3469034
description:
Jan  6 01:30:09 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=191.37.11.109, lip=66.85.158.91, TLS, session=<d2uEgKlHDMa/JQtt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  6 01:30:14 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<T1+/galHmKYvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.17.108.155
country_id: 6290252
description:
Jan  6 01:30:39 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 29 secs): user=<hr>, method=PLAIN, rip=217.17.108.155, lip=66.85.158.91, TLS handshaking: Connection closed, session=<sxesgalHwuXZEWyb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 143.0.0.50
country_id: 3469034
description:
Jan  6 01:30:57 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=143.0.0.50, lip=66.85.158.91, TLS, session=<BKJzhKlHrNSPAAAy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.70
country_id: 1269750
description:
2026-01-06 01:32:01 dovecot_login authenticator failed for H=([125.17.70.25]) [125.20.251.70]:42238: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.158.138.179
country_id: 1269750
description:
2026-01-06 01:32:25 dovecot_login authenticator failed for H=([103.158.138.179]) [103.158.138.179]:58162: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.217.241.75
country_id: 6251999
description:
Jan  6 01:34:41 host2 sshd[1225703]: Disconnected from invalid user daniel 144.217.241.75 port 46796 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 01:34:48 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<92IbkqlHKp1m2gqW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.254.21
country_id: 1819730
description:
Jan  6 01:36:19 host2 sshd[1227545]: Disconnected from invalid user daniel 152.32.254.21 port 32176 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.254.21
country_id: 1819730
description:
Jan  6 01:36:53 host2 sshd[1228149]: Disconnected from invalid user claude 152.32.254.21 port 43728 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  6 01:37:06 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<hOVNmqlHqIyygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan  6 01:37:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<2HFmm6lH3Jcv/lVz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.254.21
country_id: 1819730
description:
Jan  6 01:37:27 host2 sshd[1228710]: Disconnected from invalid user client 152.32.254.21 port 55282 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.217.241.75
country_id: 6251999
description:
Jan  6 01:37:31 host2 sshd[1228781]: Disconnected from invalid user client 144.217.241.75 port 59564 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 144.217.241.75
country_id: 6251999
description:
Jan  6 01:38:31 host2 sshd[1229929]: Disconnected from invalid user build 144.217.241.75 port 56364 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 01:38:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<RzYWoKlH3MMIijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Jan  6 01:39:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@dataesite.lk>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<xjOqo6lHVKiB4kCN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.217.241.75
country_id: 6251999
description:
Jan  6 01:39:59 host2 sshd[1231202]: Disconnected from invalid user claude 144.217.241.75 port 58196 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.115
country_id: 6252001
description:
Jan  6 01:40:32 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.115, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<JSizpqlHjM/G6xhz>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.235
country_id: 6252001
description:
Jan  6 01:42:32 host2 pure-ftpd[1233693]: (?@195.184.76.235) [INFO] New connection from 195.184.76.235


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.12
country_id: 6252001
description:
Jan  6 01:42:31 host2 pure-ftpd[1233691]: (?@195.184.76.12) [INFO] New connection from 195.184.76.12


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.224.26
country_id: 1269750
description:
2026-01-06 01:43:20 dovecot_login authenticator failed for H=([152.52.224.26]) [152.52.224.26]:33360: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.0.141.138
country_id: 2750405
description:
2026-01-06 01:44:18 dovecot_login authenticator failed for H=(lezzarotech.com) [136.0.141.138]:52905: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 01:44:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<RHrEtalHMp4vWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 01:45:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<RM0dt6lHlr0vWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 01:45:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<RAd7t6lHCOMifrCV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 01:45:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<XZawt6lH0NlA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 01:45:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<PxX+t6lHgpwIijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 01:47:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<dxjovqlHKPR100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 01:48:51 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<QN5WxKlHWpRA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 01:49:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<Yc5RxqlHKulm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  6 01:49:35 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<XfD7xqlHuuOi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 01:50:05 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<7hXDyKlH0oKi8KbF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.124.28
country_id: 3042225
description:
2026-01-06 01:49:08 dovecot_login authenticator failed for H=(ADMIN) [91.90.124.28]:21639: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  6 01:49:17 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<bNXoxalHCO0yBvlc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.232
country_id: 6252001
description:
Jan  6 01:52:47 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.232, lip=66.85.158.92, TLS handshaking: Connection closed, session=<FCqP0qlHsvlBMQHo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 01:52:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<4re20qlHVugIhpC/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.232
country_id: 6252001
description:
Jan  6 01:53:15 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.232, lip=66.85.158.92, TLS: Connection closed, session=<7psz1KlH9P1BMQHo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Jan  6 01:53:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<qcKR1KlHQKGPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  6 01:54:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<1Eiq16lHitGi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 01:54:47 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<VbeT2alHtNOi8GQy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.244.49.14
country_id: 1668284
description:
Jan  6 01:55:15 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=173.244.49.14, lip=66.85.158.91, TLS handshaking: Connection closed, session=<zZlW26lHvuCt9DEO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.88.26.16
country_id: 294640
description:
Jan  6 01:55:16 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=149.88.26.16, lip=66.85.158.91, session=<n6to26lHBJqVWBoQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.70.11.12
country_id: 3895114
description:
Jan  6 01:55:15 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=146.70.11.12, lip=66.85.158.91, TLS, session=<J2tV26lHzuCSRgsM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 116.90.74.165
country_id: 2186224
description:
Jan  6 01:55:16 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=116.90.74.165, lip=66.85.158.91, session=<aOFt26lHxCJ0Wkql>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 01:55:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<nnoA3KlHoIIyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  6 01:55:41 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<af7E3KlHbJSygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  6 01:56:40 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@lankaherbalsolutions.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<a2NQ4KlHbIIvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Jan  6 01:56:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<owl34KlHCNVetwuC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  6 01:59:58 host2 sshd[1243713]: Disconnected from invalid user admin 2.57.121.112 port 16993 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 02:00:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<aewK7qlHJJhCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  6 02:00:48 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@sobaherbal.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<iBAX76lHitMvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Jan  6 02:02:42 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@melanifinefood.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<rX3k9alHWN0vT1jH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2026-01-06 02:03:58 dovecot_plain authenticator failed for H=c-73-13-220-220.hsd1.de.comcast.net (sthral) [73.13.220.220]:47788: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.37.122.175
country_id: 1643084
description:
Jan  6 02:05:24 host2 sshd[1248008]: Disconnected from invalid user claude 36.37.122.175 port 58436 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan  6 02:06:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<S/jlBKpHhJIv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2026-01-06 02:07:14 dovecot_login authenticator failed for H=([125.20.249.39]) [128.185.214.78]:45724: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.115.173.11
country_id: 1269750
description:
2026-01-06 02:07:46 dovecot_login authenticator failed for H=([45.115.173.11]) [45.115.173.11]:47304: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.37.122.175
country_id: 1643084
description:
Jan  6 02:08:02 host2 sshd[1250473]: Disconnected from invalid user claude 36.37.122.175 port 33966 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.72.22.61
country_id: 6251999
description:
2026-01-06 02:08:06 dovecot_login authenticator failed for H=static24-72-22-61.r.rev.accesscomm.ca [24.72.22.61]:55181: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 02:07:35 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<5NdLB6pH7uVm2gqW>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 02:08:24 host2 sshd[1250910]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.37.122.175
country_id: 1643084
description:
Jan  6 02:09:23 host2 sshd[1251744]: Disconnected from invalid user claude 36.37.122.175 port 35052 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  6 02:10:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<7M8PE6pH1tyygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 02:12:06 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<RdJ2F6pHLtMIijoY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2026-01-06 02:12:26 dovecot_plain authenticator failed for H=(mazonodly) [91.73.188.251]:58173: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.118.53
country_id: 3865483
description:
2026-01-06 02:13:16 dovecot_login authenticator failed for H=([167.250.118.53]) [167.250.118.53]:45030: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.213.10
country_id: 933860
description:
Jan  6 02:13:19 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=41.216.213.10, lip=66.85.158.91, TLS, session=<n1uIGqpHieEp2NUK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.90.94
country_id: 1269750
description:
2026-01-06 02:13:36 dovecot_login authenticator failed for H=([182.95.85.106]) [27.123.90.94]:56204: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.73.136
country_id: 3469034
description:
Jan  6 02:13:42 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<charanaw>, method=PLAIN, rip=187.120.73.136, lip=66.85.158.91, TLS, session=<47kbHKpH5Oq7eEmI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 02:15:51 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@lankaherbalsolutions.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<It/nJKpHStsvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 02:16:14 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@sobaherbal.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<5SxFJqpHaIwvWBNS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  6 02:17:21 host2 sshd[1259788]: Disconnected from invalid user admin 2.57.121.112 port 49270 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 02:17:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<b0D/K6pH7pdA46ZK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.122
country_id: 6252001
description:
Jan  6 02:18:22 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.122, lip=66.85.158.91, TLS handshaking: Connection closed, session=<a1YALqpHcPFAPpx6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.2
country_id: 6252001
description:
Jan  6 02:18:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=74.82.47.2, lip=66.85.158.91, session=<8K2pLqpHihdKUi8C>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 02:18:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<cauZL6pH3qsIijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 02:19:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<cZskMKpHVqoifrCV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  6 02:20:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 7 secs): user=<finance@melanifinefood.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<6HSoM6pHLJ4yBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 02:20:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<+fgzNapHotx100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 02:20:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<ptLWNqpHxtGi8KbF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  6 02:21:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<y3QcOKpHXHGi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 02:21:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<GpuGOKpHOshA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 02:21:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<qGGLOqpHNIJm2gqW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.178
country_id: 3144096
description:
2026-01-06 02:22:33 dovecot_login authenticator failed for H=(cm-84.213.189.178.get.no) [84.213.189.178]:49566: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.226.8
country_id: 6252001
description:
Jan  6 02:22:57 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.65.226.8, lip=66.85.158.92, session=<aAFrPqpHQpUUQeII>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Jan  6 02:23:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@rehanseo.online>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<fhhJQKpHutyPbtX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.238.122
country_id: 2542007
description:
2026-01-06 02:23:36 dovecot_login authenticator failed for H=([154.146.238.122]) [154.146.238.122]:57624: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  6 02:24:38 host2 sshd[1266439]: Disconnected from invalid user user 2.57.121.25 port 48788 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 02:25:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<jsloR6pHKJoyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  6 02:25:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@nsteeleng.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<eJLUSKpH5JGi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 02:25:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<uTFCRqpHlKWi8GQy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.237.125.78
country_id: 6252001
description:
Jan  6 02:26:09 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=135.237.125.78, lip=66.85.158.91, session=<lTnYSapHyIWH7X1O>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 02:26:47 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<T2EFTKpHzI4IhpC/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  6 02:27:32 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@lankaherbalsolutions.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<HvqwTqpHeNMvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Jan  6 02:29:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<4GtxVKpHSgtetwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  6 02:29:27 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<8R6EVapHFumygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 02:31:14 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<HXvrW6pHYJBCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  6 02:31:40 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@sobaherbal.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<wuJ5XapH6M0vWfaQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2026-01-06 02:32:08 dovecot_plain authenticator failed for H=c-98-227-25-115.hsd1.il.comcast.net (piting) [98.227.25.115]:44570: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.149.27.208
country_id: 1819730
description:
Jan  6 02:33:20 host2 sshd[1275113]: Disconnected from invalid user yangkai 103.149.27.208 port 44518 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.122
country_id: 6252001
description:
Jan  6 02:33:51 host2 pure-ftpd[1275588]: (?@66.132.153.122) [INFO] New connection from 66.132.153.122


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.149.27.208
country_id: 1819730
description:
Jan  6 02:34:31 host2 sshd[1276176]: Disconnected from invalid user test123 103.149.27.208 port 42406 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.149.27.208
country_id: 1819730
description:
Jan  6 02:35:42 host2 sshd[1277591]: Disconnected from invalid user claude 103.149.27.208 port 34432 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan  6 02:36:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<c0CTbqpHGI0v/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 02:40:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<IVXwe6pHXqJm2gqW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.4.145.50
country_id: 1210997
description:
Jan  6 02:45:05 host2 sshd[1288269]: Disconnected from invalid user vpn 103.4.145.50 port 55236 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.4.145.50
country_id: 1210997
description:
Jan  6 02:44:25 host2 sshd[1287405]: Disconnected from invalid user claude 103.4.145.50 port 42966 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  6 02:44:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<XAo1jKpH3qOygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 02:45:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<r9UGj6pHcOIIijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 02:47:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@lankaherbalsolutions.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<4siAlKpHwqovWBNS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.76.120.106
country_id: 1643084
description:
Jan  6 02:47:09 host2 sshd[1290841]: Disconnected from invalid user claude 103.76.120.106 port 47782 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 02:47:27 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@sobaherbal.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<gtzklapHMsovWBNS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.4.145.50
country_id: 1210997
description:
Jan  6 02:47:40 host2 sshd[1291197]: Disconnected from invalid user claude 103.4.145.50 port 47860 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.190.22.247
country_id: 2750405
description:
Jan  6 02:48:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=146.190.22.247, lip=66.85.158.91, session=<hi5qmqpHkouSvhb3>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.76.120.106
country_id: 1643084
description:
Jan  6 02:49:53 host2 sshd[1293213]: Disconnected from invalid user lek 103.76.120.106 port 48008 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 02:51:07 host2 sshd[1294683]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 02:50:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<+BGwn6pHbq9A46ZK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.76.120.106
country_id: 1643084
description:
Jan  6 02:50:31 host2 sshd[1294018]: Disconnected from invalid user caja01 103.76.120.106 port 48064 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  6 02:50:42 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<PXiNoapHouMyBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 02:51:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<RVLbpapHvtWi8KbF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.87.21.241
country_id: 953987
description:
Jan  6 02:51:43 host2 sshd[1295198]: Disconnected from invalid user kamil 20.87.21.241 port 46112 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 02:52:56 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<HDmJqapH6MgifrCV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 02:52:16 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<HtMkp6pHGLsIijoY>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.87.21.241
country_id: 953987
description:
Jan  6 02:52:34 host2 sshd[1296119]: Disconnected from invalid user marcelo 20.87.21.241 port 48030 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  6 02:53:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<JdBjqqpHIGqi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 02:53:32 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<GfGvq6pHPFB100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 02:53:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<arBQrKpHGqtA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Jan  6 02:54:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@rehanseo.online>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<MdUQrqpHQqCPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 02:54:47 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<y+QjsKpHeNVm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 02:55:41 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<mG9fs6pH+OSi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 02:56:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<WgevtKpHsuMyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  6 02:58:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@nsteeleng.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<WRnYu6pH6Cyi8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2026-01-06 02:57:11 dovecot_login authenticator failed for H=([152.52.234.134]) [125.20.245.182]:47492: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.205.169
country_id: 1733045
description:
2026-01-06 02:57:31 dovecot_login authenticator failed for H=([49.124.205.169]) [49.124.205.169]:34458: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.148.0.202
country_id: 6252001
description:
2026-01-06 02:57:51 dovecot_login authenticator failed for H=syn-131-148-000-202.biz.spectrum.com [131.148.0.202]:54354: 535 Incorrect authentication data (set_id=marketing)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 162.240.154.125
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[162.240.154.125] [Remote Port]=[11496] [Authentication Database]=[mail] [Username]=[finance@nsteeleng.com] (10/10 failures) (blocked until [Tue Jan  6 21:28:01 2026 UTC/Wed Jan  7 02:58:01 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  6 02:58:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<oY27vqpH5q8vWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 03:00:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<QZzkw6pHNuYIhpC/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Jan  6 03:00:57 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<lbotxqpHJ9VetwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 03:02:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<H6R6yqpHiulCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  6 03:03:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<KR2xzapHwIsvWfaQ>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 47.89.246.144
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[47.89.246.144] [Remote Port]=[35776] [Authentication Database]=[mail] [Username]=[sales@sobaherbal.com] (10/10 failures) (blocked until [Tue Jan  6 21:33:01 2026 UTC/Wed Jan  7 03:03:01 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  6 03:03:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<vDvdzqpHcNCygBt7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2026-01-06 03:07:08 dovecot_login authenticator failed for H=([128.185.189.57]) [182.78.79.134]:40614: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan  6 03:06:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<l8un2apHXIcv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.172
country_id: 3144096
description:
2026-01-06 03:07:29 dovecot_login authenticator failed for H=(172-161-97-62.cust.smartcall.no) [62.97.161.172]:60708: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.54.18.220
country_id: 1694008
description:
Jan  6 03:10:20 host2 sshd[1313364]: Disconnected from invalid user claude 122.54.18.220 port 58575 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.80
country_id: 2328926
description:
Jan  6 03:11:05 host2 sshd[1314210]: Disconnected from invalid user claude 102.88.137.80 port 1491 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.68.9.182
country_id: 6252001
description:
Jan  6 03:11:07 host2 sshd[1314245]: Disconnected from invalid user claude 138.68.9.182 port 45072 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.54.18.220
country_id: 1694008
description:
Jan  6 03:11:46 host2 sshd[1314735]: Disconnected from invalid user ctf 122.54.18.220 port 24780 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.47.94.55
country_id: 1643084
description:
Jan  6 03:13:54 host2 sshd[1316970]: Disconnected from invalid user claude 38.47.94.55 port 47054 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.68.9.182
country_id: 6252001
description:
Jan  6 03:14:43 host2 sshd[1317783]: Disconnected from invalid user ctf 138.68.9.182 port 57038 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.68.9.182
country_id: 6252001
description:
Jan  6 03:15:40 host2 sshd[1318834]: Disconnected from invalid user john 138.68.9.182 port 54200 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.88.137.80
country_id: 2328926
description:
Jan  6 03:15:46 host2 sshd[1318966]: Disconnected from invalid user jhcho 102.88.137.80 port 1267 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.128.181.199
country_id: 357994
description:
Jan  6 03:16:52 host2 sshd[1319978]: Disconnected from invalid user claude 41.128.181.199 port 58292 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.80
country_id: 2328926
description:
Jan  6 03:16:24 host2 sshd[1319614]: Disconnected from invalid user reporting 102.88.137.80 port 33759 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Jan  6 03:17:51 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<uHOnAqtHKI0vT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  6 03:18:16 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<NSwdBKtHEoiygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 03:18:34 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<H0QwBatHcugvWBNS>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 47.88.19.82
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[47.88.19.82] [Remote Port]=[39314] [Authentication Database]=[mail] [Username]=[contact@sobaherbal.com] (10/10 failures) (blocked until [Tue Jan  6 21:48:55 2026 UTC/Wed Jan  7 03:18:55 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 03:19:02 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<TF/YBqtHWoMIijoY>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 178.128.27.123
country_id: 1880251
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[178.128.27.123] [Remote Port]=[34834] [Authentication Database]=[mail] [Username]=[sales@sobaherbal.com] (10/10 failures) (blocked until [Tue Jan  6 21:48:14 2026 UTC/Wed Jan  7 03:18:14 2026 LOCAL])


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 41.128.181.199
country_id: 357994
description:
Jan  6 03:19:36 host2 sshd[1322804]: Received disconnect from 41.128.181.199 port 44126:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.128.181.199
country_id: 357994
description:
Jan  6 03:19:36 host2 sshd[1322804]: Disconnected from invalid user claude 41.128.181.199 port 44126 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.211.28.92
country_id: 6252001
description:
[2026-01-06 03:20:28 +0530] info [whostmgrd] 74.211.28.92 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  6 03:20:42 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<35fWDKtHjNcyBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 03:23:04 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<DA5OFatHYrSi8KbF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.141.74
country_id: 298795
description:
2026-01-06 03:22:18 dovecot_plain authenticator failed for H=(peffres) [5.11.141.74]:39750: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.104
country_id: 6252001
description:
Jan  6 03:22:26 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.104, lip=66.85.158.92, TLS, session=<ZcwrE6tHJuzG6xho>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 03:22:53 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<Wt2gFKtHtuJA46ZK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.157.219.158
country_id: 6252001
description:
2026-01-06 03:24:01 dovecot_plain authenticator failed for H=c-76-157-219-158.hsd1.il.comcast.net (vates) [76.157.219.158]:55828: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Jan  6 03:25:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@rehanseo.online>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<m8veHKtHVs+PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  6 03:25:39 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<ExaJHqtHrF6i8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 03:25:48 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<8g0MH6tHWMoIijoY>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 8.138.58.24
country_id: 1814991
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[8.138.58.24] [Remote Port]=[51800] [Authentication Database]=[mail] [Username]=[support@lankaherbalsolutions.com] (10/10 failures) (blocked until [Tue Jan  6 21:55:46 2026 UTC/Wed Jan  7 03:25:46 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 03:27:04 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<3ZecI6tHRNQifrCV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 03:26:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<mSWSIKtHarWi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 03:26:27 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<zhxgIatHMOdA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 03:26:32 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<ugy1IatHk55100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 03:26:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<ZmILIqtHopoyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 03:27:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<wyF7JqtHxLdm2gqW>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 102.218.10.150
country_id: 51537
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[102.218.10.150] [Remote Port]=[47044] [Authentication Database]=[mail] [Username]=[help@anandaobauae.org] (10/10 failures) (blocked until [Tue Jan  6 21:57:50 2026 UTC/Wed Jan  7 03:27:50 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  6 03:29:53 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<ZJqoLatHErYvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  6 03:30:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@nsteeleng.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<v6aVL6tHkHmi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 03:32:51 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<XkJMOKtH8t9CdMzo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.154
country_id: 3144096
description:
2026-01-06 03:32:11 dovecot_login authenticator failed for H=(cm-84.213.189.154.get.no) [84.213.189.154]:57285: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.68
country_id: 1733045
description:
2026-01-06 03:32:30 dovecot_login authenticator failed for H=([49.125.201.68]) [49.125.201.68]:49786: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Jan  6 03:32:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<H8HbN6tHyjhetwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  6 03:33:59 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<E/ZXPKtHmt4vWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 03:34:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<xUyNPKtHxNQIhpC/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan  6 03:36:14 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<MdpnRKtH6IEv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  6 03:36:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<wC6dRKtHBIOygBt7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.128.214.238
country_id: 798544
description:
Jan  6 03:41:10 host2 sshd[1344302]: Disconnected from invalid user claude 57.128.214.238 port 39754 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.40.122.250
country_id: 2629691
description:
2026-01-06 03:41:33 dovecot_login authenticator failed for H=nova-185-040-122-250.cpe.novanet.is [185.40.122.250]:41118: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.221.180
country_id: 3144096
description:
2026-01-06 03:41:45 dovecot_login authenticator failed for H=(cm-178.232.221.180.get.no) [178.232.221.180]:37561: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.128.214.238
country_id: 798544
description:
Jan  6 03:45:40 host2 sshd[1347972]: Disconnected from invalid user user 57.128.214.238 port 58144 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.135.241.151
country_id: 130758
description:
Jan  6 03:45:45 host2 sshd[1348092]: Disconnected from invalid user camera 45.135.241.151 port 37820 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.157.177.161
country_id: 1733045
description:
Jan  6 03:45:50 host2 sshd[1348308]: Disconnected from invalid user ali 202.157.177.161 port 32980 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 57.128.214.238
country_id: 798544
description:
Jan  6 03:46:10 host2 sshd[1348588]: Disconnected from invalid user minecraft 57.128.214.238 port 50190 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 03:46:17 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<0V5SaKtHHoxm2gqW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.128.214.238
country_id: 798544
description:
Jan  6 03:47:08 host2 sshd[1349489]: Disconnected from invalid user anthony 57.128.214.238 port 51006 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.157.177.161
country_id: 1733045
description:
Jan  6 03:47:32 host2 sshd[1349747]: Disconnected from invalid user db2fenc1 202.157.177.161 port 39314 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.135.241.151
country_id: 130758
description:
Jan  6 03:48:13 host2 sshd[1350142]: Disconnected from invalid user alberto 45.135.241.151 port 44982 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 03:49:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<1dEhdatHqLcvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 03:50:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<KhODdqtHCNcvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  6 03:50:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@melanifinefood.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<XNTjd6tHTqoyBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  6 03:51:29 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<AeHleqtHWrOygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 03:52:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<w9MHgKtHypIIijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 03:54:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<EAlKhatHspmi8KbF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Jan  6 03:55:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<FsMOiqtHXoAvT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Jan  6 03:56:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@rehanseo.online>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<j15JjKtHILaPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 03:56:37 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<ucBFjatHKIai8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 03:56:14 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<Mn3ji6tHlrpA46ZK>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 03:58:05 host2 sshd[1357685]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  6 03:58:14 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<CtYMk6tHSLWi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 03:58:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<Ct1Lk6tHeMsyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 03:59:32 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<lfOtl6tHSdJ100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 04:00:26 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<bCDrmqtHDqlA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 04:01:01 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<6zAHnatHxtkIijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  6 04:01:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<XJ1dnatHHo4vWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 04:01:08 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<QZtonatH5ogifrCV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 04:02:40 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<PFbnoqtH7rFm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  6 04:02:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<P3LTo6tHwqSi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 04:03:47 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<NEXrpqtHXN5CdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Jan  6 04:04:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<hCV2qatHuWtetwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  6 04:05:17 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<EaQ/rKtH0rYvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan  6 04:06:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<tVf/rqtHkOov/lVz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.211.209.191
country_id: 2464461
description:
Jan  6 04:06:18 host2 sshd[1364537]: Disconnected from invalid user odoo 102.211.209.191 port 49350 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.76.82.80
country_id: 2328926
description:
Jan  6 04:06:33 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=41.76.82.80, lip=66.85.158.91, TLS, session=<MJzRr6tHJuYpTFJQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.210
country_id: 6252001
description:
Jan  6 04:06:51 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.230.168.210, lip=66.85.158.91, TLS handshaking: Connection closed, session=<D3L+satH69Bb5qjS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.41.71
country_id: 953987
description:
Jan  6 04:06:56 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<charanaw>, method=PLAIN, rip=102.64.41.71, lip=66.85.158.91, TLS, session=<5hkOsatHNJpmQClH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.93
country_id: 6252001
description:
Jan  6 04:07:01 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.230.168.93, lip=66.85.158.91, TLS: Connection closed, session=<ptacsqtHadpb5qhd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.91
country_id: 6252001
description:
Jan  6 04:07:14 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.230.168.91, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<FQtds6tHLcRb5qhb>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.211.209.191
country_id: 2464461
description:
Jan  6 04:07:17 host2 sshd[1364981]: Disconnected from invalid user ubuntu 102.211.209.191 port 33998 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.214
country_id: 6252001
description:
Jan  6 04:07:17 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.230.168.214, lip=66.85.158.91, TLS: Connection closed, session=<cI2Ls6tH5YVb5qjW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.175.193.205
country_id: 1269750
description:
Jan  6 04:08:34 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@sobaherbal.com>, method=PLAIN, rip=122.175.193.205, lip=66.85.158.91, session=<y4wCuKtHCs16r8HN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 04:09:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<E7/yuqtHUt8IhpC/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  6 04:10:04 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<++RcvatHysGygBt7>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.161.114.113
country_id: 2017370
description:
[2026-01-06 04:10:43 +0530] info [cpaneld] 195.161.114.113 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.137.32.187
country_id: 3017382
description:
Jan  6 04:12:06 host2 sshd[1370083]: Disconnected from invalid user test 79.137.32.187 port 56624 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.17
country_id: 6252001
description:
Jan  6 04:12:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.230.168.17, lip=66.85.158.91, TLS handshaking: Connection closed, session=<IYrtxatHuYtb5qgR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.31
country_id: 6252001
description:
Jan  6 04:12:36 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.230.168.31, lip=66.85.158.91, TLS: Connection closed, session=<Up+JxqtH955b5qgf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.29
country_id: 6252001
description:
Jan  6 04:12:51 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.230.168.29, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<O8h4x6tH8YJb5qgd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.30
country_id: 6252001
description:
Jan  6 04:12:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.230.168.30, lip=66.85.158.91, TLS: Connection closed, session=<vjanx6tHcetb5qge>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-06 04:13:09 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:50227: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 79.137.32.187
country_id: 3017382
description:
Jan  6 04:14:15 host2 sshd[1372102]: Disconnected from invalid user sysadmin 79.137.32.187 port 43062 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.137.32.187
country_id: 3017382
description:
Jan  6 04:15:27 host2 sshd[1373590]: Disconnected from invalid user ubuntu 79.137.32.187 port 45068 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.175.193.205
country_id: 1269750
description:
Jan  6 04:15:34 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=122.175.193.205, lip=66.85.158.91, session=<MX0O0atH0N16r8HN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.144.27.228
country_id: 6252001
description:
2026-01-06 04:18:10 dovecot_plain authenticator failed for H=c-73-144-27-228.hsd1.mi.comcast.net (brobowl) [73.144.27.228]:60834: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.92.242.178
country_id: 2750405
description:
[2026-01-06 04:19:33 +0530] info [cpaneld] 91.92.242.178 - cloudtourssrilan "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.96.197.166
country_id: 3865483
description:
Jan  6 04:20:18 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=186.96.197.166, lip=66.85.158.91, TLS, session=<fvT+4KtH/p66YMWm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.197
country_id: 3469034
description:
Jan  6 04:20:49 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=177.44.96.197, lip=66.85.158.91, TLS, session=<KyTd4qtHkZexLGDF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 04:21:05 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<cZDH5KtH4IYvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 04:21:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<WBwk5qtHQqYvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 04:21:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<iPRS5qtH/JNm2gqW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.172.190.181
country_id: 2921044
description:
Jan  6 04:22:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.172.190.181, lip=66.85.158.92, session=<rNLX6KtHQ3CnrL61>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 161.35.79.234
country_id: 2921044
description:
Jan  6 04:22:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=161.35.79.234, lip=66.85.158.92, session=<zkzf6KtHsJyhI0/q>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  6 04:23:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<S0RH7KtHCK0yBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  6 04:24:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<WrL68atH4OiygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 04:27:01 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<IOb6+atHwsWi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 04:27:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<BiFT+6tHLpKi8KbF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Jan  6 04:27:27 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@rehanseo.online>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=</fSN+6tHTJGPbtX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.209
country_id: 3996063
description:
2026-01-06 04:27:45 dovecot_login authenticator failed for H=([177.236.146.209]) [177.236.146.209]:48588: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 04:27:59 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<hats/atHDqIIijoY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.103
country_id: 6252001
description:
Jan  6 04:28:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.103, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<QDok/qtHwsuTuYRn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.228.53.136
country_id: 6252001
description:
Jan  6 04:28:52 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=66.228.53.136, lip=66.85.158.91, session=<D9K5AKxHarpC5DWI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-06 04:29:00 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (pnonglos) [87.103.126.54]:7277: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.248.111.238
country_id: 6252001
description:
2026-01-06 04:29:27 dovecot_plain authenticator failed for H=(uncot) [38.248.111.238]:55185: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  6 04:29:56 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@bostonlanka.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<YXZzBKxHhuKi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 04:30:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<yyYWBaxHsMsyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 04:29:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<PQ28AaxHdMBA46ZK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.226.119.1
country_id: 2921044
description:
Jan  6 04:30:58 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.226.119.1, lip=66.85.158.92, session=<cddACKxHuXRA4ncB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.59.134.178
country_id: 2921044
description:
Jan  6 04:30:59 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.59.134.178, lip=66.85.158.92, session=<u85GCKxH8EGLO4ay>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  6 04:31:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<gAd0C6xHQtAvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 04:32:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<fQ1HDaxHxst100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 04:32:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<uKYcDqxHBJtA46ZK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.213.126
country_id: 1819730
description:
Jan  6 04:32:49 host2 sshd[1391714]: Disconnected from invalid user es 123.58.213.126 port 37566 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 123.58.213.126
country_id: 1819730
description:
Jan  6 04:33:33 host2 sshd[1392087]: Disconnected from invalid user docker 123.58.213.126 port 38214 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  6 04:34:36 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@nsteeleng.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<I2wcFaxHxkqi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 04:34:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<+2eEFaxHBukIijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 04:35:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<IRj8FqxHvsEifrCV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.213.126
country_id: 1819730
description:
Jan  6 04:34:24 host2 sshd[1392421]: Disconnected from invalid user admin 123.58.213.126 port 52398 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 04:34:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<UaLDFKxHCrtCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Jan  6 04:35:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@melanifinefood.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<yqgAGKxHAucvT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan  6 04:35:53 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<pIqxGaxH+OQv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  6 04:36:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<suEdGqxHwqAvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 04:36:01 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<w6kxGqxHBMBm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Jan  6 04:36:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<+tOYG6xH5p9etwuC>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 04:40:46 host2 sshd[1397163]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.175.193.205
country_id: 1269750
description:
Jan  6 04:41:17 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=122.175.193.205, lip=66.85.158.91, session=<fhz9LKxHkuR6r8HN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  6 04:42:41 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<V/UFMqxHirWygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 04:42:51 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<Tg+lMqxHVMsIhpC/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Jan  6 04:45:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<jwxrO6xHOs4FhH+s>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  6 04:48:48 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<nyvpR6xH1MGi8Jp9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.164.107.5
country_id: 6252001
description:
Jan  6 04:48:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=194.164.107.5, lip=66.85.158.92, TLS: Connection closed, session=<h5AeSKxHWNrCpGsF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  6 04:49:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@melanifinefood.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<z0k/S6xHXuwyBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.175.193.205
country_id: 1269750
description:
Jan  6 04:49:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=122.175.193.205, lip=66.85.158.91, session=<3aB2SqxHqux6r8HN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 04:50:34 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<VB84TqxHCsCi8KbF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  6 04:52:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@lankaherbalsolutions.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<ZL+hVKxH3s+ygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 04:56:16 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<ShSbYqxHkMgyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Jan  6 04:56:57 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@sivagnanamfoundation.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<JAkIZaxHsiJetwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Jan  6 04:57:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@rehanseo.online>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<quVzaKxHNLSPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 04:57:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<pLraZ6xHOK6i8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  6 04:58:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<u3wQbKxHSKIvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 05:01:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<a8N7dqxHtqVm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 05:02:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<9uldeqxHroxCdMzo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 207.166.174.63
country_id: 1880251
description:
Jan  6 05:04:27 host2 sshd[1422983]: Disconnected from invalid user claude 207.166.174.63 port 46162 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 05:05:35 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<UZvmg6xHHqQIijoY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 65.38.97.236
country_id: 6252001
description:
Jan  6 05:05:55 host2 sshd[1424518]: Disconnected from invalid user claude 65.38.97.236 port 52188 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  6 05:06:57 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@sobaherbal.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<wmHKiKxHutyygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan  6 05:06:37 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<uvKWh6xHKuAv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.195.53.129
country_id: 6252001
description:
2026-01-06 05:06:42 dovecot_login authenticator failed for H=([74.195.53.129]) [74.195.53.129]:36794: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 65.38.97.236
country_id: 6252001
description:
Jan  6 05:08:01 host2 sshd[1426654]: Disconnected from invalid user steam 65.38.97.236 port 52100 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 05:09:02 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<84A7kKxHrq8ifrCV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 207.166.174.63
country_id: 1880251
description:
Jan  6 05:08:29 host2 sshd[1427109]: Disconnected from invalid user claude 207.166.174.63 port 37974 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 207.166.174.63
country_id: 1880251
description:
Jan  6 05:09:51 host2 sshd[1428399]: Disconnected from invalid user asterisk 207.166.174.63 port 51412 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 05:11:08 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<dei8l6xHeMsz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 05:12:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<ArkpnKxHCOsIijoY>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 47.254.85.115
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[47.254.85.115] [Remote Port]=[58012] [Authentication Database]=[mail] [Username]=[support@seyawin.com] (10/10 failures) (blocked until [Tue Jan  6 23:43:23 2026 UTC/Wed Jan  7 05:13:23 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan  6 05:13:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<lI/un6xHnOIv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 05:14:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<05+hoqxHAt5A46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 05:16:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<pkOGqqxHyOFm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.175.193.205
country_id: 1269750
description:
Jan  6 05:15:49 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=122.175.193.205, lip=66.85.158.91, session=<CbGJqKxHZtx6r8HN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 05:17:14 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<PX2RraxH6kJ100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 05:17:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<pSfBrKxHTu0vWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 05:17:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<9dYarqxHaJ4vWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 05:17:40 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<Og8ir6xHUplA46ZK>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 64.227.166.74
country_id: 1269750
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[64.227.166.74] [Remote Port]=[39250] [Authentication Database]=[mail] [Username]=[contact@bostonlanka.com] (16/10 failures) (blocked until [Tue Jan  6 23:47:38 2026 UTC/Wed Jan  7 05:17:38 2026 LOCAL])


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 50.6.249.92
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[50.6.249.92] [Remote Port]=[45058] [Authentication Database]=[mail] [Username]=[finance@melanifinefood.com] (10/10 failures) (blocked until [Tue Jan  6 23:49:11 2026 UTC/Wed Jan  7 05:19:11 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  6 05:19:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@melanifinefood.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<4YOvtKxHArAyBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 05:19:53 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<CwgVt6xH6J0IhpC/>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 162.240.166.197
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[162.240.166.197] [Remote Port]=[37012] [Authentication Database]=[mail] [Username]=[hr@ceylondigest.com] (10/10 failures) (blocked until [Tue Jan  6 23:50:54 2026 UTC/Wed Jan  7 05:20:54 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 05:20:56 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<IfnTuqxHlJCi8KbF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.175.193.205
country_id: 1269750
description:
Jan  6 05:22:58 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=122.175.193.205, lip=66.85.158.91, session=<im0UwqxHhut6r8HN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.30
country_id: 1269750
description:
2026-01-06 05:23:41 dovecot_login authenticator failed for H=([182.95.119.30]) [182.95.119.30]:48950: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2026-01-06 05:23:59 dovecot_login authenticator failed for H=(138.219.244.10.static.softdados.net) [177.128.209.48]:52406: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.228.17
country_id: 2589581
description:
2026-01-06 05:24:39 dovecot_login authenticator failed for H=(ADMIN) [176.125.228.17]:65180: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 50.6.195.206
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[50.6.195.206] [Remote Port]=[35748] [Authentication Database]=[mail] [Username]=[finance@mathsmotorcysle.xyz] (10/10 failures) (blocked until [Tue Jan  6 23:56:04 2026 UTC/Wed Jan  7 05:26:04 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 05:26:06 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<DJ9IzaxHpIsyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Jan  6 05:26:51 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<+fb4z6xH3swvT1jH>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 162.240.100.50
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[162.240.100.50] [Remote Port]=[60696] [Authentication Database]=[mail] [Username]=[admin@essenceceylontea.com] (10/10 failures) (blocked until [Tue Jan  6 23:58:10 2026 UTC/Wed Jan  7 05:28:10 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Jan  6 05:28:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<5r1k1axHeR9etwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Jan  6 05:27:42 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@rehanseo.online>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<eer90qxHiL+PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 05:28:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<PQvO1KxHGO2i8GQy>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 94.183.11.130
country_id: 130758
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[94.183.11.130] [Remote Port]=[8057] [Authentication Database]=[mail] [Username]=[hr@sivagnanamfoundation.com] (10/10 failures) (blocked until [Tue Jan  6 23:58:20 2026 UTC/Wed Jan  7 05:28:20 2026 LOCAL])


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 207.90.244.14
country_id: 6252001
description:
Jan  6 05:29:02 host2 dovecot[1170291]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=207.90.244.14, lip=66.85.158.91, TLS, session=<mHnp16xHtpXPWvQO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.14
country_id: 6252001
description:
Jan  6 05:29:10 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=207.90.244.14, lip=66.85.158.91, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<Wexe2KxHup/PWvQO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.172.200
country_id: 6252001
description:
Jan  6 05:30:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=165.154.172.200, lip=66.85.158.92, session=<ldKb3qxHWqClmqzI>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 165.154.172.200
country_id: 6252001
description:
Jan  6 05:30:56 host2 dovecot[1170291]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 2 secs): user=<>, rip=165.154.172.200, lip=66.85.158.92, session=<gzis3qxHIKGlmqzI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.46.148.180
country_id: 6252001
description:
2026-01-06 05:33:06 dovecot_plain authenticator failed for H=c-68-46-148-180.hsd1.mi.comcast.net (suria) [68.46.148.180]:60306: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 05:33:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<exvv6KxHiIhCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 05:34:48 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<o3Rm7KxHNtlm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan  6 05:38:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<Vn0J+KxHEJEv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 05:39:17 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<P5lr/KxHcrMIijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 05:40:21 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<zSlGAK1HzcAz0msW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2026-01-06 05:42:23 dovecot_plain authenticator failed for H=(antan) [12.150.243.22]:17581: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.57.141
country_id: 6252001
description:
Jan  6 05:43:21 host2 sshd[1462565]: Disconnected from invalid user adit 198.98.57.141 port 39548 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan  6 05:44:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<tQlvDq1H/uIv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 05:43:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<6881C61HIpgifrCV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  6 05:43:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailer-demo@melanifinefood.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<TkNoDK1H5oIyBvlc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.95.187
country_id: 1643084
description:
Jan  6 05:43:49 host2 sshd[1462968]: Disconnected from invalid user admin 103.59.95.187 port 38756 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.57.141
country_id: 6252001
description:
Jan  6 05:44:30 host2 sshd[1463785]: Disconnected from invalid user fedora 198.98.57.141 port 56950 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 05:44:35 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postmaster@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<2Y9nD61HyOGi8KbF>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.98.57.141
country_id: 6252001
description:
Jan  6 05:45:10 host2 sshd[1464544]: Disconnected from invalid user ubuntu 198.98.57.141 port 41532 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.143.238.173
country_id: 1819730
description:
Jan  6 05:45:16 host2 sshd[1464699]: Disconnected from invalid user claude 103.143.238.173 port 56468 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 216.218.206.67
country_id: 6252001
description:
Jan  6 05:45:23 host2 pure-ftpd[1464869]: (?@216.218.206.67) [INFO] New connection from 216.218.206.67


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.143.238.173
country_id: 1819730
description:
Jan  6 05:46:22 host2 sshd[1466131]: Disconnected from invalid user ubuntu 103.143.238.173 port 46114 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.153
country_id: 3077311
description:
2026-01-06 05:45:24 dovecot_login authenticator failed for H=(ADMIN) [212.102.39.153]:34189: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.15.132
country_id: 1733045
description:
Jan  6 05:45:45 host2 sshd[1465434]: Disconnected from invalid user factorio 202.165.15.132 port 37193 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.143.238.173
country_id: 1819730
description:
Jan  6 05:45:50 host2 sshd[1465581]: Disconnected from invalid user jia 103.143.238.173 port 56648 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 05:47:15 host2 sshd[1466899]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.143.238.173
country_id: 1819730
description:
Jan  6 05:47:25 host2 sshd[1467019]: Disconnected from invalid user adit 103.143.238.173 port 56802 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.68.104.233
country_id: 2921044
description:
Jan  6 05:47:49 host2 sshd[1467513]: Disconnected from invalid user claude 138.68.104.233 port 37626 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.15.132
country_id: 1733045
description:
Jan  6 05:47:58 host2 sshd[1467673]: Disconnected from invalid user test 202.165.15.132 port 49011 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.232.41.236
country_id: 1527747
description:
Jan  6 05:48:15 host2 sshd[1467934]: Disconnected from invalid user ts3server 94.232.41.236 port 33958 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.15.132
country_id: 1733045
description:
Jan  6 05:48:35 host2 sshd[1468239]: Disconnected from invalid user adit 202.165.15.132 port 55520 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.165.15.132
country_id: 1733045
description:
Jan  6 05:49:09 host2 sshd[1468810]: Disconnected from invalid user ts3server 202.165.15.132 port 13740 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.232.41.236
country_id: 1527747
description:
Jan  6 05:49:51 host2 sshd[1469553]: Disconnected from invalid user claude 94.232.41.236 port 37154 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.15.132
country_id: 1733045
description:
Jan  6 05:50:16 host2 sshd[1470177]: Disconnected from invalid user misp 202.165.15.132 port 59182 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 05:50:21 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<OH4CJK1HpJUyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 05:49:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<XdqdIK1HApxm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 05:50:29 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<ORV7JK1HQ+J100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Jan  6 05:51:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postmaster@sivagnanamfoundation.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<xfFUJq1H4gtetwuC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.95.187
country_id: 1643084
description:
Jan  6 05:50:38 host2 sshd[1470545]: Disconnected from invalid user arch 103.59.95.187 port 59030 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 94.232.41.236
country_id: 1527747
description:
Jan  6 05:50:23 host2 sshd[1470300]: Disconnected from invalid user claude 94.232.41.236 port 48290 [preauth]


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 143.110.213.247
country_id: 6251999
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[143.110.213.247] [Remote Port]=[51328] [Authentication Database]=[mail] [Username]=[mailer-demo@rehanseo.online] (10/10 failures) (blocked until [Wed Jan  7 00:21:49 2026 UTC/Wed Jan  7 05:51:49 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 05:51:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postmaster@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<d8oIKa1HOoSi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Jan  6 05:51:51 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailer-demo@rehanseo.online>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<ksZhKa1HgMiPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.175.193.205
country_id: 1269750
description:
Jan  6 05:53:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=122.175.193.205, lip=66.85.158.91, session=<PAl/La1HKtZ6r8HN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.239.41.74
country_id: 3469034
description:
2026-01-06 05:53:12 dovecot_login authenticator failed for H=(201-28-33-49.customer.tdatabrasil.net.br) [186.239.41.74]:47945: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 05:53:34 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<5AeLL61HKL4IhpC/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2026-01-06 05:53:37 dovecot_login authenticator failed for H=([125.19.160.206]) [125.19.160.206]:44296: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2026-01-06 05:55:09 dovecot_plain authenticator failed for H=c-174-169-224-27.hsd1.vt.comcast.net (unomphyle) [174.169.224.27]:34330: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.165
country_id: 6252001
description:
Jan  6 05:55:32 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.165, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<A8asNq1HidTG6xil>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 05:56:56 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailer-demo@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<K0GOO61HxolCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.175.193.205
country_id: 1269750
description:
Jan  6 06:01:05 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@lankaherbalsolutions.com>, method=PLAIN, rip=122.175.193.205, lip=66.85.158.91, session=<fnhuSq1HHqd6r8HN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.252.223.155
country_id: 719819
description:
2026-01-06 06:02:44 dovecot_login authenticator failed for H=(ADMIN) [185.252.223.155]:19176: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.14
country_id: 6252001
description:
Jan  6 06:03:06 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=207.90.244.14, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<hi68Ua1H9pjPWvQO>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 207.90.244.14
country_id: 6252001
description:
Jan  6 06:03:04 host2 dovecot[1170291]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=207.90.244.14, lip=66.85.158.92, TLS, session=<BVqkUa1H8pjPWvQO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 06:05:16 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailer-demo@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<3c9WWa1HE70z0msW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.190
country_id: 1269750
description:
2026-01-06 06:05:33 dovecot_login authenticator failed for H=([27.123.98.190]) [27.123.98.190]:42564: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.76
country_id: 1733045
description:
2026-01-06 06:05:53 dovecot_login authenticator failed for H=([49.124.151.76]) [49.124.151.76]:46418: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.138
country_id: 6252001
description:
Jan  6 06:05:59 host2 pure-ftpd[1486783]: (?@205.210.31.138) [INFO] New connection from 205.210.31.138


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 06:08:14 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postmaster@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<DAn7Y61HnMpA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan  6 06:08:21 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailer-demo@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<gQ1pZK1H0sQv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 06:07:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<BCKtYq1HsINm2gqW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.21
country_id: 798549
description:
Jan  6 06:08:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.21, lip=66.85.158.91, session=<rnH5Y61H/NxV2ZUV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.61.201
country_id: 953987
description:
Jan  6 06:09:36 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=102.129.61.201, lip=66.85.158.91, TLS, session=<l97UZ61HwZhmgT3J>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.67.161.44
country_id: 6252001
description:
Jan  6 06:08:58 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=40.67.161.44, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<zm22Zq1HdtwoQ6Es>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.229.252.203
country_id: 3865483
description:
Jan  6 06:09:58 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<charanaw>, method=PLAIN, rip=200.229.252.203, lip=66.85.158.91, TLS, session=<AiInaa1HRZ/I5fzL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan  6 06:10:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<EQFna61HZtsv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 06:11:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postmaster@lankaherbalsolutions.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<f/aHbq1HkrYvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 06:11:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postmaster@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<j1ptcK1HNIZA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 06:13:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<Xnrsda1HssIIijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  6 06:13:21 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailer-demo@melanifinefood.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<bGJGdq1Hfr0yBvlc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.46.124.0
country_id: 3686110
description:
2026-01-06 06:14:32 dovecot_login authenticator failed for H=(azteca-comunicaciones.com) [201.46.124.0]:1976: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 06:15:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailer-demo@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<ej/efK1HUJyi8KbF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.36.82
country_id: 1210997
description:
2026-01-06 06:14:54 dovecot_login authenticator failed for H=([49.0.36.82]) [49.0.36.82]:47168: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 34.126.176.149
country_id: 1880251
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[34.126.176.149] [Remote Port]=[60334] [Authentication Database]=[mail] [Username]=[finance@melanifinefood.com] (10/10 failures) (blocked until [Wed Jan  7 00:47:51 2026 UTC/Wed Jan  7 06:17:51 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 06:17:53 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<EJ51hq1HrusifrCV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 169.239.118.15
country_id: 2215636
description:
Jan  6 06:20:38 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=169.239.118.15, lip=66.85.158.91, TLS, session=<n2Jyj61H6Lyp73YP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.29.28
country_id: 798544
description:
Jan  6 06:20:40 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=178.216.29.28, lip=66.85.158.91, TLS, session=<ohKDj61H5p6y2B0c>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 06:20:04 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<gKZFjq1HWJsIijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.207.35.213
country_id: 6290252
description:
Jan  6 06:20:20 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@jrdc.lk>, method=PLAIN, rip=109.207.35.213, lip=66.85.158.91, TLS, session=<tgpejq1HWpptzyPV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.41.235.115
country_id: 3865483
description:
Jan  6 06:20:22 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@jrdc.lk>, method=PLAIN, rip=181.41.235.115, lip=66.85.158.91, TLS, session=<+tJrjq1HxrG1Ketz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 155.133.56.74
country_id: 798544
description:
Jan  6 06:20:38 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=155.133.56.74, lip=66.85.158.91, TLS, session=<vgRhj61HogqbhThK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.206.98.135
country_id: 6290252
description:
Jan  6 06:20:38 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=109.206.98.135, lip=66.85.158.91, TLS, session=<jGVuj61HsuFtzmKH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.213.48
country_id: 933860
description:
Jan  6 06:20:43 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=41.216.213.48, lip=66.85.158.91, TLS, session=<mligj61HjYEp2NUw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.140.234.221
country_id: 719819
description:
Jan  6 06:20:19 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@jrdc.lk>, method=PLAIN, rip=45.140.234.221, lip=66.85.158.91, TLS, session=<STVOjq1Hd5AtjOrd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.98.177
country_id: 3469034
description:
Jan  6 06:20:20 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@jrdc.lk>, method=PLAIN, rip=187.120.98.177, lip=66.85.158.91, TLS, session=<+O9Wjq1H6ZG7eGKx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.85.104.155
country_id: 3469034
description:
Jan  6 06:20:22 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@jrdc.lk>, method=PLAIN, rip=187.85.104.155, lip=66.85.158.91, TLS, session=<TEdQjq1HQ9a7VWib>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 06:20:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailer-demo@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<OSfqj61HOLEyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Jan  6 06:21:37 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailer-demo@rehanseo.online>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<GgnWk61HCoyPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 06:22:32 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<i1Mgl61Hsohm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 06:22:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postmaster@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<NZm6la1HdsSi8GQy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 184.174.20.28
country_id: 6252001
description:
Jan  6 06:22:20 host2 sshd[1500121]: Invalid user cloudtourssrilan_travel from 184.174.20.28 port 28054


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Jan  6 06:22:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailer-demo@sivagnanamfoundation.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<UlQpl61HaCBetwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.153.3.94
country_id: 3175395
description:
Jan  6 06:23:11 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=185.153.3.94, lip=66.85.158.91, TLS, session=<QqaSmK1HbMm5mQNe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 06:23:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<zhBDmq1HzVJ100Db>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 117.211.64.219
country_id: 1269750
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[117.211.64.219] [Remote Port]=[21197] [Authentication Database]=[mail] [Username]=[sales@kiriaswanu.com] (10/10 failures) (blocked until [Wed Jan  7 00:53:23 2026 UTC/Wed Jan  7 06:23:23 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.39.178
country_id: 953987
description:
Jan  6 06:23:33 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=102.64.39.178, lip=66.85.158.91, TLS, session=<MgC3ma1H2qxmQCey>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.236.9
country_id: 614540
description:
2026-01-06 06:27:23 dovecot_login authenticator failed for H=(ADMIN) [95.181.236.9]:44538: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 06:27:29 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<wOLLqK1HyqgIhpC/>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 8.134.144.191
country_id: 1814991
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[8.134.144.191] [Remote Port]=[43210] [Authentication Database]=[mail] [Username]=[support@sivagnanamfoundation.com] (10/10 failures) (blocked until [Wed Jan  7 00:57:27 2026 UTC/Wed Jan  7 06:27:27 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 06:27:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailer-demo@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<Va3Uqa1H3MhCdMzo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.108.231.55
country_id: 2077456
description:
Jan  6 06:27:52 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=103.108.231.55, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<5udOqq1HotJnbOc3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 184.174.20.28
country_id: 6252001
description:
Jan  6 06:27:57 host2 sshd[1505164]: Invalid user cloudtourssrilan_travel from 184.174.20.28 port 48023


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2026-01-06 06:29:10 dovecot_plain authenticator failed for H=(plugs) [65.20.160.107]:38128: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.108.231.55
country_id: 2077456
description:
Jan  6 06:30:31 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=103.108.231.55, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<vIHEs61HDvNnbOc3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.117.126
country_id: 6252001
description:
Jan  6 06:30:53 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=40.124.117.126, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<B9Ifta1Hir4ofHV+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.175.193.205
country_id: 1269750
description:
Jan  6 06:33:42 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@sobaherbal.com>, method=PLAIN, rip=122.175.193.205, lip=66.85.158.91, session=<PGYJv61HmOF6r8HN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 06:34:29 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<cJvewa1H+bUz0msW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-06 06:35:08 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:64523: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.212.54
country_id: 99237
description:
2026-01-06 06:35:43 dovecot_login authenticator failed for H=([62.201.212.54]) [62.201.212.54]:43324: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 06:40:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailer-demo@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<6+UZ161HTuJA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 06:40:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<kITd2K1HIqlm2gqW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2026-01-06 06:44:25 dovecot_plain authenticator failed for H=c-71-235-225-181.hsd1.ct.comcast.net (haratom) [71.235.225.181]:55752: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.230.231
country_id: 1861060
description:
Jan  6 06:44:15 host2 sshd[1520781]: Disconnected from invalid user tao 118.194.230.231 port 46822 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 06:44:17 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<cpanel@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<PWDt5K1H2IAIhpC/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2026-01-06 06:45:47 dovecot_plain authenticator failed for H=(bellin) [102.53.15.180]:42445: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.163.123.45
country_id: 1880251
description:
Jan  6 06:44:59 host2 sshd[1521498]: Disconnected from invalid user claude 43.163.123.45 port 48004 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 06:46:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<cpanel@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<dt41661HtNJCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 06:47:16 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contacts@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<OOiN761H0qxA46ZK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.163.123.45
country_id: 1880251
description:
Jan  6 06:47:28 host2 sshd[1524181]: Disconnected from invalid user tester 43.163.123.45 port 33644 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.230.231
country_id: 1861060
description:
Jan  6 06:47:41 host2 sshd[1524338]: Disconnected from invalid user claude 118.194.230.231 port 46928 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.194.230.231
country_id: 1861060
description:
Jan  6 06:48:22 host2 sshd[1524966]: Disconnected from invalid user qw 118.194.230.231 port 46988 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 06:48:16 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<commercial@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<cRgm861Hpu0IijoY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.163.123.45
country_id: 1880251
description:
Jan  6 06:49:50 host2 sshd[1526133]: Disconnected from invalid user ubuntu 43.163.123.45 port 52918 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.32.48.81
country_id: 6251999
description:
2026-01-06 06:50:30 dovecot_login authenticator failed for H=(ADMIN) [212.32.48.81]:19190: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  6 06:51:43 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<rPWc/61H6MADhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2026-01-06 06:51:45 dovecot_login authenticator failed for H=([152.52.234.46]) [182.95.176.194]:42272: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 166.198.103.11
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 166.198.103.11 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.41.251.88
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 73.41.251.88 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.108.117.44
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 74.108.117.44 - tradeceylon "GET /login/?login_only=1&user=tradeceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.123.5.44
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 99.123.5.44 - tradeceylo "GET /login/?login_only=1&user=tradeceylo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceylo (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.175.193.205
country_id: 1269750
description:
Jan  6 06:52:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postmaster@sobaherbal.com>, method=PLAIN, rip=122.175.193.205, lip=66.85.158.91, session=<YbiDAK5H5uZ6r8HN>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.163.123.45
country_id: 1880251
description:
Jan  6 06:52:40 host2 sshd[1528884]: Disconnected from invalid user john 43.163.123.45 port 55826 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.241.61.64
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 108.241.61.64 - tradeceyloncom "GET /login/?login_only=1&user=tradeceyloncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyloncom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.149.79
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 172.58.149.79 - tradece2 "GET /login/?login_only=1&user=tradece2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece2 (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 06:52:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<VOmlAa5H+qIifrCV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  6 06:52:31 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: Connection closed, session=<FKd3Aq5HeLADhBfJ>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 122.175.193.205
country_id: 1269750
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[122.175.193.205] [Remote Port]=[59110] [Authentication Database]=[mail] [Username]=[postmaster@sobaherbal.com] (10/10 failures) (blocked until [Wed Jan  7 01:21:58 2026 UTC/Wed Jan  7 06:51:58 2026 LOCAL])


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.197.36.151
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 107.197.36.151 - tradecey "GET /login/?login_only=1&user=tradecey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradecey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.65.144.107
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 99.65.144.107 - tradece "GET /login/?login_only=1&user=tradece&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.10.0.164
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 68.10.0.164 - trade "GET /login/?login_only=1&user=trade&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trade (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 140.186.244.228
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 140.186.244.228 - tradece1 "GET /login/?login_only=1&user=tradece1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.105.245.48
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 143.105.245.48 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.150.97.94
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 69.150.97.94 - tradec "GET /login/?login_only=1&user=tradec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 147.136.9.237
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 147.136.9.237 - trad "GET /login/?login_only=1&user=trad&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trad (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 199.241.224.114
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 199.241.224.114 - tra "GET /login/?login_only=1&user=tra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tra (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.20.84.55
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 76.20.84.55 - tr "GET /login/?login_only=1&user=tr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tr (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.222
country_id: 1733045
description:
2026-01-06 06:52:12 dovecot_login authenticator failed for H=([49.124.152.222]) [49.124.152.222]:49240: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 06:52:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<client@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<5jUjAa5HlLei8KbF>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.228.114.202
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 68.228.114.202 - tradeceyl "GET /login/?login_only=1&user=tradeceyl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyl (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.49.246.176
country_id: 6252001
description:
Jan  6 06:54:12 host2 sshd[1530322]: Disconnected from invalid user celery 69.49.246.176 port 41242 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  6 06:54:13 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<yeCDCK5HougDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 06:54:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contacts@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<Zj4UCa5H7LMyBsPO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  6 06:55:20 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<hVuJDK5H3KQDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 06:55:37 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notice@sobaherbal.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<mTZoDa5H9uAvWBNS>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 69.49.246.176
country_id: 6252001
description:
Jan  6 06:55:48 host2 sshd[1532137]: Disconnected from invalid user claude 69.49.246.176 port 40308 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  6 06:55:56 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<6MqrDq5HdK8DhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.49.246.176
country_id: 6252001
description:
Jan  6 06:56:17 host2 sshd[1532565]: Disconnected from invalid user testuser 69.49.246.176 port 33384 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  6 06:56:51 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: Connection closed, session=<W+/6Ea5HEsgDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 06:58:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<1S8lFq5HbtVm2gqW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.28.242.198
country_id: 2361809
description:
Jan  6 06:58:12 host2 sshd[1534326]: Disconnected from invalid user luser 196.28.242.198 port 52604 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Jan  6 06:58:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<ni2XGK5HditetwuC>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.16
country_id: 2635167
description:
Jan  6 06:59:04 host2 dovecot[1170291]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.16, lip=66.85.158.92, TLS, session=<2xbgGa5HJ+e594kQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.80
country_id: 2635167
description:
Jan  6 06:59:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.80, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<pIfFGq5H+9O594lQ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.28.242.198
country_id: 2361809
description:
Jan  6 06:59:33 host2 sshd[1535502]: Disconnected from invalid user testuser 196.28.242.198 port 55182 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  6 06:58:54 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<EblRGa5HGOkDhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.28.242.198
country_id: 2361809
description:
Jan  6 07:00:11 host2 sshd[1536263]: Disconnected from invalid user webadm 196.28.242.198 port 44084 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.78
country_id: 2635167
description:
Jan  6 07:00:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.78, lip=66.85.158.92, TLS handshaking: Connection closed, session=<NQq8Hq5Hd+C594lO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.76
country_id: 2635167
description:
Jan  6 06:59:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.76, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<C8zAHK5HXbG594lM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.100
country_id: 2635167
description:
Jan  6 07:00:59 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=185.247.137.100, lip=66.85.158.92, TLS handshaking: Connection closed, session=<B223IK5Hc6K594lk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.89
country_id: 2635167
description:
Jan  6 07:01:32 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.89, lip=66.85.158.92, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<BNeyIq5Hv6FX7LBZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.100
country_id: 2635167
description:
Jan  6 07:02:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.100, lip=66.85.158.92, TLS handshaking: Connection closed, session=<+3qpJq5Hb5e594lk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.106
country_id: 2635167
description:
Jan  6 07:02:05 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.106, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<hy+sJK5H+55X7LBq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 07:02:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<h3HuJa5HqqV100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 07:02:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<commercial@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<PrsVJq5HKNQIijoY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.81
country_id: 2635167
description:
Jan  6 07:03:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=87.236.176.81, lip=66.85.158.92, TLS handshaking: Connection closed, session=<+tqkKK5HQ61X7LBR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  6 07:03:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@melanifinefood.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<Dwl3Kq5H7NEyBvlc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.91
country_id: 2635167
description:
Jan  6 07:03:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<yCyeKq5HLdpX7LBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.93
country_id: 2635167
description:
Jan  6 07:04:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.93, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<5ZWZLK5HJZJX7LBd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 07:06:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<L9hxM65HLJii8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 07:08:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notice@lankaherbalsolutions.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<miz9PK5HKoovWBNS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.133.47.11
country_id: 1522867
description:
2026-01-06 07:09:29 dovecot_login authenticator failed for H=(ADMIN) [62.133.47.11]:14428: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 07:10:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<L8zgQK5HSecz0msW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.184.83.17
country_id: 6252001
description:
2026-01-06 07:10:22 dovecot_login authenticator failed for H=h17.83.184.173.dynamic.ip.windstream.net [173.184.83.17]:54732: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.103.120.150
country_id: 1819730
description:
2026-01-06 07:10:43 dovecot_login authenticator failed for H=150.120.103.218.static.netvigator.com [218.103.120.150]:52636: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 07:12:37 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contacts@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<TCk1Sq5H6JVA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 07:14:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<l2fFT65HyOlm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 07:16:48 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sale@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<gTUuWa5H/p1CdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  6 07:17:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<cpanel@melanifinefood.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<BAgMW65H/LUyBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 07:18:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<panel@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<Z0wNXq5HJuUIhpC/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 07:19:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<43ldYq5H/KVA46ZK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.39.58.191
country_id: 2635167
description:
Jan  6 07:19:30 host2 sshd[1555464]: Disconnected from invalid user logger 34.39.58.191 port 33962 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.39.58.191
country_id: 2635167
description:
Jan  6 07:20:02 host2 sshd[1555854]: Disconnected from invalid user csczserver 34.39.58.191 port 32908 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.39.58.191
country_id: 2635167
description:
Jan  6 07:21:04 host2 sshd[1556934]: Disconnected from invalid user m1 34.39.58.191 port 41638 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.190.155.43
country_id: 6252001
description:
2026-01-06 07:21:35 dovecot_plain authenticator failed for H=(hienests) [76.190.155.43]:35085: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 07:22:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<nEjxbK5HsI4IijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 07:22:53 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<q+z1bq5HdpKi8KbF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 07:24:42 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<dg1xda5HzL0yBsPO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.250.81.123
country_id: 1733045
description:
Jan  6 07:24:22 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=783) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=47.250.81.123, lip=66.85.158.91, TLS handshaking: read(size=783) failed: Connection reset by peer, session=<DyBjdK5HOKAv+lF7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.175.193.205
country_id: 1269750
description:
Jan  6 07:24:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shop@lankaherbalsolutions.com>, method=PLAIN, rip=122.175.193.205, lip=66.85.158.91, session=<+sm4dK5HruF6r8HN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.250.81.123
country_id: 1733045
description:
Jan  6 07:24:53 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=47.250.81.123, lip=66.85.158.91, TLS, session=<h00wdq5HPKAv+lF7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 07:26:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mail@sobaherbal.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<zlLxe65HvK8vWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 07:26:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<0QAsfa5H5LYifrCV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-06 07:34:35 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:49591: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.232.44
country_id: 2542007
description:
2026-01-06 07:35:47 dovecot_login authenticator failed for H=(ADMIN) [95.181.232.44]:17988: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.248.129.252
country_id: 2921044
description:
Jan  6 07:43:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=104.248.129.252, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<DWmiua5H05Bo+IH8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2026-01-06 07:43:13 dovecot_login authenticator failed for H=([196.191.212.236]) [213.55.85.202]:4086: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.217.204.91
country_id: 2658434
description:
2026-01-06 07:43:26 dovecot_login authenticator failed for H=adsl-89-217-204-91.adslplus.ch [89.217.204.91]:33370: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.123
country_id: 6252001
description:
Jan  6 07:43:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 16 secs): user=<>, rip=66.132.153.123, lip=66.85.158.91, TLS handshaking: Connection closed, session=<7Zuoua5HDghChJl7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.122.80
country_id: 2921044
description:
Jan  6 07:44:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=46.101.122.80, lip=66.85.158.91, TLS handshaking: Connection closed, session=<oJC8u65HdMcuZXpQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.248.129.252
country_id: 2921044
description:
Jan  6 07:43:56 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=104.248.129.252, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<Nhleuq5HuTNo+IH8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.143
country_id: 6252001
description:
Jan  6 07:45:21 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.143, lip=66.85.158.91, TLS: Connection closed, session=<IGZpv65HBjJChJmP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 161.35.79.234
country_id: 2921044
description:
Jan  6 07:44:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=161.35.79.234, lip=66.85.158.91, TLS handshaking: Connection closed, session=<3DHNva5HbrWhI0/q>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 212.154.234.9
country_id: 1522867
description:
Jan  6 07:46:46 host2 sshd[1581515]: Disconnected from invalid user nc 212.154.234.9 port 58881 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.154.234.9
country_id: 1522867
description:
Jan  6 07:47:33 host2 sshd[1582183]: Disconnected from invalid user bodega 212.154.234.9 port 11399 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.154.234.9
country_id: 1522867
description:
Jan  6 07:48:07 host2 sshd[1582682]: Disconnected from invalid user minecraft 212.154.234.9 port 41920 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.106.76
country_id: 3469034
description:
Jan  6 07:49:36 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=187.120.106.76, lip=66.85.158.91, TLS, session=<eG51za5HV4G7eGpM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.87.201.135
country_id: 3469034
description:
Jan  6 07:49:57 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=177.87.201.135, lip=66.85.158.91, TLS, session=<Cai4zq5H8tGxV8mH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.47.53.19
country_id: 798549
description:
Jan  6 07:53:39 host2 sshd[1588195]: Disconnected from invalid user admin 89.47.53.19 port 32794 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.121.61.198
country_id: 3017382
description:
2026-01-06 07:55:07 dovecot_login authenticator failed for H=ip198.ip-91-121-61.eu (ADMIN) [91.121.61.198]:57084: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.47.53.19
country_id: 798549
description:
Jan  6 07:55:18 host2 sshd[1590429]: Disconnected from invalid user admin 89.47.53.19 port 40382 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.156.128.122
country_id: 2264397
description:
Jan  6 07:56:35 host2 pure-ftpd[1591787]: (?@45.156.128.122) [INFO] New connection from 45.156.128.122


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 89.47.53.19
country_id: 798549
description:
Jan  6 07:56:48 host2 sshd[1592006]: Disconnected from invalid user claude 89.47.53.19 port 47382 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.47.53.19
country_id: 798549
description:
Jan  6 07:57:19 host2 sshd[1592496]: Disconnected from invalid user claude 89.47.53.19 port 59122 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.154.77.48
country_id: 1643084
description:
Jan  6 07:57:42 host2 sshd[1592882]: Disconnected from invalid user claude 103.154.77.48 port 48830 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.89.28.139
country_id: 1643084
description:
Jan  6 07:58:49 host2 sshd[1593869]: Disconnected from invalid user ghost 36.89.28.139 port 42994 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.89.28.139
country_id: 1643084
description:
Jan  6 07:59:26 host2 sshd[1594426]: Disconnected from invalid user sun 36.89.28.139 port 39444 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.154.77.48
country_id: 1643084
description:
Jan  6 07:59:46 host2 sshd[1594677]: Disconnected from invalid user admin 103.154.77.48 port 55714 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.154.77.48
country_id: 1643084
description:
Jan  6 08:00:54 host2 sshd[1595925]: Disconnected from invalid user claude 103.154.77.48 port 49576 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.97.24.41
country_id: 732800
description:
Jan  6 08:01:44 host2 sshd[1596699]: Disconnected from invalid user xuhao 83.97.24.41 port 60332 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 08:01:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<btX8+a5HMtgifrCV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.218.149
country_id: 1880251
description:
Jan  6 08:02:03 host2 sshd[1597177]: Disconnected from invalid user admin 152.32.218.149 port 40174 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 83.97.24.41
country_id: 732800
description:
Jan  6 08:02:14 host2 sshd[1597331]: Disconnected from invalid user tung 83.97.24.41 port 44104 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.64.27.145
country_id: 3932488
description:
Jan  6 08:02:42 host2 sshd[1597765]: Disconnected from invalid user tung 181.64.27.145 port 52936 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.89.28.139
country_id: 1643084
description:
Jan  6 08:01:59 host2 sshd[1597080]: Disconnected from invalid user claude 36.89.28.139 port 49468 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.164.107.6
country_id: 6252001
description:
Jan  6 08:03:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=194.164.107.6, lip=66.85.158.92, session=<I85T/65HEKPCpGsG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.89.28.139
country_id: 1643084
description:
Jan  6 08:03:17 host2 sshd[1598441]: Disconnected from invalid user testuser 36.89.28.139 port 55588 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.64.27.145
country_id: 3932488
description:
Jan  6 08:03:21 host2 sshd[1598569]: Disconnected from invalid user terry 181.64.27.145 port 43070 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.218.149
country_id: 1880251
description:
Jan  6 08:04:00 host2 sshd[1599154]: Disconnected from invalid user claude 152.32.218.149 port 35468 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.64.27.145
country_id: 3932488
description:
Jan  6 08:05:26 host2 sshd[1600838]: Disconnected from invalid user adminuser 181.64.27.145 port 36612 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.64.27.145
country_id: 3932488
description:
Jan  6 08:06:06 host2 sshd[1601402]: Disconnected from invalid user claude 181.64.27.145 port 52370 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.203.22
country_id: 1880251
description:
Jan  6 08:06:12 host2 sshd[1601490]: Disconnected from invalid user test 45.78.203.22 port 43018 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.64.27.145
country_id: 3932488
description:
Jan  6 08:06:46 host2 sshd[1601935]: Disconnected from invalid user ashok 181.64.27.145 port 56512 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 166.170.48.43
country_id: 6252001
description:
Jan  6 08:07:03 host2 sshd[1602204]: Disconnected from invalid user proxyuser 166.170.48.43 port 63401 [preauth]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 195.178.110.132
country_id: 732800
description:
Denial of Service (DoS) attack was discovered from 195.178.110.132: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 166.170.48.43
country_id: 6252001
description:
Jan  6 08:07:47 host2 sshd[1602839]: Disconnected from invalid user dk 166.170.48.43 port 2174 [preauth]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 195.178.110.132
country_id: 732800
description:
Denial of Service (DoS) attack was discovered from 195.178.110.132: 445 connections per 30 seconds to 443 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.188.130
country_id: 3144096
description:
2026-01-06 08:08:33 dovecot_login authenticator failed for H=(cm-84.213.188.130.get.no) [84.213.188.130]:50226: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.50.154
country_id: 1269750
description:
2026-01-06 08:08:45 dovecot_login authenticator failed for H=([125.19.93.105]) [182.95.50.154]:45708: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 166.170.48.43
country_id: 6252001
description:
Jan  6 08:08:59 host2 sshd[1604324]: Disconnected from invalid user alice 166.170.48.43 port 24219 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.142
country_id: 1269750
description:
2026-01-06 08:09:04 dovecot_login authenticator failed for H=([128.185.227.142]) [128.185.227.142]:39444: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.84
country_id: 1210997
description:
2026-01-06 08:09:15 dovecot_login authenticator failed for H=([103.115.252.60]) [103.115.252.84]:44304: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.142
country_id: 1269750
description:
2026-01-06 08:09:50 dovecot_login authenticator failed for H=([182.79.202.89]) [182.95.230.142]:37414: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.203.22
country_id: 1880251
description:
Jan  6 08:10:25 host2 sshd[1605774]: Disconnected from invalid user bitrix 45.78.203.22 port 51104 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.32.122.72
country_id: 597427
description:
2026-01-06 08:13:15 dovecot_login authenticator failed for H=(ADMIN) [194.32.122.72]:1325: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2026-01-06 08:17:36 dovecot_plain authenticator failed for H=(genear) [65.20.205.197]:52239: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2026-01-06 08:18:23 dovecot_plain authenticator failed for H=c-73-137-7-97.hsd1.ga.comcast.net (eltessal) [73.137.7.97]:32984: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2026-01-06 08:18:21 dovecot_plain authenticator failed for H=(heratrid) [23.30.11.253]:38754: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-01-06 08:22:32 dovecot_plain authenticator failed for H=host-196-47-172-253.afnet.net (ocyper) [196.47.172.253]:43493: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.62.238
country_id: 953987
description:
Jan  6 08:27:39 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<charanaw>, method=PLAIN, rip=102.129.62.238, lip=66.85.158.91, TLS, session=<C6B0Va9HwcZmgT7u>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 93.174.180.151
country_id: 3057568
description:
Jan  6 08:27:16 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=93.174.180.151, lip=66.85.158.91, TLS, session=<ql1NVK9H8JRdrrSX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.210
country_id: 1269750
description:
2026-01-06 08:31:07 dovecot_login authenticator failed for H=(nsg-corporate-49.218.186.122.airtel.in) [103.251.31.210]:60992: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
country_id: 99237
description:
2026-01-06 08:30:20 dovecot_login authenticator failed for H=([65.20.191.12]) [65.20.191.12]:40448: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.124.25
country_id: 3042225
description:
2026-01-06 08:30:35 dovecot_login authenticator failed for H=(ADMIN) [91.90.124.25]:45521: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.146
country_id: 1819730
description:
2026-01-06 08:30:45 dovecot_login authenticator failed for H=146.47.246.220.static.netvigator.com [220.246.47.146]:57691: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.5.135
country_id: 798544
description:
2026-01-06 08:30:50 dovecot_login authenticator failed for H=89-67-5-135.dynamic.play.pl [89.67.5.135]:60289: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.165.219
country_id: 1605651
description:
2026-01-06 08:31:04 dovecot_login authenticator failed for H=([106.0.165.219]) [106.0.165.219]:60310: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.205
country_id: 6252001
description:
Jan  6 08:32:37 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.205, lip=66.85.158.91, session=<VVZtaK9HuOHN0h/N>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.185
country_id: 6252001
description:
Jan  6 08:33:53 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.185, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<QaP2bK9HgN7N0h+5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 08:36:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<LzUdd69HxIAifrCV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.212.241.39
country_id: 1880251
description:
Jan  6 08:37:43 host2 sshd[1638067]: Disconnected from invalid user es 20.212.241.39 port 59308 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.126.105.42
country_id: 3469034
description:
2026-01-06 08:47:02 dovecot_login authenticator failed for H=187-126-105-42.user.vtal.net.br (187-126-105-145.user.vtal.net.br) [187.126.105.42]:48599: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2026-01-06 08:47:26 dovecot_login authenticator failed for H=([193.46.192.20]) [193.46.192.20]:41385: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  6 08:49:47 host2 sshd[1652717]: Disconnected from invalid user admin 2.57.121.112 port 20277 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.149.52.111
country_id: 6251999
description:
2026-01-06 08:51:37 dovecot_login authenticator failed for H=(ADMIN) [89.149.52.111]:56953: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 102.204.223.185
country_id: 2328926
description:
Jan  6 08:51:30 host2 pure-ftpd[1654994]: (?@102.204.223.185) [INFO] New connection from 102.204.223.185


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 08:52:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mail@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<tTw5sK9HRI6i8GQy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.212.241.39
country_id: 1880251
description:
Jan  6 08:53:00 host2 sshd[1656454]: Disconnected from invalid user claude 20.212.241.39 port 50704 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 08:52:32 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<iFWUr69HatUIhpC/>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 08:54:16 host2 sshd[1658251]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 08:54:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@lankaherbalsolutions.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<woC0ta9H1NwvWBNS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.21.104
country_id: 1269750
description:
2026-01-06 08:56:08 dovecot_login authenticator failed for H=(abts-north-static-104.21.176.122.airtelbroadband.in) [122.176.21.104]:35665: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.191.70.126
country_id: 6252001
description:
2026-01-06 08:56:56 dovecot_login authenticator failed for H=pool-71-191-70-126.washdc.fios.verizon.net [71.191.70.126]:56490: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 08:56:14 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<panel@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<OsTOvK9HYq4z0msW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.238.2.56
country_id: 3469034
description:
2026-01-06 08:56:30 dovecot_login authenticator failed for H=45-238-2-56.netmaisfibra.net.br [45.238.2.56]:46736: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 08:56:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postmaster@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<vlSQvq9HeLlA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 08:57:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<commercial@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<Dqe8wK9Hwumi8KbF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 08:58:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<tccPxa9H58l100Db>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.212.241.39
country_id: 1880251
description:
Jan  6 08:58:34 host2 sshd[1662829]: Disconnected from invalid user ubuntu 20.212.241.39 port 57598 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.24
country_id: 241170
description:
Jan  6 09:01:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.24, lip=66.85.158.91, session=<LEyez69HjrvE+2YY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2026-01-06 09:04:02 dovecot_plain authenticator failed for H=c-24-1-200-187.hsd1.il.comcast.net (chark) [24.1.200.187]:33478: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 09:07:19 host2 sshd[1671493]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 09:07:41 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<Tlu35a9H1KxCdMzo>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 09:09:12 host2 sshd[1673019]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 09:10:26 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postmaster@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<+huX769HcqlA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 09:11:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<invoice@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<L7lk8q9HquwIijoY>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.64.215.64
country_id: 298795
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 212.64.215.64 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 09:11:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<fSQW869HcOpm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 09:11:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<kywU869HbL0yBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 09:11:27 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<Q9Iv869HjJIifrCV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.233.17
country_id: 2993457
description:
2026-01-06 09:13:09 dovecot_login authenticator failed for H=(ADMIN) [95.181.233.17]:7683: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 09:12:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<invoice@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<PJ+H9q9HktUIijoY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.224.242.137
country_id: 2635167
description:
2026-01-06 09:13:41 dovecot_login authenticator failed for H=([109.224.242.137]) [109.224.242.137]:55022: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.102.149.135
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 191.102.149.135 - lezzarotech@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.179.59.108
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 186.179.59.108 - marketing@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2026-01-06 09:14:22 dovecot_login authenticator failed for H=(netcomafrica.com) [41.219.149.74]:65472: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.3
country_id: 1668284
description:
Jan  6 09:15:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.3, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<IdrhAbBHEcDG6xgD>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.49.50.6
country_id: 3686110
description:
Jan  6 09:18:19 host2 sshd[1681502]: Disconnected from invalid user bitrix 181.49.50.6 port 40728 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 09:18:59 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<k6cfDrBHgrRm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Jan  6 09:19:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notice@sivagnanamfoundation.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<20W8DrBH9oxetwuC>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.49.50.6
country_id: 3686110
description:
Jan  6 09:20:08 host2 sshd[1683077]: Disconnected from invalid user damian 181.49.50.6 port 52408 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.165.121.195
country_id: 1269750
description:
Jan  6 09:21:44 host2 sshd[1684587]: Disconnected from invalid user admin 122.165.121.195 port 37710 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 09:21:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@sobaherbal.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<yUW9FrBHqL8vWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 09:23:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<Pig8HbBHRM2i8GQy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.165.121.195
country_id: 1269750
description:
Jan  6 09:23:28 host2 sshd[1686226]: Disconnected from invalid user damian 122.165.121.195 port 45540 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.107.103
country_id: 1819730
description:
Jan  6 09:23:37 host2 sshd[1686351]: Disconnected from invalid user claude 101.36.107.103 port 51806 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 09:25:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<account@lankaherbalsolutions.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<KXMSJLBHfKsvWBNS>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.107.103
country_id: 1819730
description:
Jan  6 09:24:17 host2 sshd[1687030]: Disconnected from invalid user sergey 101.36.107.103 port 57816 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.165.121.195
country_id: 1269750
description:
Jan  6 09:24:18 host2 sshd[1687080]: Disconnected from invalid user claude 122.165.121.195 port 54592 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.174
country_id: 6252001
description:
Jan  6 09:24:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=205.210.31.174, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<EY+5IbBHtsPN0h+u>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.165.121.195
country_id: 1269750
description:
Jan  6 09:26:04 host2 sshd[1688729]: Disconnected from invalid user bitrix 122.165.121.195 port 55694 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 09:25:49 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<GLOQJrBHc6kz0msW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.165.121.195
country_id: 1269750
description:
Jan  6 09:26:55 host2 sshd[1689541]: Disconnected from invalid user admin 122.165.121.195 port 49264 [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 95.178.85.71
country_id: 102358
description:
Jan  6 09:27:03 host2 sshd[1689619]: Disconnecting authenticating user root 95.178.85.71 port 40984: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 95.178.85.71
country_id: 102358
description:
Jan  6 09:27:03 host2 sshd[1689619]: error: maximum authentication attempts exceeded for root from 95.178.85.71 port 40984 ssh2 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 09:26:47 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postmaster@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<QjETKrBH/IgIhpC/>


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 95.178.85.71
country_id: 102358
description:
Jan  6 09:27:13 host2 sshd[1689781]: error: maximum authentication attempts exceeded for root from 95.178.85.71 port 42184 ssh2 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2026-01-06 09:28:00 dovecot_plain authenticator failed for H=(doweged) [50.217.40.11]:40016: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 09:28:08 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<sZ/eLrBHFOui8KbF>


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 95.178.85.71
country_id: 102358
description:
Jan  6 09:27:13 host2 sshd[1689781]: Disconnecting authenticating user root 95.178.85.71 port 42184: Too many authentication failures [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.112.186.122
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 71.112.186.122 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.105.173
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 172.56.105.173 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 15.218.145.174
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 15.218.145.174 - tradece "GET /login/?login_only=1&user=tradece&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.218.190.116
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 47.218.190.116 - trade "GET /login/?login_only=1&user=trade&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trade (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.218.110.160
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 47.218.110.160 - tradeceyloncom "GET /login/?login_only=1&user=tradeceyloncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyloncom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.56.1.207
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 99.56.1.207 - tradeceylo "GET /login/?login_only=1&user=tradeceylo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceylo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.49.6.29
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 99.49.6.29 - tradeceyl "GET /login/?login_only=1&user=tradeceyl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 142.79.112.144
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 142.79.112.144 - tradec "GET /login/?login_only=1&user=tradec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.129.245.242
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 68.129.245.242 - tradece2 "GET /login/?login_only=1&user=tradece2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.138.100.159
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 69.138.100.159 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.217.47.250
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 107.217.47.250 - tradece1 "GET /login/?login_only=1&user=tradece1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.60.51.72
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 73.60.51.72 - tradeceylon "GET /login/?login_only=1&user=tradeceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.129.68
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 172.59.129.68 - tradecey "GET /login/?login_only=1&user=tradecey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradecey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.131.45.200
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 70.131.45.200 - trad "GET /login/?login_only=1&user=trad&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trad (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.23.23.146
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 184.23.23.146 - tr "GET /login/?login_only=1&user=tr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.161.249.112
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 107.161.249.112 - tra "GET /login/?login_only=1&user=tra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tra (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 09:30:34 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<account@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<s8iRN7BH6KJA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 09:31:27 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<Wh+4OrBHMPl100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.214.122.105
country_id: 357994
description:
2026-01-06 09:36:08 dovecot_login authenticator failed for H=(ADMIN) [188.214.122.105]:35038: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2026-01-06 09:38:28 dovecot_plain authenticator failed for H=c-174-169-224-27.hsd1.vt.comcast.net (meraters) [174.169.224.27]:42518: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 09:38:26 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<wrGwU7BHyrBCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 09:41:57 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<5FRHYLBHgNwyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 09:44:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<0pbiabBHluVm2gqW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.143
country_id: 6252001
description:
Jan  6 09:45:26 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.143, lip=66.85.158.91, TLS: Connection closed, session=<ypDdbLBHSLVChJmP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 09:46:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<cpanel@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<KBjBbrBHwo0IijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 09:45:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<account@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<aqudbLBH0KRA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 09:46:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<+N75b7BHdpEifrCV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 09:47:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<cpanel@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<bFMHc7BH8OQIijoY>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.122.139
country_id: 1819730
description:
Jan  6 09:48:39 host2 sshd[1709706]: Disconnected from invalid user vivek 101.36.122.139 port 39972 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Jan  6 09:51:02 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<cpanel@sivagnanamfoundation.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<NePAgLBHy49etwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 09:52:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=</4MjhbBHNO5m2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 09:52:36 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<account@sobaherbal.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<pg1lhrBH+o4vWBNS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.25.59.5
country_id: 3469034
description:
2026-01-06 09:53:56 dovecot_login authenticator failed for H=(ip-177-25-59-5.user.vivozap.com.br) [177.25.59.5]:59893: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 09:54:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<NIsqjLBHcp+i8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.224.242.137
country_id: 2635167
description:
2026-01-06 09:54:20 dovecot_login authenticator failed for H=([109.224.242.137]) [109.224.242.137]:37614: 535 Incorrect authentication data (set_id=washeera)


