# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2026-01-06 06:51:45 dovecot_login authenticator failed for H=([152.52.234.46]) [182.95.176.194]:42272: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 166.198.103.11
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 166.198.103.11 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.41.251.88
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 73.41.251.88 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.108.117.44
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 74.108.117.44 - tradeceylon "GET /login/?login_only=1&user=tradeceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.123.5.44
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 99.123.5.44 - tradeceylo "GET /login/?login_only=1&user=tradeceylo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceylo (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.175.193.205
country_id: 1269750
description:
Jan  6 06:52:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postmaster@sobaherbal.com>, method=PLAIN, rip=122.175.193.205, lip=66.85.158.91, session=<YbiDAK5H5uZ6r8HN>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.163.123.45
country_id: 1880251
description:
Jan  6 06:52:40 host2 sshd[1528884]: Disconnected from invalid user john 43.163.123.45 port 55826 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.241.61.64
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 108.241.61.64 - tradeceyloncom "GET /login/?login_only=1&user=tradeceyloncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyloncom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.149.79
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 172.58.149.79 - tradece2 "GET /login/?login_only=1&user=tradece2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece2 (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 06:52:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<VOmlAa5H+qIifrCV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  6 06:52:31 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: Connection closed, session=<FKd3Aq5HeLADhBfJ>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 122.175.193.205
country_id: 1269750
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[122.175.193.205] [Remote Port]=[59110] [Authentication Database]=[mail] [Username]=[postmaster@sobaherbal.com] (10/10 failures) (blocked until [Wed Jan  7 01:21:58 2026 UTC/Wed Jan  7 06:51:58 2026 LOCAL])


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.197.36.151
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 107.197.36.151 - tradecey "GET /login/?login_only=1&user=tradecey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradecey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.65.144.107
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 99.65.144.107 - tradece "GET /login/?login_only=1&user=tradece&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.10.0.164
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 68.10.0.164 - trade "GET /login/?login_only=1&user=trade&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trade (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 140.186.244.228
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 140.186.244.228 - tradece1 "GET /login/?login_only=1&user=tradece1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.105.245.48
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 143.105.245.48 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.150.97.94
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 69.150.97.94 - tradec "GET /login/?login_only=1&user=tradec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 147.136.9.237
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 147.136.9.237 - trad "GET /login/?login_only=1&user=trad&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trad (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 199.241.224.114
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 199.241.224.114 - tra "GET /login/?login_only=1&user=tra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tra (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.20.84.55
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 76.20.84.55 - tr "GET /login/?login_only=1&user=tr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tr (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.222
country_id: 1733045
description:
2026-01-06 06:52:12 dovecot_login authenticator failed for H=([49.124.152.222]) [49.124.152.222]:49240: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 06:52:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<client@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<5jUjAa5HlLei8KbF>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.228.114.202
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 68.228.114.202 - tradeceyl "GET /login/?login_only=1&user=tradeceyl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyl (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.49.246.176
country_id: 6252001
description:
Jan  6 06:54:12 host2 sshd[1530322]: Disconnected from invalid user celery 69.49.246.176 port 41242 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  6 06:54:13 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<yeCDCK5HougDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 06:54:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contacts@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<Zj4UCa5H7LMyBsPO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  6 06:55:20 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<hVuJDK5H3KQDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 06:55:37 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notice@sobaherbal.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<mTZoDa5H9uAvWBNS>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 69.49.246.176
country_id: 6252001
description:
Jan  6 06:55:48 host2 sshd[1532137]: Disconnected from invalid user claude 69.49.246.176 port 40308 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  6 06:55:56 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<6MqrDq5HdK8DhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.49.246.176
country_id: 6252001
description:
Jan  6 06:56:17 host2 sshd[1532565]: Disconnected from invalid user testuser 69.49.246.176 port 33384 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  6 06:56:51 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: Connection closed, session=<W+/6Ea5HEsgDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 06:58:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<1S8lFq5HbtVm2gqW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.28.242.198
country_id: 2361809
description:
Jan  6 06:58:12 host2 sshd[1534326]: Disconnected from invalid user luser 196.28.242.198 port 52604 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Jan  6 06:58:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<ni2XGK5HditetwuC>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.16
country_id: 2635167
description:
Jan  6 06:59:04 host2 dovecot[1170291]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.16, lip=66.85.158.92, TLS, session=<2xbgGa5HJ+e594kQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.80
country_id: 2635167
description:
Jan  6 06:59:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.80, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<pIfFGq5H+9O594lQ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.28.242.198
country_id: 2361809
description:
Jan  6 06:59:33 host2 sshd[1535502]: Disconnected from invalid user testuser 196.28.242.198 port 55182 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  6 06:58:54 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<EblRGa5HGOkDhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.28.242.198
country_id: 2361809
description:
Jan  6 07:00:11 host2 sshd[1536263]: Disconnected from invalid user webadm 196.28.242.198 port 44084 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.78
country_id: 2635167
description:
Jan  6 07:00:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.78, lip=66.85.158.92, TLS handshaking: Connection closed, session=<NQq8Hq5Hd+C594lO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.76
country_id: 2635167
description:
Jan  6 06:59:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.76, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<C8zAHK5HXbG594lM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.100
country_id: 2635167
description:
Jan  6 07:00:59 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=185.247.137.100, lip=66.85.158.92, TLS handshaking: Connection closed, session=<B223IK5Hc6K594lk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.89
country_id: 2635167
description:
Jan  6 07:01:32 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.89, lip=66.85.158.92, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<BNeyIq5Hv6FX7LBZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.100
country_id: 2635167
description:
Jan  6 07:02:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.100, lip=66.85.158.92, TLS handshaking: Connection closed, session=<+3qpJq5Hb5e594lk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.106
country_id: 2635167
description:
Jan  6 07:02:05 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.106, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<hy+sJK5H+55X7LBq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 07:02:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<h3HuJa5HqqV100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 07:02:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<commercial@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<PrsVJq5HKNQIijoY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.81
country_id: 2635167
description:
Jan  6 07:03:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=87.236.176.81, lip=66.85.158.92, TLS handshaking: Connection closed, session=<+tqkKK5HQ61X7LBR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  6 07:03:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@melanifinefood.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<Dwl3Kq5H7NEyBvlc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.91
country_id: 2635167
description:
Jan  6 07:03:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<yCyeKq5HLdpX7LBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.93
country_id: 2635167
description:
Jan  6 07:04:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.93, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<5ZWZLK5HJZJX7LBd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 07:06:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<L9hxM65HLJii8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 07:08:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notice@lankaherbalsolutions.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<miz9PK5HKoovWBNS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.133.47.11
country_id: 1522867
description:
2026-01-06 07:09:29 dovecot_login authenticator failed for H=(ADMIN) [62.133.47.11]:14428: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 07:10:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<L8zgQK5HSecz0msW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.184.83.17
country_id: 6252001
description:
2026-01-06 07:10:22 dovecot_login authenticator failed for H=h17.83.184.173.dynamic.ip.windstream.net [173.184.83.17]:54732: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.103.120.150
country_id: 1819730
description:
2026-01-06 07:10:43 dovecot_login authenticator failed for H=150.120.103.218.static.netvigator.com [218.103.120.150]:52636: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 07:12:37 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contacts@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<TCk1Sq5H6JVA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 07:14:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<l2fFT65HyOlm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 07:16:48 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sale@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<gTUuWa5H/p1CdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  6 07:17:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<cpanel@melanifinefood.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<BAgMW65H/LUyBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 07:18:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<panel@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<Z0wNXq5HJuUIhpC/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 07:19:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<43ldYq5H/KVA46ZK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.39.58.191
country_id: 2635167
description:
Jan  6 07:19:30 host2 sshd[1555464]: Disconnected from invalid user logger 34.39.58.191 port 33962 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.39.58.191
country_id: 2635167
description:
Jan  6 07:20:02 host2 sshd[1555854]: Disconnected from invalid user csczserver 34.39.58.191 port 32908 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.39.58.191
country_id: 2635167
description:
Jan  6 07:21:04 host2 sshd[1556934]: Disconnected from invalid user m1 34.39.58.191 port 41638 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.190.155.43
country_id: 6252001
description:
2026-01-06 07:21:35 dovecot_plain authenticator failed for H=(hienests) [76.190.155.43]:35085: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 07:22:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<nEjxbK5HsI4IijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 07:22:53 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<q+z1bq5HdpKi8KbF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 07:24:42 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<dg1xda5HzL0yBsPO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.250.81.123
country_id: 1733045
description:
Jan  6 07:24:22 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=783) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=47.250.81.123, lip=66.85.158.91, TLS handshaking: read(size=783) failed: Connection reset by peer, session=<DyBjdK5HOKAv+lF7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.175.193.205
country_id: 1269750
description:
Jan  6 07:24:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shop@lankaherbalsolutions.com>, method=PLAIN, rip=122.175.193.205, lip=66.85.158.91, session=<+sm4dK5HruF6r8HN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.250.81.123
country_id: 1733045
description:
Jan  6 07:24:53 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=47.250.81.123, lip=66.85.158.91, TLS, session=<h00wdq5HPKAv+lF7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 07:26:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mail@sobaherbal.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<zlLxe65HvK8vWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 07:26:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<0QAsfa5H5LYifrCV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-06 07:34:35 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:49591: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.232.44
country_id: 2542007
description:
2026-01-06 07:35:47 dovecot_login authenticator failed for H=(ADMIN) [95.181.232.44]:17988: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.248.129.252
country_id: 2921044
description:
Jan  6 07:43:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=104.248.129.252, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<DWmiua5H05Bo+IH8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2026-01-06 07:43:13 dovecot_login authenticator failed for H=([196.191.212.236]) [213.55.85.202]:4086: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.217.204.91
country_id: 2658434
description:
2026-01-06 07:43:26 dovecot_login authenticator failed for H=adsl-89-217-204-91.adslplus.ch [89.217.204.91]:33370: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.123
country_id: 6252001
description:
Jan  6 07:43:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 16 secs): user=<>, rip=66.132.153.123, lip=66.85.158.91, TLS handshaking: Connection closed, session=<7Zuoua5HDghChJl7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.122.80
country_id: 2921044
description:
Jan  6 07:44:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=46.101.122.80, lip=66.85.158.91, TLS handshaking: Connection closed, session=<oJC8u65HdMcuZXpQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.248.129.252
country_id: 2921044
description:
Jan  6 07:43:56 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=104.248.129.252, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<Nhleuq5HuTNo+IH8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.143
country_id: 6252001
description:
Jan  6 07:45:21 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.143, lip=66.85.158.91, TLS: Connection closed, session=<IGZpv65HBjJChJmP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 161.35.79.234
country_id: 2921044
description:
Jan  6 07:44:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=161.35.79.234, lip=66.85.158.91, TLS handshaking: Connection closed, session=<3DHNva5HbrWhI0/q>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 212.154.234.9
country_id: 1522867
description:
Jan  6 07:46:46 host2 sshd[1581515]: Disconnected from invalid user nc 212.154.234.9 port 58881 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.154.234.9
country_id: 1522867
description:
Jan  6 07:47:33 host2 sshd[1582183]: Disconnected from invalid user bodega 212.154.234.9 port 11399 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.154.234.9
country_id: 1522867
description:
Jan  6 07:48:07 host2 sshd[1582682]: Disconnected from invalid user minecraft 212.154.234.9 port 41920 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.106.76
country_id: 3469034
description:
Jan  6 07:49:36 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=187.120.106.76, lip=66.85.158.91, TLS, session=<eG51za5HV4G7eGpM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.87.201.135
country_id: 3469034
description:
Jan  6 07:49:57 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=177.87.201.135, lip=66.85.158.91, TLS, session=<Cai4zq5H8tGxV8mH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.47.53.19
country_id: 798549
description:
Jan  6 07:53:39 host2 sshd[1588195]: Disconnected from invalid user admin 89.47.53.19 port 32794 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.121.61.198
country_id: 3017382
description:
2026-01-06 07:55:07 dovecot_login authenticator failed for H=ip198.ip-91-121-61.eu (ADMIN) [91.121.61.198]:57084: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.47.53.19
country_id: 798549
description:
Jan  6 07:55:18 host2 sshd[1590429]: Disconnected from invalid user admin 89.47.53.19 port 40382 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.156.128.122
country_id: 2264397
description:
Jan  6 07:56:35 host2 pure-ftpd[1591787]: (?@45.156.128.122) [INFO] New connection from 45.156.128.122


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 89.47.53.19
country_id: 798549
description:
Jan  6 07:56:48 host2 sshd[1592006]: Disconnected from invalid user claude 89.47.53.19 port 47382 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.47.53.19
country_id: 798549
description:
Jan  6 07:57:19 host2 sshd[1592496]: Disconnected from invalid user claude 89.47.53.19 port 59122 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.154.77.48
country_id: 1643084
description:
Jan  6 07:57:42 host2 sshd[1592882]: Disconnected from invalid user claude 103.154.77.48 port 48830 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.89.28.139
country_id: 1643084
description:
Jan  6 07:58:49 host2 sshd[1593869]: Disconnected from invalid user ghost 36.89.28.139 port 42994 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.89.28.139
country_id: 1643084
description:
Jan  6 07:59:26 host2 sshd[1594426]: Disconnected from invalid user sun 36.89.28.139 port 39444 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.154.77.48
country_id: 1643084
description:
Jan  6 07:59:46 host2 sshd[1594677]: Disconnected from invalid user admin 103.154.77.48 port 55714 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.154.77.48
country_id: 1643084
description:
Jan  6 08:00:54 host2 sshd[1595925]: Disconnected from invalid user claude 103.154.77.48 port 49576 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.97.24.41
country_id: 732800
description:
Jan  6 08:01:44 host2 sshd[1596699]: Disconnected from invalid user xuhao 83.97.24.41 port 60332 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 08:01:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<btX8+a5HMtgifrCV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.218.149
country_id: 1880251
description:
Jan  6 08:02:03 host2 sshd[1597177]: Disconnected from invalid user admin 152.32.218.149 port 40174 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 83.97.24.41
country_id: 732800
description:
Jan  6 08:02:14 host2 sshd[1597331]: Disconnected from invalid user tung 83.97.24.41 port 44104 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.64.27.145
country_id: 3932488
description:
Jan  6 08:02:42 host2 sshd[1597765]: Disconnected from invalid user tung 181.64.27.145 port 52936 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.89.28.139
country_id: 1643084
description:
Jan  6 08:01:59 host2 sshd[1597080]: Disconnected from invalid user claude 36.89.28.139 port 49468 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.164.107.6
country_id: 6252001
description:
Jan  6 08:03:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=194.164.107.6, lip=66.85.158.92, session=<I85T/65HEKPCpGsG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.89.28.139
country_id: 1643084
description:
Jan  6 08:03:17 host2 sshd[1598441]: Disconnected from invalid user testuser 36.89.28.139 port 55588 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.64.27.145
country_id: 3932488
description:
Jan  6 08:03:21 host2 sshd[1598569]: Disconnected from invalid user terry 181.64.27.145 port 43070 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.218.149
country_id: 1880251
description:
Jan  6 08:04:00 host2 sshd[1599154]: Disconnected from invalid user claude 152.32.218.149 port 35468 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.64.27.145
country_id: 3932488
description:
Jan  6 08:05:26 host2 sshd[1600838]: Disconnected from invalid user adminuser 181.64.27.145 port 36612 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.64.27.145
country_id: 3932488
description:
Jan  6 08:06:06 host2 sshd[1601402]: Disconnected from invalid user claude 181.64.27.145 port 52370 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.203.22
country_id: 1880251
description:
Jan  6 08:06:12 host2 sshd[1601490]: Disconnected from invalid user test 45.78.203.22 port 43018 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.64.27.145
country_id: 3932488
description:
Jan  6 08:06:46 host2 sshd[1601935]: Disconnected from invalid user ashok 181.64.27.145 port 56512 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 166.170.48.43
country_id: 6252001
description:
Jan  6 08:07:03 host2 sshd[1602204]: Disconnected from invalid user proxyuser 166.170.48.43 port 63401 [preauth]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 195.178.110.132
country_id: 732800
description:
Denial of Service (DoS) attack was discovered from 195.178.110.132: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 166.170.48.43
country_id: 6252001
description:
Jan  6 08:07:47 host2 sshd[1602839]: Disconnected from invalid user dk 166.170.48.43 port 2174 [preauth]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 195.178.110.132
country_id: 732800
description:
Denial of Service (DoS) attack was discovered from 195.178.110.132: 445 connections per 30 seconds to 443 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.188.130
country_id: 3144096
description:
2026-01-06 08:08:33 dovecot_login authenticator failed for H=(cm-84.213.188.130.get.no) [84.213.188.130]:50226: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.50.154
country_id: 1269750
description:
2026-01-06 08:08:45 dovecot_login authenticator failed for H=([125.19.93.105]) [182.95.50.154]:45708: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 166.170.48.43
country_id: 6252001
description:
Jan  6 08:08:59 host2 sshd[1604324]: Disconnected from invalid user alice 166.170.48.43 port 24219 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.142
country_id: 1269750
description:
2026-01-06 08:09:04 dovecot_login authenticator failed for H=([128.185.227.142]) [128.185.227.142]:39444: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.84
country_id: 1210997
description:
2026-01-06 08:09:15 dovecot_login authenticator failed for H=([103.115.252.60]) [103.115.252.84]:44304: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.142
country_id: 1269750
description:
2026-01-06 08:09:50 dovecot_login authenticator failed for H=([182.79.202.89]) [182.95.230.142]:37414: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.203.22
country_id: 1880251
description:
Jan  6 08:10:25 host2 sshd[1605774]: Disconnected from invalid user bitrix 45.78.203.22 port 51104 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.32.122.72
country_id: 597427
description:
2026-01-06 08:13:15 dovecot_login authenticator failed for H=(ADMIN) [194.32.122.72]:1325: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2026-01-06 08:17:36 dovecot_plain authenticator failed for H=(genear) [65.20.205.197]:52239: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2026-01-06 08:18:23 dovecot_plain authenticator failed for H=c-73-137-7-97.hsd1.ga.comcast.net (eltessal) [73.137.7.97]:32984: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2026-01-06 08:18:21 dovecot_plain authenticator failed for H=(heratrid) [23.30.11.253]:38754: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-01-06 08:22:32 dovecot_plain authenticator failed for H=host-196-47-172-253.afnet.net (ocyper) [196.47.172.253]:43493: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.62.238
country_id: 953987
description:
Jan  6 08:27:39 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<charanaw>, method=PLAIN, rip=102.129.62.238, lip=66.85.158.91, TLS, session=<C6B0Va9HwcZmgT7u>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 93.174.180.151
country_id: 3057568
description:
Jan  6 08:27:16 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=93.174.180.151, lip=66.85.158.91, TLS, session=<ql1NVK9H8JRdrrSX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.210
country_id: 1269750
description:
2026-01-06 08:31:07 dovecot_login authenticator failed for H=(nsg-corporate-49.218.186.122.airtel.in) [103.251.31.210]:60992: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
country_id: 99237
description:
2026-01-06 08:30:20 dovecot_login authenticator failed for H=([65.20.191.12]) [65.20.191.12]:40448: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.124.25
country_id: 3042225
description:
2026-01-06 08:30:35 dovecot_login authenticator failed for H=(ADMIN) [91.90.124.25]:45521: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.146
country_id: 1819730
description:
2026-01-06 08:30:45 dovecot_login authenticator failed for H=146.47.246.220.static.netvigator.com [220.246.47.146]:57691: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.5.135
country_id: 798544
description:
2026-01-06 08:30:50 dovecot_login authenticator failed for H=89-67-5-135.dynamic.play.pl [89.67.5.135]:60289: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.165.219
country_id: 1605651
description:
2026-01-06 08:31:04 dovecot_login authenticator failed for H=([106.0.165.219]) [106.0.165.219]:60310: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.205
country_id: 6252001
description:
Jan  6 08:32:37 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.205, lip=66.85.158.91, session=<VVZtaK9HuOHN0h/N>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.185
country_id: 6252001
description:
Jan  6 08:33:53 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.185, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<QaP2bK9HgN7N0h+5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 08:36:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<LzUdd69HxIAifrCV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.212.241.39
country_id: 1880251
description:
Jan  6 08:37:43 host2 sshd[1638067]: Disconnected from invalid user es 20.212.241.39 port 59308 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.126.105.42
country_id: 3469034
description:
2026-01-06 08:47:02 dovecot_login authenticator failed for H=187-126-105-42.user.vtal.net.br (187-126-105-145.user.vtal.net.br) [187.126.105.42]:48599: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2026-01-06 08:47:26 dovecot_login authenticator failed for H=([193.46.192.20]) [193.46.192.20]:41385: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  6 08:49:47 host2 sshd[1652717]: Disconnected from invalid user admin 2.57.121.112 port 20277 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.149.52.111
country_id: 6251999
description:
2026-01-06 08:51:37 dovecot_login authenticator failed for H=(ADMIN) [89.149.52.111]:56953: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 102.204.223.185
country_id: 2328926
description:
Jan  6 08:51:30 host2 pure-ftpd[1654994]: (?@102.204.223.185) [INFO] New connection from 102.204.223.185


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 08:52:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mail@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<tTw5sK9HRI6i8GQy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.212.241.39
country_id: 1880251
description:
Jan  6 08:53:00 host2 sshd[1656454]: Disconnected from invalid user claude 20.212.241.39 port 50704 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 08:52:32 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<iFWUr69HatUIhpC/>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 08:54:16 host2 sshd[1658251]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 08:54:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@lankaherbalsolutions.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<woC0ta9H1NwvWBNS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.21.104
country_id: 1269750
description:
2026-01-06 08:56:08 dovecot_login authenticator failed for H=(abts-north-static-104.21.176.122.airtelbroadband.in) [122.176.21.104]:35665: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.191.70.126
country_id: 6252001
description:
2026-01-06 08:56:56 dovecot_login authenticator failed for H=pool-71-191-70-126.washdc.fios.verizon.net [71.191.70.126]:56490: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 08:56:14 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<panel@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<OsTOvK9HYq4z0msW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.238.2.56
country_id: 3469034
description:
2026-01-06 08:56:30 dovecot_login authenticator failed for H=45-238-2-56.netmaisfibra.net.br [45.238.2.56]:46736: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 08:56:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postmaster@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<vlSQvq9HeLlA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 08:57:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<commercial@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<Dqe8wK9Hwumi8KbF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 08:58:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<tccPxa9H58l100Db>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.212.241.39
country_id: 1880251
description:
Jan  6 08:58:34 host2 sshd[1662829]: Disconnected from invalid user ubuntu 20.212.241.39 port 57598 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.24
country_id: 241170
description:
Jan  6 09:01:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.24, lip=66.85.158.91, session=<LEyez69HjrvE+2YY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2026-01-06 09:04:02 dovecot_plain authenticator failed for H=c-24-1-200-187.hsd1.il.comcast.net (chark) [24.1.200.187]:33478: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 09:07:19 host2 sshd[1671493]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 09:07:41 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<Tlu35a9H1KxCdMzo>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 09:09:12 host2 sshd[1673019]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 09:10:26 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postmaster@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<+huX769HcqlA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 09:11:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<invoice@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<L7lk8q9HquwIijoY>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.64.215.64
country_id: 298795
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 212.64.215.64 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 09:11:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<fSQW869HcOpm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 09:11:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<kywU869HbL0yBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 09:11:27 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<Q9Iv869HjJIifrCV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.233.17
country_id: 2993457
description:
2026-01-06 09:13:09 dovecot_login authenticator failed for H=(ADMIN) [95.181.233.17]:7683: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 09:12:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<invoice@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<PJ+H9q9HktUIijoY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.224.242.137
country_id: 2635167
description:
2026-01-06 09:13:41 dovecot_login authenticator failed for H=([109.224.242.137]) [109.224.242.137]:55022: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.102.149.135
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 191.102.149.135 - lezzarotech@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.179.59.108
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 186.179.59.108 - marketing@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2026-01-06 09:14:22 dovecot_login authenticator failed for H=(netcomafrica.com) [41.219.149.74]:65472: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.3
country_id: 1668284
description:
Jan  6 09:15:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.3, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<IdrhAbBHEcDG6xgD>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.49.50.6
country_id: 3686110
description:
Jan  6 09:18:19 host2 sshd[1681502]: Disconnected from invalid user bitrix 181.49.50.6 port 40728 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 09:18:59 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<k6cfDrBHgrRm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Jan  6 09:19:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notice@sivagnanamfoundation.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<20W8DrBH9oxetwuC>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.49.50.6
country_id: 3686110
description:
Jan  6 09:20:08 host2 sshd[1683077]: Disconnected from invalid user damian 181.49.50.6 port 52408 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.165.121.195
country_id: 1269750
description:
Jan  6 09:21:44 host2 sshd[1684587]: Disconnected from invalid user admin 122.165.121.195 port 37710 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 09:21:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@sobaherbal.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<yUW9FrBHqL8vWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 09:23:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<Pig8HbBHRM2i8GQy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.165.121.195
country_id: 1269750
description:
Jan  6 09:23:28 host2 sshd[1686226]: Disconnected from invalid user damian 122.165.121.195 port 45540 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.107.103
country_id: 1819730
description:
Jan  6 09:23:37 host2 sshd[1686351]: Disconnected from invalid user claude 101.36.107.103 port 51806 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 09:25:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<account@lankaherbalsolutions.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<KXMSJLBHfKsvWBNS>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.107.103
country_id: 1819730
description:
Jan  6 09:24:17 host2 sshd[1687030]: Disconnected from invalid user sergey 101.36.107.103 port 57816 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.165.121.195
country_id: 1269750
description:
Jan  6 09:24:18 host2 sshd[1687080]: Disconnected from invalid user claude 122.165.121.195 port 54592 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.174
country_id: 6252001
description:
Jan  6 09:24:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=205.210.31.174, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<EY+5IbBHtsPN0h+u>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.165.121.195
country_id: 1269750
description:
Jan  6 09:26:04 host2 sshd[1688729]: Disconnected from invalid user bitrix 122.165.121.195 port 55694 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 09:25:49 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<GLOQJrBHc6kz0msW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.165.121.195
country_id: 1269750
description:
Jan  6 09:26:55 host2 sshd[1689541]: Disconnected from invalid user admin 122.165.121.195 port 49264 [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 95.178.85.71
country_id: 102358
description:
Jan  6 09:27:03 host2 sshd[1689619]: Disconnecting authenticating user root 95.178.85.71 port 40984: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 95.178.85.71
country_id: 102358
description:
Jan  6 09:27:03 host2 sshd[1689619]: error: maximum authentication attempts exceeded for root from 95.178.85.71 port 40984 ssh2 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 09:26:47 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postmaster@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<QjETKrBH/IgIhpC/>


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 95.178.85.71
country_id: 102358
description:
Jan  6 09:27:13 host2 sshd[1689781]: error: maximum authentication attempts exceeded for root from 95.178.85.71 port 42184 ssh2 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2026-01-06 09:28:00 dovecot_plain authenticator failed for H=(doweged) [50.217.40.11]:40016: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 09:28:08 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<sZ/eLrBHFOui8KbF>


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 95.178.85.71
country_id: 102358
description:
Jan  6 09:27:13 host2 sshd[1689781]: Disconnecting authenticating user root 95.178.85.71 port 42184: Too many authentication failures [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.112.186.122
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 71.112.186.122 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.105.173
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 172.56.105.173 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 15.218.145.174
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 15.218.145.174 - tradece "GET /login/?login_only=1&user=tradece&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.218.190.116
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 47.218.190.116 - trade "GET /login/?login_only=1&user=trade&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trade (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.218.110.160
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 47.218.110.160 - tradeceyloncom "GET /login/?login_only=1&user=tradeceyloncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyloncom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.56.1.207
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 99.56.1.207 - tradeceylo "GET /login/?login_only=1&user=tradeceylo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceylo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.49.6.29
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 99.49.6.29 - tradeceyl "GET /login/?login_only=1&user=tradeceyl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 142.79.112.144
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 142.79.112.144 - tradec "GET /login/?login_only=1&user=tradec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.129.245.242
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 68.129.245.242 - tradece2 "GET /login/?login_only=1&user=tradece2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.138.100.159
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 69.138.100.159 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.217.47.250
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 107.217.47.250 - tradece1 "GET /login/?login_only=1&user=tradece1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.60.51.72
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 73.60.51.72 - tradeceylon "GET /login/?login_only=1&user=tradeceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.129.68
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 172.59.129.68 - tradecey "GET /login/?login_only=1&user=tradecey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradecey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.131.45.200
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 70.131.45.200 - trad "GET /login/?login_only=1&user=trad&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trad (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.23.23.146
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 184.23.23.146 - tr "GET /login/?login_only=1&user=tr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.161.249.112
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 107.161.249.112 - tra "GET /login/?login_only=1&user=tra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tra (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 09:30:34 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<account@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<s8iRN7BH6KJA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 09:31:27 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<Wh+4OrBHMPl100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.214.122.105
country_id: 357994
description:
2026-01-06 09:36:08 dovecot_login authenticator failed for H=(ADMIN) [188.214.122.105]:35038: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2026-01-06 09:38:28 dovecot_plain authenticator failed for H=c-174-169-224-27.hsd1.vt.comcast.net (meraters) [174.169.224.27]:42518: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 09:38:26 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<wrGwU7BHyrBCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 09:41:57 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<5FRHYLBHgNwyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 09:44:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<0pbiabBHluVm2gqW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.143
country_id: 6252001
description:
Jan  6 09:45:26 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.143, lip=66.85.158.91, TLS: Connection closed, session=<ypDdbLBHSLVChJmP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 09:46:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<cpanel@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<KBjBbrBHwo0IijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 09:45:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<account@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<aqudbLBH0KRA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 09:46:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<+N75b7BHdpEifrCV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 09:47:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<cpanel@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<bFMHc7BH8OQIijoY>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.122.139
country_id: 1819730
description:
Jan  6 09:48:39 host2 sshd[1709706]: Disconnected from invalid user vivek 101.36.122.139 port 39972 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Jan  6 09:51:02 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<cpanel@sivagnanamfoundation.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<NePAgLBHy49etwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 09:52:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=</4MjhbBHNO5m2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 09:52:36 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<account@sobaherbal.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<pg1lhrBH+o4vWBNS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.25.59.5
country_id: 3469034
description:
2026-01-06 09:53:56 dovecot_login authenticator failed for H=(ip-177-25-59-5.user.vivozap.com.br) [177.25.59.5]:59893: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 09:54:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<NIsqjLBHcp+i8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.224.242.137
country_id: 2635167
description:
2026-01-06 09:54:20 dovecot_login authenticator failed for H=([109.224.242.137]) [109.224.242.137]:37614: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 09:55:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<tpv1kbBH66Yz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 09:56:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@lankaherbalsolutions.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<2k/0k7BHKukvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 09:59:14 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<invoice@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<SQkXnrBHeNmi8KbF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  6 10:01:06 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<lJnkpLBHwNcDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.126
country_id: 6252001
description:
Jan  6 10:02:06 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.126, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<WnJ2qLBHgNTG6xh+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.10
country_id: 6252001
description:
Jan  6 10:01:20 host2 pure-ftpd[1720671]: (?@147.185.132.10) [INFO] New connection from 147.185.132.10


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 10:01:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<PZ1jprBHkpkIhpC/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  6 10:01:53 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<p9usp7BHhMMDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  6 10:02:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<EXndqLBH1M8DgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 10:03:41 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<aRT+rbBHzoZA46ZK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.57.148
country_id: 2921044
description:
2026-01-06 10:03:19 dovecot_login authenticator failed for H=(ADMIN) [212.102.57.148]:54968: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.106.136
country_id: 3865483
description:
Jan  6 10:04:50 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw>, method=PLAIN, rip=45.238.106.136, lip=66.85.158.91, TLS, session=<I5EnsbBHZ6Qt7mqI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.122.162
country_id: 226074
description:
Jan  6 10:04:30 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=196.0.122.162, lip=66.85.158.91, TLS, session=<tTHYr7BH88nEAHqi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 10:04:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postmaster@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<FEFnsbBH6Td100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2026-01-06 10:04:51 dovecot_plain authenticator failed for H=(stiones) [91.73.188.251]:33059: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  6 10:05:36 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<6o37tLBHSq0DgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  6 10:06:32 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS, session=<ZE5UuLBHwpADgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.107.155.206
country_id: 798544
description:
Jan  6 10:07:26 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=89.107.155.206, lip=66.85.158.91, TLS, session=<6SSQurBH8axZa5vO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.154.227.101
country_id: 3469034
description:
Jan  6 10:07:49 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<charanaw>, method=PLAIN, rip=177.154.227.101, lip=66.85.158.91, TLS, session=<yYOqu7BHKoaxmuNl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  6 10:08:48 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: Connection closed, session=<QsFrwLBHyMwDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 10:09:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<cpanel@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<8zAlwrBHgJJCdMzo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  6 10:10:59 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<sBw8yLBHKKoDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.179.18
country_id: 2921044
description:
Jan  6 10:11:35 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=164.92.179.18, lip=66.85.158.91, session=<+RppyrBH9U2kXLMS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.111.59
country_id: 2921044
description:
Jan  6 10:11:36 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=157.230.111.59, lip=66.85.158.91, session=<FPVwyrBHoIad5m87>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  6 10:11:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS, session=<kPAPy7BHiNMDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.135
country_id: 6252001
description:
Jan  6 10:14:40 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.135, lip=66.85.158.91, session=<9rpr1bBHzdnDuEyH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.130
country_id: 6252001
description:
Jan  6 10:14:50 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=195.184.76.130, lip=66.85.158.91, session=<zb0G1rBH65HDuEyC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.131
country_id: 6252001
description:
Jan  6 10:15:02 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=195.184.76.131, lip=66.85.158.91, session=<lIO81rBHudTDuEyD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.213
country_id: 6252001
description:
Jan  6 10:15:42 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.213, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<AGYZ2bBHwcvN0h/V>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-01-06 10:16:10 dovecot_plain authenticator failed for H=(matitarize) [24.187.213.29]:50640: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 10:17:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<O5Zl37BHjrJA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 10:17:56 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<Iznm4LBHestm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 10:21:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<dSYG7bBHFp0IijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 10:21:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<uiYG7bBHUu0ifrCV>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 10:23:04 host2 sshd[1740393]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Jan  6 10:23:01 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notice@sivagnanamfoundation.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<PZQj87BHN7RetwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 10:22:29 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<Nzs68bBH+oUIijoY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.81.142.53
country_id: 3996063
description:
2026-01-06 10:23:15 dovecot_login authenticator failed for H=(ADMIN) [77.81.142.53]:42916: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 10:24:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@sobaherbal.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<O31m97BHPs0vWBNS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.217
country_id: 6252001
description:
Jan  6 10:24:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 17 secs): user=<>, rip=147.185.133.217, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<Fz9o+bBHE8CTuYXZ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 10:25:49 host2 sshd[1742774]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 10:25:14 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mail@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<BKkT+7BHfOKi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 10:25:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<iRYD/LBHTpRm2gqW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.217
country_id: 6252001
description:
Jan  6 10:25:47 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=147.185.133.217, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<NcQq/bBHavaTuYXZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 10:26:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<yyLP/bBHEqUz0msW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.217
country_id: 6252001
description:
Jan  6 10:26:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=147.185.133.217, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<oGCR/rBHTuKTuYXZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.12
country_id: 6252001
description:
Jan  6 10:26:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=162.216.149.12, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<CRjX/rBHTsei2JUM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.12
country_id: 6252001
description:
Jan  6 10:27:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 12 secs): user=<>, rip=162.216.149.12, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<fAYdArFHqOGi2JUM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 10:28:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<6KL4BLFHILkvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 10:30:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<Ct4KDbFHINWi8KbF>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.94.210.79
country_id: 2750405
description:
Jan  6 10:31:09 host2 pure-ftpd[1747696]: (?@158.94.210.79) [INFO] New connection from 158.94.210.79


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 10:33:09 host2 sshd[1749072]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.209.245.114
country_id: 2921044
description:
Jan  6 10:34:04 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=134.209.245.114, lip=66.85.158.91, TLS, session=<GD7LGrFHhJyG0fVy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.12
country_id: 6252001
description:
Jan  6 10:34:04 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.12, lip=66.85.158.91, TLS, session=<b3fHGrFHRP6i2JUM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.217
country_id: 6252001
description:
Jan  6 10:33:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.217, lip=66.85.158.92, TLS, session=<4WLjF7FHVuWTuYXZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.217
country_id: 6252001
description:
Jan  6 10:34:21 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.133.217, lip=66.85.158.92, TLS, session=<Ao/GG7FHxPWTuYXZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.195.138.52
country_id: 6252001
description:
2026-01-06 10:34:31 dovecot_plain authenticator failed for H=c-98-195-138-52.hsd1.tx.comcast.net (riginia) [98.195.138.52]:53066: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.209.245.114
country_id: 2921044
description:
Jan  6 10:34:15 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=134.209.245.114, lip=66.85.158.91, session=<jF13G7FHQl+G0fVy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 10:35:42 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<UIqAILFHzs9A46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 10:36:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postmaster@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<bSpNJLFHgqgIhpC/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 10:37:47 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<account@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<jdz2J7FHRZ5100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 10:40:06 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<g6E+MLFH+t5CdMzo>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.253.162.162
country_id: 146669
description:
Jan  6 10:41:04 host2 pure-ftpd[1756290]: (?@185.253.162.162) [INFO] New connection from 185.253.162.162


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.134.212.206
country_id: 798544
description:
Jan  6 10:41:05 host2 pure-ftpd[1756295]: (?@45.134.212.206) [INFO] New connection from 45.134.212.206


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 10:41:53 host2 sshd[1757008]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.34.242.231
country_id: 2963597
description:
Jan  6 10:41:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=149.34.242.231, lip=66.85.158.91, TLS handshaking: Connection closed, session=<pvsBNLFHEoOVIvLn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.232.51
country_id: 2542007
description:
2026-01-06 10:41:21 dovecot_login authenticator failed for H=(ADMIN) [95.181.232.51]:6591: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 154.47.16.230
country_id: 3686110
description:
Jan  6 10:41:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=154.47.16.230, lip=66.85.158.91, TLS, session=<gQQDNLFHesCaLxDm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.64.98.5
country_id: 1655842
description:
Jan  6 10:41:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=64.64.98.5, lip=66.85.158.91, TLS, session=<ZcfuNLFHjrJAQGIF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.154.155.6
country_id: 3932488
description:
Jan  6 10:41:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=45.154.155.6, lip=66.85.158.91, TLS handshaking: Connection closed, session=<VK3tNLFHgrItmpsG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.231.243.28
country_id: 6252001
description:
2026-01-06 10:41:54 dovecot_plain authenticator failed for H=(preuddylas) [50.231.243.28]:40846: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2026-01-06 10:42:41 dovecot_plain authenticator failed for H=(amatably) [65.20.233.110]:38931: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 10:43:36 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<Lj3HPLFHaOoyBsPO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.14
country_id: 1814991
description:
Jan  6 10:43:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=94.231.206.14, lip=66.85.158.91, session=<3z35PLFHPcxe584O>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.4
country_id: 1814991
description:
Jan  6 10:43:48 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=94.231.206.4, lip=66.85.158.91, session=<ZgeZPbFHT+Be584E>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.4
country_id: 1814991
description:
Jan  6 10:44:08 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=94.231.206.4, lip=66.85.158.91, session=<plfIPrFHKexe584E>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.7
country_id: 1814991
description:
Jan  6 10:44:04 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=94.231.206.7, lip=66.85.158.91, session=<aAOQPrFHRb9e584H>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.212.198
country_id: 732800
description:
Jan  6 10:46:52 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=185.255.212.198, lip=66.85.158.91, TLS, session=<4ZWLR7FHnq+5/9TG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.222.8.179
country_id: 3077311
description:
Jan  6 10:47:10 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=31.222.8.179, lip=66.85.158.91, TLS, session=<vPGnSLFHBbcf3giz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-06 10:48:31 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:65326: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 10:49:32 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<Ja//UbFHfIVA46ZK>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.169.66.57
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 209.169.66.57 - tradecey "GET /login/?login_only=1&user=tradecey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradecey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.93.200.199
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 73.93.200.199 - tradece "GET /login/?login_only=1&user=tradece&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.38.184.120
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 99.38.184.120 - trad "GET /login/?login_only=1&user=trad&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trad (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.132.118.224
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 68.132.118.224 - tradece1 "GET /login/?login_only=1&user=tradece1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.85.250
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 172.56.85.250 - tradece2 "GET /login/?login_only=1&user=tradece2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.105.111.208
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 143.105.111.208 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.166.247
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 172.58.166.247 - tradeceylo "GET /login/?login_only=1&user=tradeceylo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceylo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 142.79.83.133
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 142.79.83.133 - tradec "GET /login/?login_only=1&user=tradec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.230.233.173
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 68.230.233.173 - tr "GET /login/?login_only=1&user=tr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.5.232.224
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 68.5.232.224 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.187.58.146
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 71.187.58.146 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.238.19.162
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 96.238.19.162 - tradeceylon "GET /login/?login_only=1&user=tradeceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 206.85.120.81
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 206.85.120.81 - tradeceyloncom "GET /login/?login_only=1&user=tradeceyloncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyloncom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.43.84.240
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 99.43.84.240 - tradeceyl "GET /login/?login_only=1&user=tradeceyl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.113.242.141
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 98.113.242.141 - trade "GET /login/?login_only=1&user=trade&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trade (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.110.3.89
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 46.110.3.89 - tra "GET /login/?login_only=1&user=tra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tra (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 10:51:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<panel@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<GK0eWLFHJulm2gqW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.194
country_id: 6252001
description:
Jan  6 10:51:17 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.247.194, lip=66.85.158.91, TLS handshaking: Connection closed, session=<o4FfWLFHKt+4affC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.11.181.236
country_id: 6252001
description:
Jan  6 10:51:58 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 3 secs): user=<>, rip=198.11.181.236, lip=66.85.158.92, session=<WNDOWrFH8JrGC7Xs>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 10:54:50 host2 sshd[1769768]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.129.57.71
country_id: 6252001
description:
2026-01-06 10:55:14 dovecot_plain authenticator failed for H=c-73-129-57-71.hsd1.md.comcast.net (throd) [73.129.57.71]:48498: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Jan  6 10:55:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mail@sivagnanamfoundation.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<X4vlZrFHPSdetwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 10:56:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<ijKQarFHSL0ifrCV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 10:56:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sale@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<3WGKarFHQLWi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 10:56:14 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<rezzabFHqqMz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 10:56:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<oArfabFHVJ0vWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 10:57:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<client@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<NM0VbrFHSqwIijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Jan  6 10:57:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@melanifinefood.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<+St8brFHTuwvT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 10:58:36 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<client@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<JztlcrFHNJUIijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 10:58:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<panel@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<sZp6c7FHnuJm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 11:00:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@lankaherbalsolutions.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<KbjOd7FHdIkvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 11:01:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<II7afLFHxKai8KbF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.88.103.70
country_id: 1861060
description:
2026-01-06 11:02:51 dovecot_login authenticator failed for H=(ADMIN) [149.88.103.70]:57042: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 11:07:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<cpanel@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<5e9ok7FHpsJA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 11:11:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<panel@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<By9pn7FHOJdCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 11:11:26 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<invoice@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=</QVLoLFHJt9100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 11:12:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<MDUjpLFHOK8IhpC/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 11:14:59 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailer-demo@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<NrT+rLFHxpgyBsPO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.235.204.218
country_id: 2017370
description:
2026-01-06 11:15:30 dovecot_login authenticator failed for H=(37-235-204-218.dynamic.customer.lanta.me) [37.235.204.218]:48250: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2026-01-06 11:15:17 dovecot_plain authenticator failed for H=(coalmolly) [75.97.190.237]:39220: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-01-06 11:16:10 dovecot_login authenticator failed for H=([200.106.49.149]) [200.106.49.149]:58164: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.40.31.154
country_id: 3865483
description:
Jan  6 11:17:36 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=179.40.31.154, lip=66.85.158.91, TLS, session=<czRNtbFHp7mzKB+a>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.26.42
country_id: 1269750
description:
Jan  6 11:17:58 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<charanaw>, method=PLAIN, rip=103.164.26.42, lip=66.85.158.91, TLS, session=<CMictrFHzLNnpBoq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2026-01-06 11:21:02 dovecot_plain authenticator failed for H=c-73-183-74-177.hsd1.pa.comcast.net (aster) [73.183.74.177]:34046: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.228.21.109
country_id: 6251999
description:
2026-01-06 11:22:00 dovecot_login authenticator failed for H=(ADMIN) [140.228.21.109]:30475: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 11:21:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<cpanel@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<TTgUxbFHKqJA46ZK>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.94.210.79
country_id: 2750405
description:
Jan  6 11:23:03 host2 pure-ftpd[1795757]: (?@158.94.210.79) [INFO] New connection from 158.94.210.79


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 11:24:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<Fr50z7FHGOFm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 11:26:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<cToj1rFHUqIz0msW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.116
country_id: 6252001
description:
Jan  6 11:27:09 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=66.132.153.116, lip=66.85.158.92, TLS: Connection closed, session=<YqOc2LFH0vdChJl0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 11:27:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<CJwr27FHhoai8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 11:28:16 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<notify@sobaherbal.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<IWh03LFHBtwvWBNS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.247
country_id: 1733045
description:
2026-01-06 11:30:16 dovecot_login authenticator failed for H=([49.124.152.247]) [49.124.152.247]:44996: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.220
country_id: 2186224
description:
2026-01-06 11:31:04 dovecot_login authenticator failed for H=([121.73.162.220]) [121.73.162.220]:53300: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2026-01-06 11:31:17 dovecot_plain authenticator failed for H=c-68-40-189-43.hsd1.mi.comcast.net (sterwhed) [68.40.189.43]:43474: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 11:31:26 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<fjDb57FHcqQifrCV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 11:32:05 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<panel@lankaherbalsolutions.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<NMAn6rFH/McvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 11:32:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<r7ta67FHkN1m2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 11:32:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sale@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<UQFv7LFHIoCi8KbF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 11:32:58 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<dtVW7bFHlrsIijoY>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 11:34:01 host2 sshd[1805339]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 11:34:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<j9eh8bFHfqQIijoY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.137.230
country_id: 1269750
description:
2026-01-06 11:37:30 dovecot_login authenticator failed for H=(abts-north-static-230.137.160.122.airtelbroadband.in) [122.160.137.230]:45874: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
country_id: 1269750
description:
2026-01-06 11:38:08 dovecot_login authenticator failed for H=(nsg-static-82.71.76.182-airtel.com) [182.76.71.82]:56990: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 11:39:58 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<vip@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<J3ZWBrJH9NJA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 11:42:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<webmaster@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<b+x/DrJHoJlCdMzo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.65.138
country_id: 2328926
description:
2026-01-06 11:44:13 dovecot_login authenticator failed for H=(ADMIN) [146.70.65.138]:31794: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 11:45:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<XEAHGbJH1l1100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 11:46:27 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contacts@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<JrCFHbJH/q8yBsPO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2026-01-06 11:47:41 dovecot_plain authenticator failed for H=c-73-213-237-28.hsd1.va.comcast.net (bilia) [73.213.237.28]:59748: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.116.165
country_id: 3144096
description:
2026-01-06 11:47:47 dovecot_login authenticator failed for H=(cm-178.232.116.165.get.no) [178.232.116.165]:53013: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.72.202.86
country_id: 192950
description:
2026-01-06 11:48:00 dovecot_login authenticator failed for H=([41.72.201.170]) [41.72.202.86]:48768: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 11:48:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<rPmjI7JHOukIhpC/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 11:53:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<vip@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<ovYkOLJHLqFA46ZK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.25
country_id: 6252001
description:
Jan  6 11:56:04 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.25, lip=66.85.158.92, TLS, session=<HjcOQLJHOufN0h8Z>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.218.50
country_id: 1269750
description:
2026-01-06 11:56:07 dovecot_login authenticator failed for H=([125.19.218.50]) [125.19.218.50]:43236: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 11:56:34 host2 sshd[1826500]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.51.135
country_id: 3144096
description:
2026-01-06 11:56:30 dovecot_login authenticator failed for H=(cm-178.232.51.135.get.no) [178.232.51.135]:50581: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 11:57:05 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<account@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<3oqCQ7JHV6Iz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 11:58:37 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shop@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<NtIKSbJHqr1m2gqW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2026-01-06 11:58:10 dovecot_plain authenticator failed for H=c-174-169-224-27.hsd1.vt.comcast.net (veles) [174.169.224.27]:56036: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 11:59:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<midoTbJHTsqi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 12:00:35 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<panel@sobaherbal.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<rBQQULJHnqwvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 12:04:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<lQtzXLJHPKai8KbF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 12:04:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<client@lankaherbalsolutions.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<4Y35XbJHvJgvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 12:05:39 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<buUsYrJHvLEifrCV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 12:06:16 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shop@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<hLthZLJHBNxm2gqW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.235.147
country_id: 102358
description:
2026-01-06 12:08:41 dovecot_login authenticator failed for H=(ADMIN) [95.181.235.147]:34081: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 12:09:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<jED6brJH4soIijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 12:10:26 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<5ORUc7JHxrMIijoY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2026-01-06 12:12:02 dovecot_plain authenticator failed for H=c-73-137-7-97.hsd1.ga.comcast.net (thelitione) [73.137.7.97]:45984: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 12:12:48 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<Lxe/e7JHbI9A46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Jan  6 12:13:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<shop@melanifinefood.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<ooWgfLJHwKwvT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 12:13:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<vip@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<B34/frJH8JhCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 12:18:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<s3DGjrJH4pkyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 12:18:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mail@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<QXt5kbJHE2F100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.118.215.229
country_id: 1880251
description:
Jan  6 12:20:07 host2 sshd[1848324]: Disconnected from invalid user gov 161.118.215.229 port 44894 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.118.215.229
country_id: 1880251
description:
Jan  6 12:20:10 host2 sshd[1848398]: Disconnected from invalid user gov 161.118.215.229 port 47522 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.10.86.130
country_id: 3895114
description:
Jan  6 12:23:45 host2 sshd[1851942]: Disconnected from invalid user rajesh 186.10.86.130 port 50214 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 12:23:57 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<Pcioo7JHcOgIhpC/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.10.86.130
country_id: 3895114
description:
Jan  6 12:26:10 host2 sshd[1854141]: Disconnected from invalid user ec2-user 186.10.86.130 port 43974 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.248.245.89
country_id: 2921044
description:
Jan  6 12:25:47 host2 sshd[1853829]: Disconnected from invalid user apollo 104.248.245.89 port 35704 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.248.245.89
country_id: 2921044
description:
Jan  6 12:26:20 host2 sshd[1854285]: Disconnected from invalid user tester 104.248.245.89 port 56728 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 12:26:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<cikRrrJHoqFA46ZK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.10
country_id: 1269750
description:
2026-01-06 12:27:24 dovecot_login authenticator failed for H=(aes-static-137.135.17.125.airtel.in) [182.95.228.10]:46814: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.242.112.200
country_id: 1269750
description:
2026-01-06 12:27:42 dovecot_login authenticator failed for H=(121.242.112.200.static-hyderabad.vsnl.net.in) [121.242.112.200]:41930: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 12:27:57 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<A434sbJHTKQz0msW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.10.86.130
country_id: 3895114
description:
Jan  6 12:28:15 host2 sshd[1855955]: Disconnected from invalid user james 186.10.86.130 port 45450 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.248.245.89
country_id: 2921044
description:
Jan  6 12:28:19 host2 sshd[1856013]: Disconnected from invalid user josh 104.248.245.89 port 39210 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.137.144
country_id: 1605651
description:
Jan  6 12:28:21 host2 sshd[1856055]: Disconnected from invalid user mongodb 27.254.137.144 port 35756 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 12:29:46 host2 sshd[1857262]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  6 12:30:09 host2 sshd[1857359]: Disconnected from invalid user user 2.57.121.25 port 51808 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2026-01-06 12:29:40 dovecot_plain authenticator failed for H=c-73-196-144-25.hsd1.nj.comcast.net (sness) [73.196.144.25]:57044: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.55.189.211
country_id: 6252001
description:
2026-01-06 12:30:38 dovecot_login authenticator failed for H=(wllk99-129-211.dsl.netins.net) [67.55.189.211]:50237: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.188.140
country_id: 3996063
description:
2026-01-06 12:31:00 dovecot_login authenticator failed for H=([140.84.188.140]) [140.84.188.140]:39460: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.209.108.42
country_id: 6254930
description:
2026-01-06 12:31:12 dovecot_plain authenticator failed for H=(nonon) [185.209.108.42]:35096: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.254.137.144
country_id: 1605651
description:
Jan  6 12:30:21 host2 sshd[1857955]: Disconnected from invalid user arjun 27.254.137.144 port 46174 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 12:31:34 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sale@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<RJ7fvrJHUJ2i8GQy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.52.88
country_id: 6252001
description:
Jan  6 12:31:49 host2 sshd[1859101]: Disconnected from invalid user claude 209.141.52.88 port 48920 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 12:32:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<dPYww7JHOLpm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 12:32:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<client@sobaherbal.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<zuOww7JHwusvWBNS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.156
country_id: 3703430
description:
Jan  6 12:32:56 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (disconnected before auth was ready, waited 0 secs): user=<>, rip=45.227.254.156, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<LfDmw7JHHv8t4/6c>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.215.235.115
country_id: 1831722
description:
2026-01-06 12:35:54 dovecot_login authenticator failed for H=(ADMIN) [188.215.235.115]:63592: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.203.49.121
country_id: 2963597
description:
Jan  6 12:36:05 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=37.203.49.121, lip=66.85.158.91, TLS, session=<hfc0zrJHcLglyzF5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 12:35:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<vip@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<6yxszbJHLr+i8KbF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.186.12.17
country_id: 798544
description:
Jan  6 12:35:48 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=89.186.12.17, lip=66.85.158.91, TLS, session=<uwclzbJH5blZugwR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 12:36:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<D4Gx0bJH3tcvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.17.125.224
country_id: 690791
description:
Jan  6 12:36:53 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=185.17.125.224, lip=66.85.158.91, TLS, session=<kwYI0bJH1da5EX3g>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.124.182.140
country_id: 3175395
description:
Jan  6 12:37:16 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=185.124.182.140, lip=66.85.158.91, TLS, session=<z3lC0rJHsJq5fLaM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 12:39:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<LZ4p27JHcroifrCV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 12:40:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<jDKP3rJH8qZm2gqW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.83.151.102
country_id: 6252001
description:
Jan  6 12:41:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.83.151.102, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<LMOt4rJHxt0UU5dm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.170.26.169
country_id: 2077456
description:
2026-01-06 12:41:52 dovecot_login authenticator failed for H=(124-170-26-169.tpgi.com.au) [124.170.26.169]:52690: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 12:42:43 host2 sshd[1869774]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.122
country_id: 1269750
description:
2026-01-06 12:42:27 dovecot_login authenticator failed for H=([182.95.230.122]) [182.95.230.122]:49084: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 12:45:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<uL/K77JHONoIijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 12:44:51 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<yYZa7rJH0oVCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 12:46:41 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<9sbq9LJHcONA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 12:46:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<M0Am9LJHJMMIijoY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.126
country_id: 6252001
description:
Jan  6 12:51:23 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.126, lip=66.85.158.92, session=<PlndBbNHTOmTuYR+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 12:52:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<kt6vCrNHtUh100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.102.232.38
country_id: 3057568
description:
2026-01-06 12:57:49 dovecot_login authenticator failed for H=(ADMIN) [149.102.232.38]:64020: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 12:58:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<zrZaH7NHXpkIhpC/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 12:58:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<o8QJILNHKuGi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 13:00:17 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<doCPJbNHXNIvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 13:02:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<HsFhLLNHjtwz0msW>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 13:02:37 host2 sshd[1890564]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 13:02:41 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<4zImLrNHWtFA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 13:03:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<DEB8MLNHiuCi8KbF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2026-01-06 13:04:20 dovecot_login authenticator failed for H=([152.52.218.233]) [182.78.79.134]:59582: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 13:04:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<1HgdNrNHDzB100Db>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 138.197.42.221
country_id: 6252001
description:
Jan  6 13:05:04 host2 pure-ftpd[1893245]: (?@138.197.42.221) [INFO] New connection from 138.197.42.221


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.199.197.102
country_id: 6252001
description:
Jan  6 13:06:16 host2 pure-ftpd[1894351]: (?@134.199.197.102) [INFO] New connection from 134.199.197.102


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Jan  6 13:08:39 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@melanifinefood.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<062FQ7NHwLYvT1jH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.16.157.39
country_id: 6252001
description:
2026-01-06 13:09:14 dovecot_plain authenticator failed for H=([10.5.0.2]) [154.16.157.39]:17007: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.16.157.39
country_id: 6252001
description:
2026-01-06 13:09:20 dovecot_login authenticator failed for H=([10.5.0.2]) [154.16.157.39]:17007: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.27.92.31
country_id: 6252001
description:
[2026-01-06 13:11:12 +0530] info [cpaneld] 45.27.92.31 - tradece "GET /login/?login_only=1&user=tradece&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.91.157.162
country_id: 6252001
description:
[2026-01-06 13:11:15 +0530] info [cpaneld] 68.91.157.162 - tradec "GET /login/?login_only=1&user=tradec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 132.147.156.194
country_id: 6252001
description:
[2026-01-06 13:11:02 +0530] info [cpaneld] 132.147.156.194 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.72.244.154
country_id: 6252001
description:
[2026-01-06 13:11:00 +0530] info [cpaneld] 108.72.244.154 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.192.138.188
country_id: 6252001
description:
[2026-01-06 13:11:05 +0530] info [whostmgrd] 72.192.138.188 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.244.84.239
country_id: 6252001
description:
[2026-01-06 13:11:07 +0530] info [cpaneld] 108.244.84.239 - tradeceylo "GET /login/?login_only=1&user=tradeceylo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceylo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.111.238.115
country_id: 6252001
description:
[2026-01-06 13:11:17 +0530] info [cpaneld] 68.111.238.115 - trade "GET /login/?login_only=1&user=trade&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trade (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.66.91.165
country_id: 6252001
description:
[2026-01-06 13:11:10 +0530] info [cpaneld] 108.66.91.165 - tradecey "GET /login/?login_only=1&user=tradecey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradecey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.86.225.0
country_id: 6252001
description:
[2026-01-06 13:11:06 +0530] info [cpaneld] 67.86.225.0 - tradeceyloncom "GET /login/?login_only=1&user=tradeceyloncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyloncom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.248.148.21
country_id: 6252001
description:
[2026-01-06 13:11:03 +0530] info [cpaneld] 167.248.148.21 - tradeceylon "GET /login/?login_only=1&user=tradeceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.188.215
country_id: 6252001
description:
[2026-01-06 13:11:09 +0530] info [cpaneld] 172.59.188.215 - tradeceyl "GET /login/?login_only=1&user=tradeceyl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.61.160.224
country_id: 6252001
description:
[2026-01-06 13:11:23 +0530] info [cpaneld] 24.61.160.224 - tradece1 "GET /login/?login_only=1&user=tradece1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.56.75.94
country_id: 6252001
description:
[2026-01-06 13:11:24 +0530] info [cpaneld] 98.56.75.94 - tradece2 "GET /login/?login_only=1&user=tradece2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece2 (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.169.105.48
country_id: 6252001
description:
Jan  6 13:11:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.169.105.48, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<vVu1TrNHRoAUqWkw>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.18.83.250
country_id: 6252001
description:
[2026-01-06 13:11:18 +0530] info [cpaneld] 47.18.83.250 - trad "GET /login/?login_only=1&user=trad&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trad (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.67.83.28
country_id: 6252001
description:
[2026-01-06 13:11:20 +0530] info [cpaneld] 97.67.83.28 - tra "GET /login/?login_only=1&user=tra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tra (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.117.36.181
country_id: 6252001
description:
[2026-01-06 13:11:21 +0530] info [cpaneld] 24.117.36.181 - tr "GET /login/?login_only=1&user=tr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tr (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 13:13:02 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<PcIzU7NHFqEifrCV>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 66.116.204.232
country_id: 1269750
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[66.116.204.232] [Remote Port]=[49944] [Authentication Database]=[mail] [Username]=[sales@kiriaswanu.com] (10/10 failures) (blocked until [Wed Jan  7 07:43:36 2026 UTC/Wed Jan  7 13:13:36 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 13:13:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<IodMVbNHGMNCdMzo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 144.126.237.13
country_id: 2635167
description:
Jan  6 13:15:11 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=144.126.237.13, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<VVb3WrNHcqGQfu0N>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 13:15:24 host2 sshd[1903633]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.244.52.64
country_id: 798549
description:
2026-01-06 13:15:46 dovecot_login authenticator failed for H=(ADMIN) [143.244.52.64]:44959: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 13:16:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<vtQwX7NHZI9A46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 13:17:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<hmohY7NHlNAIijoY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.94.66
country_id: 1269750
description:
2026-01-06 13:17:49 dovecot_login authenticator failed for H=([27.123.94.66]) [27.123.94.66]:39428: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.67.22
country_id: 1269750
description:
2026-01-06 13:18:07 dovecot_login authenticator failed for H=(nsg-corporate-246.50.185.122.airtel.in) [182.78.67.22]:51952: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 13:17:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=</JqRYrNHTr1m2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 13:17:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<Bbu8YrNHhpMyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 13:18:39 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<xYxKZ7NHfLkIijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.18.235
country_id: 2300660
description:
Jan  6 13:18:50 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=41.139.18.235, lip=66.85.158.91, TLS, session=<oMnMZrNH8bEpixLr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.62.192
country_id: 953987
description:
Jan  6 13:19:25 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=102.129.62.192, lip=66.85.158.91, TLS, session=<yeL4aLNHKOlmgT7A>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 188.241.177.36
country_id: 3469034
description:
Jan  6 13:23:51 host2 dovecot[1170291]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=188.241.177.36, lip=66.85.158.91, session=<Fd31ebNHpMe88bEk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 154.47.29.203
country_id: 3202326
description:
Jan  6 13:23:51 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=154.47.29.203, lip=66.85.158.91, TLS handshaking: Connection closed, session=<nJf4ebNHptyaLx3L>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.78.54.111
country_id: 2750405
description:
Jan  6 13:23:48 host2 pure-ftpd[1910911]: (?@195.78.54.111) [INFO] New connection from 195.78.54.111


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.70.11.62
country_id: 3895114
description:
Jan  6 13:23:51 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=146.70.11.62, lip=66.85.158.91, TLS, session=<uGv4ebNHrtySRgs+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.78.138.227
country_id: 2802361
description:
Jan  6 13:24:57 host2 pure-ftpd[1911995]: (?@34.78.138.227) [INFO] New connection from 34.78.138.227


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 13:24:56 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<nzGrfbNHyMZm2gqW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.85.196
country_id: 294640
description:
2026-01-06 13:25:57 dovecot_login authenticator failed for H=(31-154-85-196.orange.net.il) [2.55.85.196]:57429: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


