# incident

plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.1.117.220
country_id: 6252001
description:
Jan  4 09:51:12 host2 sshd[2787641]: Disconnected from invalid user claude 198.1.117.220 port 50828 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.191.239.155
country_id: 6252001
description:
Jan  4 09:52:26 host2 sshd[2788825]: Disconnected from invalid user claude 172.191.239.155 port 49550 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.213.170
country_id: 1819730
description:
Jan  4 09:52:29 host2 sshd[2788862]: Disconnected from invalid user hans 152.32.213.170 port 54402 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.191.239.155
country_id: 6252001
description:
Jan  4 09:54:52 host2 sshd[2791880]: Disconnected from invalid user administrator 172.191.239.155 port 36598 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.191.239.155
country_id: 6252001
description:
Jan  4 09:56:08 host2 sshd[2793399]: Disconnected from invalid user eric 172.191.239.155 port 55796 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.221.101.27
country_id: 3469034
description:
Jan  4 09:56:38 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=177.221.101.27, lip=66.85.158.91, TLS, session=<arILWIhH25qx3WUb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.149
country_id: 3175395
description:
Jan  4 09:56:56 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=217.26.179.149, lip=66.85.158.91, TLS, session=<hfpUWYhHL+nZGrOV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-04 10:01:26 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (orgalis) [87.103.126.54]:32072: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.105.224.72
country_id: 1861060
description:
Jan  4 10:03:56 host2 pure-ftpd[2800751]: (?@172.105.224.72) [INFO] New connection from 172.105.224.72


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 10:12:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<0kahkohHZohA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 10:13:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<pRftlYhHpoQjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 10:14:08 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<vZKxl4hH8I+Oq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 10:15:57 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<pNgtnohHor9nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 10:22:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<9/UNt4hHaG+uijvy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.43.123
country_id: 6252001
description:
2026-01-04 10:23:09 dovecot_plain authenticator failed for H=c-71-229-43-123.hsd1.ga.comcast.net (handism) [71.229.43.123]:34208: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.230.86.50
country_id: 6252001
description:
2026-01-04 10:24:11 dovecot_plain authenticator failed for H=c-73-230-86-50.hsd1.pa.comcast.net (cleadyine) [73.230.86.50]:54106: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.80.35.45
country_id: 192950
description:
Jan  4 10:26:37 host2 sshd[2823306]: Disconnected from invalid user sajjad 41.80.35.45 port 54402 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.80.35.45
country_id: 192950
description:
Jan  4 10:27:16 host2 sshd[2823856]: Disconnected from invalid user claude 41.80.35.45 port 34344 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.20.32.220
country_id: 1643084
description:
Jan  4 10:27:31 host2 sshd[2824076]: Disconnected from invalid user webmin 157.20.32.220 port 39154 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.167.105
country_id: 2635167
description:
Jan  4 10:27:53 host2 sshd[2824434]: Disconnected from invalid user ubuntu 178.128.167.105 port 46402 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 109.206.241.199
country_id: 453733
description:
Jan  4 10:28:04 host2 sshd[2824649]: Disconnected from invalid user claude 109.206.241.199 port 38502 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.80.35.45
country_id: 192950
description:
Jan  4 10:28:32 host2 sshd[2825169]: Disconnected from invalid user admins 41.80.35.45 port 39208 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.20.32.220
country_id: 1643084
description:
Jan  4 10:28:11 host2 sshd[2824793]: Disconnected from invalid user claude 157.20.32.220 port 49664 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.80.35.45
country_id: 192950
description:
Jan  4 10:29:10 host2 sshd[2825914]: Disconnected from invalid user mama 41.80.35.45 port 57548 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.206.241.199
country_id: 453733
description:
Jan  4 10:29:13 host2 sshd[2825990]: Disconnected from invalid user claude 109.206.241.199 port 46196 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 157.20.32.220
country_id: 1643084
description:
Jan  4 10:29:40 host2 sshd[2826364]: Disconnected from invalid user bitrix 157.20.32.220 port 56578 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.167.105
country_id: 2635167
description:
Jan  4 10:29:52 host2 sshd[2826669]: Disconnected from invalid user mailuser 178.128.167.105 port 37604 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  4 10:30:35 host2 pure-ftpd[2827623]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.94.106.254
country_id: 6252001
description:
Jan  4 10:30:41 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.94.106.254, lip=66.85.158.91, session=<0f0C04hHbqlCXmr+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.188.252.208
country_id: 6252001
description:
2026-01-04 10:33:02 dovecot_plain authenticator failed for H=c-73-188-252-208.hsd1.pa.comcast.net (ingalaus) [73.188.252.208]:58998: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 100.37.16.11
country_id: 6252001
description:
2026-01-04 10:33:27 dovecot_login authenticator failed for H=pool-100-37-16-11.nycmny.fios.verizon.net [100.37.16.11]:56193: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.84
country_id: 1210997
description:
2026-01-04 10:33:55 dovecot_login authenticator failed for H=([103.115.252.60]) [103.115.252.84]:45743: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 178.128.167.105
country_id: 2635167
description:
Jan  4 10:34:27 host2 sshd[2831551]: Disconnected from invalid user azureuser 178.128.167.105 port 43132 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.44.174.254
country_id: 357994
description:
2026-01-04 10:34:34 dovecot_plain authenticator failed for H=(cocal) [102.44.174.254]:49854: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.138.230
country_id: 1835841
description:
Jan  4 10:36:06 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=152.32.138.230, lip=66.85.158.92, session=<Sl5n5ohHMqiYIIrm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.138.230
country_id: 1835841
description:
Jan  4 10:36:26 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=152.32.138.230, lip=66.85.158.92, session=<682P54hHVuiYIIrm>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.202.118.38
country_id: 6252001
description:
Jan  4 10:37:19 host2 pure-ftpd[2834788]: (?@172.202.118.38) [INFO] New connection from 172.202.118.38


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 47.245.117.221
country_id: 1880251
description:
Jan  4 10:38:04 host2 pure-ftpd[2835553]: (?@47.245.117.221) [INFO] New connection from 47.245.117.221


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.62
country_id: 2635167
description:
Jan  4 10:40:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 45 secs): user=<>, rip=35.203.210.62, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<IR8k9ohHrM8jy9I+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.138.230
country_id: 1835841
description:
Jan  4 10:41:08 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=152.32.138.230, lip=66.85.158.91, session=<YEFi+IhHco+YIIrm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 10:41:41 host2 sshd[2839860]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.138.230
country_id: 1835841
description:
Jan  4 10:41:26 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 18 secs): user=<>, rip=152.32.138.230, lip=66.85.158.91, session=<Nh97+YhHeI+YIIrm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.62
country_id: 2635167
description:
Jan  4 10:41:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=35.203.210.62, lip=66.85.158.92, TLS: read(size=429) failed: Connection reset by peer, session=<hjHT+IhHTuwjy9I+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.68
country_id: 6252001
description:
Jan  4 10:44:26 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=216.218.206.68, lip=66.85.158.91, session=<Tj8wBIlHQjLY2s5E>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.134.120
country_id: 1269750
description:
2026-01-04 10:45:41 dovecot_login authenticator failed for H=(abts-mum-static-120.134.179.122.airtelbroadband.in) [122.179.134.120]:56356: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.62
country_id: 2635167
description:
Jan  4 10:46:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.62, lip=66.85.158.92, TLS, session=<4El+ColHRPIjy9I+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.183
country_id: 3144096
description:
2026-01-04 10:48:53 dovecot_login authenticator failed for H=(cm-84.213.189.183.get.no) [84.213.189.183]:60348: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.64.86
country_id: 1269750
description:
2026-01-04 10:49:32 dovecot_login authenticator failed for H=(nsg-corporate-80.50.185.122.airtel.in) [122.186.64.86]:51816: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.222.81.115
country_id: 6252001
description:
Jan  4 10:49:38 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=44.222.81.115, lip=66.85.158.92, TLS, session=<s0/AFolHktYs3lFz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 10:50:08 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<3cFtGIlHCteOq2dI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.45
country_id: 6252001
description:
Jan  4 10:51:03 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.45, lip=66.85.158.91, TLS, session=<j2vaG4lHbO+TuYQt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 10:51:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<3gUQHYlHNmUjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 10:51:39 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<ZuLXHYlHgrxA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 10:55:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<MSuwK4lHvJBnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2026-01-04 10:57:50 dovecot_plain authenticator failed for H=(afess) [75.97.190.237]:50707: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 10:58:04 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<mpPQNIlHVsOuijvy>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 11:01:16 host2 sshd[2862278]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.41
country_id: 2750405
description:
2026-01-04 11:02:58 dovecot_login authenticator failed for H=(Copy-of-VM-2022) [45.94.31.41]:15943: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.37.253.93
country_id: 6252001
description:
2026-01-04 11:05:24 dovecot_plain authenticator failed for H=([169.254.167.31]) [193.37.253.93]:60614: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 193.37.253.93
country_id: 6252001
description:
Jan  4 11:05:50 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=193.37.253.93, lip=66.85.158.91, TLS handshaking: Connection closed, session=<47C3UIlH/V3BJf1d>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.219
country_id: 6252001
description:
Jan  4 11:15:59 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.219, lip=66.85.158.92, TLS, session=<mCoIdYlH5PbN0h/b>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.217
country_id: 6252001
description:
Jan  4 11:19:44 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.217, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ipRxgolHlsnG6xjZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 11:20:17 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<UDE5hIlHDJ+Oq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 11:23:36 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<JRkbkIlHeNUjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 11:24:35 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<a6ygk4lHlLBA46ZK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.210.157.101
country_id: 1819730
description:
Jan  4 11:24:37 host2 sshd[2888230]: Disconnected from invalid user sunil 8.210.157.101 port 34028 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.101
country_id: 1819730
description:
Jan  4 11:25:34 host2 sshd[2889436]: Disconnected from invalid user botuser 154.83.15.101 port 52978 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.59.80.142
country_id: 3017382
description:
Jan  4 11:25:41 host2 sshd[2889513]: Disconnected from invalid user claude 146.59.80.142 port 49582 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 95.182.118.136
country_id: 1512440
description:
Jan  4 11:26:21 host2 sshd[2890133]: Disconnected from invalid user icinga 95.182.118.136 port 33670 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.59.95.254
country_id: 1522867
description:
Jan  4 11:27:23 host2 sshd[2891097]: Disconnected from invalid user eric 146.59.95.254 port 54290 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.182.118.136
country_id: 1512440
description:
Jan  4 11:27:31 host2 sshd[2891222]: Disconnected from invalid user rodrigo 95.182.118.136 port 57696 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.83.15.101
country_id: 1819730
description:
Jan  4 11:28:43 host2 sshd[2892869]: Disconnected from invalid user dashboard 154.83.15.101 port 41926 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 11:28:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<n56NoYlHRKCuijvy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.135.111.5
country_id: 298795
description:
Jan  4 11:28:34 host2 sshd[2892701]: Disconnected from invalid user lucas 78.135.111.5 port 46472 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.88
country_id: 1819730
description:
Jan  4 11:28:40 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=45.142.154.88, lip=66.85.158.91, session=<txlYoolHrkYtjppY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 11:29:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shop@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=</ypWpIlHcqpnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.101
country_id: 1819730
description:
Jan  4 11:29:23 host2 sshd[2893660]: Disconnected from invalid user claude 154.83.15.101 port 53814 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.190.168
country_id: 1819730
description:
Jan  4 11:29:44 host2 sshd[2894022]: Disconnected from invalid user postgres 152.32.190.168 port 40218 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.72.147.99
country_id: 1880251
description:
Jan  4 11:30:19 host2 sshd[2894908]: Disconnected from invalid user sagar 103.72.147.99 port 52050 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.59.80.142
country_id: 3017382
description:
Jan  4 11:30:56 host2 sshd[2895472]: Disconnected from invalid user claude 146.59.80.142 port 42158 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.59.95.254
country_id: 1522867
description:
Jan  4 11:31:34 host2 sshd[2896111]: Disconnected from invalid user marvin 146.59.95.254 port 59564 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.72.147.99
country_id: 1880251
description:
Jan  4 11:31:44 host2 sshd[2896247]: Disconnected from invalid user deploy 103.72.147.99 port 40386 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  4 11:31:13 host2 pure-ftpd[2895802]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.74.211.27
country_id: 6252001
description:
2026-01-04 11:32:38 dovecot_plain authenticator failed for H=c-75-74-211-27.hsd1.fl.comcast.net (unglerize) [75.74.211.27]:37970: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.59.95.254
country_id: 1522867
description:
Jan  4 11:32:42 host2 sshd[2897292]: Disconnected from invalid user claude 146.59.95.254 port 36744 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.190.168
country_id: 1819730
description:
Jan  4 11:32:09 host2 sshd[2896717]: Disconnected from invalid user frank 152.32.190.168 port 39240 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.135.111.5
country_id: 298795
description:
Jan  4 11:32:12 host2 sshd[2896817]: Disconnected from invalid user mine 78.135.111.5 port 38240 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.59.80.142
country_id: 3017382
description:
Jan  4 11:32:14 host2 sshd[2896854]: Disconnected from invalid user mauro 146.59.80.142 port 34840 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.190.168
country_id: 1819730
description:
Jan  4 11:33:34 host2 sshd[2898355]: Disconnected from invalid user mumbleserver 152.32.190.168 port 53480 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.203.184
country_id: 2542007
description:
2026-01-04 11:33:23 dovecot_login authenticator failed for H=([105.73.203.184]) [105.73.203.184]:46585: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.238.191.229
country_id: 6252001
description:
Jan  4 11:37:20 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.238.191.229, lip=66.85.158.91, session=<wvVcwYlH8KcD7r/l>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.140.19.22
country_id: 1269750
description:
Jan  4 11:37:57 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@euroentertainmentlk.com>, method=PLAIN, rip=103.140.19.22, lip=66.85.158.91, session=<LyVvw4lHmINnjBMW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.156
country_id: 3469034
description:
Jan  4 11:41:12 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@jrdc.lk>, method=PLAIN, rip=177.44.71.156, lip=66.85.158.91, TLS, session=<JW0hzolHIp6xLEec>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.134.100
country_id: 690791
description:
Jan  4 11:41:28 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=37.221.134.100, lip=66.85.158.91, TLS, session=<eOkpz4lHfsol3YZk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.17.125.44
country_id: 690791
description:
Jan  4 11:41:29 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.17.125.44, lip=66.85.158.91, TLS, session=<G8c2z4lHmwy5EX0s>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.12.14
country_id: 226074
description:
Jan  4 11:41:34 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=196.0.12.14, lip=66.85.158.91, TLS, session=<e+VVz4lHGd3EAAwO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.184.82.42
country_id: 798544
description:
Jan  4 11:41:10 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@jrdc.lk>, method=PLAIN, rip=195.184.82.42, lip=66.85.158.91, TLS, session=<5LIZzolHnYvDuFIq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.16.61.60
country_id: 2215636
description:
Jan  4 11:41:09 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@jrdc.lk>, method=PLAIN, rip=165.16.61.60, lip=66.85.158.91, TLS, session=<KzwLzolHOeylED08>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.4.78
country_id: 690791
description:
Jan  4 11:41:27 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=176.103.4.78, lip=66.85.158.91, TLS, session=<gBMcz4lHgI2wZwRO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.206.103.90
country_id: 6290252
description:
Jan  4 11:41:29 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=109.206.103.90, lip=66.85.158.91, TLS, session=<iYBCz4lHscZtzmda>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.128.123
country_id: 3469034
description:
Jan  4 11:41:12 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@jrdc.lk>, method=PLAIN, rip=191.53.128.123, lip=66.85.158.91, TLS, session=<8ecXzolHJ4C/NYB7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.11.119
country_id: 2300660
description:
Jan  4 11:41:11 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@jrdc.lk>, method=PLAIN, rip=41.139.11.119, lip=66.85.158.91, TLS, session=<KFIazolH470piwt3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.118.34.227
country_id: 1269750
description:
Jan  4 11:42:31 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=45.118.34.227, lip=66.85.158.91, TLS, session=<t+7T0olHWN8tdiLj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.190.22.247
country_id: 2750405
description:
Jan  4 11:42:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=146.190.22.247, lip=66.85.158.91, session=<dzmd1IlHBJmSvhb3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.142.125
country_id: 99237
description:
Jan  4 11:42:52 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw>, method=PLAIN, rip=65.20.142.125, lip=66.85.158.91, TLS, session=<OcQO1IlHeOFBFI59>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 11:49:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<qZ6o7YlHqOKOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 11:54:59 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<QqViAIpH5FojupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.166.38
country_id: 2186224
description:
2026-01-04 11:56:10 dovecot_login authenticator failed for H=([121.73.166.38]) [121.73.166.38]:60874: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.251
country_id: 3469034
description:
Jan  4 11:56:10 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=190.89.136.251, lip=66.85.158.91, TLS, session=<n1eLA4pHZ6a+WYj7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.80.26.252
country_id: 3865483
description:
Jan  4 11:55:48 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=181.80.26.252, lip=66.85.158.91, TLS, session=<smA6AopHir21UBr8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.14.56.116
country_id: 3017382
description:
2026-01-04 11:56:30 dovecot_login authenticator failed for H=laubervilliers-657-1-120-116.w80-14.abo.wanadoo.fr [80.14.56.116]:48852: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 11:56:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<ZqBDB4pHxNBA46ZK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  4 11:57:48 host2 sshd[2925527]: Disconnected from invalid user user 2.57.121.25 port 22467 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 11:59:34 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<Q8O+EIpH1EOuijvy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-04 12:01:26 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (blembrand) [87.103.126.54]:50618: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.123.134.194
country_id: 6252001
description:
Jan  4 12:02:39 host2 sshd[2931165]: Disconnected from invalid user administrador 34.123.134.194 port 49716 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 12:02:47 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<yGBFHIpHOo5nmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-04 12:03:47 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:55952: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.94.106.254
country_id: 6252001
description:
Jan  4 12:03:29 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.94.106.254, lip=66.85.158.91, session=<XPDiHopHVspCXmr+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.123.134.194
country_id: 6252001
description:
Jan  4 12:06:11 host2 sshd[2935337]: Disconnected from invalid user odoo 34.123.134.194 port 47182 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.67
country_id: 99237
description:
2026-01-04 12:09:22 dovecot_plain authenticator failed for H=(majoidae) [65.20.129.67]:48975: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.248.111.238
country_id: 6252001
description:
2026-01-04 12:12:14 dovecot_plain authenticator failed for H=(banth) [38.248.111.238]:33936: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Jan  4 12:16:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<YIJoTIpHMoIFhH+s>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.222.81.115
country_id: 6252001
description:
Jan  4 12:16:17 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=44.222.81.115, lip=66.85.158.91, session=<wk+uTIpHqKos3lFz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  4 12:19:08 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<8JzbVopHgNgDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 12:19:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<c61yV4pH3LOOq2dI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  4 12:20:21 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<u9g1W4pHbsIDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  4 12:21:30 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<TFhRX4pHjJMDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  4 12:22:41 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<iiSIY4pHspgDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  4 12:23:28 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<7MpZZopHANQDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.140.19.22
country_id: 1269750
description:
Jan  4 12:24:08 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=103.140.19.22, lip=66.85.158.91, session=<uUmYaIpHNs1njBMW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  4 12:24:40 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<WNuqaopHNpIDhBfJ>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  4 12:25:55 host2 dovecot[1170291]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<jfQWb4pH7IIDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.154.217.188
country_id: 690791
description:
2026-01-04 12:25:57 dovecot_login authenticator failed for H=ip-d9bc.d-net.kiev.ua [94.154.217.188]:53078: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.6.101.246
country_id: 2510769
description:
2026-01-04 12:26:10 dovecot_login authenticator failed for H=246.red-88-6-101.staticip.rima-tde.net [88.6.101.246]:46466: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 12:26:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<u+ixcIpHYpUjupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  4 12:26:36 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<e6aRcYpHvrgDhBfJ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 12:27:34 host2 sshd[2958331]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  4 12:27:15 host2 dovecot[1170291]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<Kw/ec4pHyrkDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  4 12:27:49 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<sQXjdYpHhNYDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.255
country_id: 6252001
description:
Jan  4 12:28:02 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.255, lip=66.85.158.91, TLS, session=<qVa1dopHkv7G6xj/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  4 12:29:04 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<Eg1feopHwLADhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 12:29:41 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<ZY56fIpH4MdA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 12:30:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<MXnqfopHOrWuijvy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 12:31:27 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<hhTHgopHkEWvnZ1q>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  4 12:31:45 host2 sshd[2962360]: Disconnected from invalid user admin 2.57.121.112 port 18012 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.157.219.158
country_id: 6252001
description:
2026-01-04 12:35:30 dovecot_plain authenticator failed for H=c-76-157-219-158.hsd1.il.comcast.net (basta) [76.157.219.158]:55816: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  4 12:36:02 host2 pure-ftpd[2966692]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 12:36:56 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<oQxjlopHIptnmud6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 12:37:22 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<2xL4l4pH2HmvnZ1q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 12:38:39 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<u5yInIpHkkWvnZ1q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 12:40:40 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<hi61o4pH2XmvnZ1q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.94.106.254
country_id: 6252001
description:
Jan  4 12:44:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.94.106.254, lip=66.85.158.91, session=<qL/BsYpHCJ1CXmr+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.65.154.146
country_id: 6252001
description:
Jan  4 12:44:59 host2 pure-ftpd[2978054]: (?@20.65.154.146) [INFO] New connection from 20.65.154.146


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 12:45:14 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<qrsMtIpHlEWvnZ1q>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 12:47:10 host2 sshd[2979977]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 12:46:48 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<LKmuuYpHlUWvnZ1q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 12:48:06 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<y7ZRvopH3XmvnZ1q>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 12:48:56 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<6TVKwYpHBsOOq2dI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 12:49:02 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<ztumwYpHlkWvnZ1q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.19.200
country_id: 6252001
description:
Jan  4 12:49:05 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=18.97.19.200, lip=66.85.158.92, session=<NezzwYpH+LwSYRPI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 12:50:03 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<W25HxYpHmEWvnZ1q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 12:51:09 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<oWI+yYpHmUWvnZ1q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 12:51:58 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<ul8pzIpH4HmvnZ1q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.5.33
country_id: 6252001
description:
Jan  4 12:54:40 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=18.97.5.33, lip=66.85.158.92, TLS handshaking: Connection closed, session=<hMvp1YpH1uQSYQUh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 12:54:27 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<r5EM1YpH4XmvnZ1q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 12:55:32 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<UkHi2IpHnUWvnZ1q>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.247.137.15
country_id: 2635167
description:
Jan  4 12:56:25 host2 pure-ftpd[2991198]: (?@185.247.137.15) [INFO] New connection from 185.247.137.15


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 12:56:54 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<Pd7S3YpH5HmvnZ1q>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2026-01-04 12:57:20 dovecot_plain authenticator failed for H=(hearaton) [24.105.248.218]:40928: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 12:58:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<vWB54opHbGcjupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 12:58:01 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<CurG4YpHnkWvnZ1q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 12:58:54 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<BWeT5IpHn0WvnZ1q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 12:59:49 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<vOY26IpH53mvnZ1q>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.5
country_id: 2635167
description:
Jan  4 13:00:02 host2 dovecot[1170291]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.5, lip=66.85.158.92, TLS, session=<e3gf6YpH1Za594kF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 13:01:05 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<pgnF7IpHoUWvnZ1q>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.11.17.169
country_id: 3175395
description:
2026-01-04 13:01:46 dovecot_plain authenticator failed for H=host-188-11-17-169.business.telecomitalia.it (saivess) [188.11.17.169]:54476: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 13:01:58 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<uMjo74pHznyuijvy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2026-01-04 13:02:05 dovecot_plain authenticator failed for H=c-73-13-220-220.hsd1.de.comcast.net (disiestip) [73.13.220.220]:55152: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 13:02:17 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<8kkI8YpHskevnZ1q>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 13:02:49 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<v5z38opHRpNA46ZK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 13:03:03 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<4o7J84pH6HmvnZ1q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 13:04:17 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<syvX94pHtEevnZ1q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 13:05:26 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<dWdO/IpHtUevnZ1q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 13:07:38 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<jaSEAItHtkevnZ1q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 13:09:30 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<VFd8CotH7nmvnZ1q>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 13:11:40 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<5RacEotHFKNnmud6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.201
country_id: 6252001
description:
Jan  4 13:11:58 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.201, lip=66.85.158.91, session=<TaXQE4tHUuCTuYTJ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.82.240.194
country_id: 1643084
description:
Jan  4 13:12:01 host2 sshd[3007503]: Disconnected from invalid user master 103.82.240.194 port 33216 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 13:12:39 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<DE4aFotHuUevnZ1q>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.152
country_id: 2635167
description:
Jan  4 13:14:13 host2 dovecot[1170291]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.152, lip=66.85.158.92, TLS, session=<cUTeG4tHm+dX7LCY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 13:15:11 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<HecrH4tHAnyvnZ1q>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.135.112.8
country_id: 6252001
description:
Jan  4 13:15:00 host2 pure-ftpd[3010301]: (?@103.135.112.8) [INFO] New connection from 103.135.112.8


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  4 13:15:42 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@anandaobauae.org>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<Q08NIYtHTskFhXlo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.253.25
country_id: 1819730
description:
Jan  4 13:17:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 9 secs): user=<>, rip=152.32.253.25, lip=66.85.158.92, session=<V081JotHqimYIP0Z>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.30.115.187
country_id: 3686110
description:
Jan  4 13:17:22 host2 sshd[3012906]: Disconnected from invalid user admin 186.30.115.187 port 40652 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 13:18:03 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<Pt5vKYtHvkevnZ1q>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.30.115.187
country_id: 3686110
description:
Jan  4 13:18:47 host2 sshd[3014092]: Disconnected from invalid user rahul 186.30.115.187 port 39760 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 13:19:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<9h54LYtH6p2Oq2dI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 13:19:24 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<0lpDLotHBHyvnZ1q>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.30.115.187
country_id: 3686110
description:
Jan  4 13:19:26 host2 sshd[3014793]: Disconnected from invalid user claude 186.30.115.187 port 53426 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  4 13:20:48 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<0jJfM4tHlLUDhpQ7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.235.179
country_id: 6252001
description:
Jan  4 13:21:57 host2 sshd[3017712]: Disconnected from invalid user dmdba 165.154.235.179 port 37674 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 13:22:08 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<UiQROItHv0evnZ1q>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.235.179
country_id: 6252001
description:
Jan  4 13:22:26 host2 sshd[3018157]: Disconnected from invalid user testuser 165.154.235.179 port 50112 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  4 13:23:26 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<HXPRPItHJNUDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 13:23:41 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<uQfrPItHCXyvnZ1q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  4 13:25:04 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<YIqmQotHjuUDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.221.99
country_id: 1227603
description:
Jan  4 13:24:32 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.221.99, lip=66.85.158.91, TLS, session=<rxI/QItHJzuvnd1j>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 13:25:48 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<J07KRItHC3yvnZ1q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  4 13:26:27 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<8DaYR4tHpKMDhpQ7>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  4 13:26:44 host2 dovecot[1170291]: imap-login: Disconnected: Input buffer full (no auth attempts in 1 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<MSCVSItHsqADhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 13:26:56 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=</hveSItHwEevnZ1q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  4 13:28:26 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<cy2xTotHrNUDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 13:29:39 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<1X/ZUotHD3yvnZ1q>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 13:30:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<rAgfVotH2r8jupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 13:32:21 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<78CQXItHxUevnZ1q>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  4 13:31:52 host2 sshd[3027288]: Disconnected from invalid user user 2.57.121.25 port 18083 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.53.199.160
country_id: 6252001
description:
2026-01-04 13:32:35 dovecot_login authenticator failed for H=(136-53-199-160.googlefiber.net) [136.53.199.160]:48893: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.83.145.39
country_id: 6252001
description:
Jan  4 13:32:40 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.83.145.39, lip=66.85.158.91, TLS, session=<oETUXYtH8qgDU5En>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.206
country_id: 1269750
description:
2026-01-04 13:32:58 dovecot_login authenticator failed for H=([27.123.105.41]) [182.95.52.206]:45834: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.218.247.234
country_id: 1522867
description:
2026-01-04 13:33:30 dovecot_login authenticator failed for H=([89.218.247.234]) [89.218.247.234]:54676: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 13:33:51 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<NVuyYItHxkevnZ1q>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 13:34:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<NcYeZItHSpGuijvy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 13:35:32 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<VdahZ4tHFHyvnZ1q>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 13:36:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<wDMGaotHlslA46ZK>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.46.210.158
country_id: 3175395
description:
Jan  4 13:37:28 host2 sshd[3033720]: Disconnected from invalid user deployer 151.46.210.158 port 61160 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 13:38:26 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<Og9FcotHykevnZ1q>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.46.210.158
country_id: 3175395
description:
Jan  4 13:40:27 host2 sshd[3036819]: Disconnected from invalid user claude 151.46.210.158 port 61358 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  4 13:40:34 host2 pure-ftpd[3036996]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  4 13:41:46 host2 sshd[3038010]: Disconnected from invalid user admin 2.57.121.112 port 48091 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 86.54.31.40
country_id: 2750405
description:
Jan  4 13:46:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=86.54.31.40, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<8qPtjYtH2sJWNh8o>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 13:45:57 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<7vk9jYtHpupnmud6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 13:46:36 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<QdxPjotHGnyvnZ1q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 13:48:31 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<FNxglotH40mvnZ1q>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 13:49:40 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<O7mAmotHMpiOq2dI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-04 13:50:11 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:16373: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.175.75
country_id: 99237
description:
2026-01-04 13:50:37 dovecot_login authenticator failed for H=([65.20.175.75]) [65.20.175.75]:38120: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.36.204
country_id: 3144096
description:
2026-01-04 13:51:01 dovecot_login authenticator failed for H=(cm-178.232.36.204.get.no) [178.232.36.204]:52150: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 179.40.31.154
country_id: 3865483
description:
Jan  4 13:51:45 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=179.40.31.154, lip=66.85.158.91, session=<oAo3oYtH3JyzKB+a>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.153.3.94
country_id: 3175395
description:
Jan  4 13:52:10 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@visionsolutionshospital.com>, method=LOGIN, rip=185.153.3.94, lip=66.85.158.91, session=<Mk3ooYtHDKW5mQNe>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 13:52:11 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<+gdto4tH5kmvnZ1q>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.115.237.19
country_id: 3923057
description:
2026-01-04 13:52:19 dovecot_login authenticator failed for H=([181.115.237.19]) [181.115.237.19]:51165: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2026-01-04 13:53:19 dovecot_plain authenticator failed for H=(subfor) [24.104.225.201]:38965: 535 Incorrect authentication data (set_id=sales@ksoft.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 14.102.101.248
country_id: 1269750
description:
Jan  4 13:52:33 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=14.102.101.248, lip=66.85.158.91, session=<04B1o4tHqY8OZmX4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.54.99.236
country_id: 294640
description:
2026-01-04 13:52:36 dovecot_login authenticator failed for H=(2-54-99-236.orange.net.il) [2.54.99.236]:55149: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 178.239.35.203
country_id: 3175395
description:
Jan  4 13:52:54 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=178.239.35.203, lip=66.85.158.91, session=<u+4DpYtH2Jqy7yPL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.118
country_id: 1269750
description:
2026-01-04 13:53:17 dovecot_login authenticator failed for H=([152.52.234.180]) [182.95.177.118]:53984: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 152.32.146.202
country_id: 1861060
description:
Jan  4 13:53:53 host2 pure-ftpd[3050450]: (?@152.32.146.202) [INFO] New connection from 152.32.146.202


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.178
country_id: 1269750
description:
2026-01-04 13:53:53 dovecot_login authenticator failed for H=([152.52.246.178]) [152.52.246.178]:41342: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2026-01-04 13:54:32 dovecot_plain authenticator failed for H=(jacheal) [192.34.128.202]:58836: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 152.32.146.202
country_id: 1861060
description:
Jan  4 13:55:51 host2 pure-ftpd[3053544]: (?@152.32.146.202) [INFO] New connection from 152.32.146.202


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.241.132.152
country_id: 1269750
description:
2026-01-04 14:01:06 dovecot_login authenticator failed for H=(static.ill.117.248.107.130.bsnl.co.in) [43.241.132.152]:54176: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.155
country_id: 2186224
description:
2026-01-04 14:02:00 dovecot_login authenticator failed for H=([121.73.168.155]) [121.73.168.155]:37034: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 14:03:17 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<l0E5y4tHTIIjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 14:06:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<A7DS1YtHYnKuijvy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.190.155.43
country_id: 6252001
description:
2026-01-04 14:06:35 dovecot_plain authenticator failed for H=(sporke) [76.190.155.43]:45889: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 14:07:56 host2 sshd[3082330]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 14:09:49 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<J2aW4otH0LRA46ZK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2026-01-04 14:10:41 dovecot_plain authenticator failed for H=(bleting) [12.150.243.22]:52571: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.180.88.176
country_id: 6252001
description:
Jan  4 14:11:19 host2 sshd[3086239]: Disconnected from invalid user claude 107.180.88.176 port 48226 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 14:13:30 host2 sshd[3088520]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.5.0.120
country_id: 1643084
description:
Jan  4 14:15:03 host2 sshd[3089982]: Disconnected from invalid user ubuntu 69.5.0.120 port 44496 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.180.88.176
country_id: 6252001
description:
Jan  4 14:14:40 host2 sshd[3089598]: Disconnected from invalid user suporte 107.180.88.176 port 44784 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.166.245.172
country_id: 6252001
description:
Jan  4 14:15:41 host2 sshd[3090639]: Disconnected from invalid user qwe 43.166.245.172 port 27904 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.180.88.176
country_id: 6252001
description:
Jan  4 14:15:50 host2 sshd[3090768]: Disconnected from invalid user claude 107.180.88.176 port 41044 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.99.14
country_id: 290557
description:
2026-01-04 14:16:53 dovecot_plain authenticator failed for H=(acops) [5.32.99.14]:49807: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2026-01-04 14:16:55 dovecot_plain authenticator failed for H=(renct) [80.227.102.242]:58792: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.153.249.99
country_id: 3895114
description:
Jan  4 14:17:39 host2 sshd[3092346]: Disconnected from invalid user claude 190.153.249.99 port 57347 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.166.245.172
country_id: 6252001
description:
Jan  4 14:17:51 host2 sshd[3092517]: Disconnected from invalid user tt 43.166.245.172 port 22528 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 14:20:06 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<zRRWB4xH4ImOq2dI>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.129.236
country_id: 1819730
description:
Jan  4 14:19:24 host2 sshd[3094436]: Disconnected from invalid user test 152.32.129.236 port 51002 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 14:20:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<fZb9CYxHcMZnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.5.0.120
country_id: 1643084
description:
Jan  4 14:20:55 host2 sshd[3096052]: Disconnected from invalid user kt 69.5.0.120 port 55960 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.153.249.99
country_id: 3895114
description:
Jan  4 14:20:57 host2 sshd[3096125]: Disconnected from invalid user minecraft 190.153.249.99 port 57697 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.211.56.214
country_id: 2750405
description:
Jan  4 14:22:12 host2 sshd[3097398]: Disconnected from invalid user hb 172.211.56.214 port 45734 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.211.56.214
country_id: 2750405
description:
Jan  4 14:23:11 host2 sshd[3098299]: Disconnected from invalid user claude 172.211.56.214 port 34646 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.5.0.120
country_id: 1643084
description:
Jan  4 14:24:21 host2 sshd[3099574]: Disconnected from invalid user zhangwei 69.5.0.120 port 40216 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 14:33:11 host2 sshd[3109281]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 14:36:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<3rjAQIxHam4jupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 14:39:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<WXlzS4xH9juuijvy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.178.115.16
country_id: 6252001
description:
Jan  4 14:40:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.178.115.16, lip=66.85.158.92, session=<g1OJT4xHosSssnMQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 14:43:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<UArRW4xHuudA46ZK>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  4 14:45:22 host2 pure-ftpd[3123114]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 14:50:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<pT33dIxHkrSOq2dI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  4 14:51:25 host2 sshd[3128836]: Disconnected from invalid user admin 2.57.121.112 port 29732 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 14:56:37 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<SEj2iYxHDN9nmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.112.56.47
country_id: 798544
description:
Jan  4 14:57:34 host2 sshd[3135414]: Disconnected from invalid user cgpexpert 134.112.56.47 port 58814 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.176.115.34
country_id: 1269750
description:
Jan  4 14:59:00 host2 sshd[3136639]: Disconnected from invalid user claude 122.176.115.34 port 33672 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.176.115.34
country_id: 1269750
description:
Jan  4 14:59:51 host2 sshd[3137483]: Disconnected from invalid user dreambox 122.176.115.34 port 47428 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.106.89
country_id: 6252001
description:
Jan  4 15:00:20 host2 sshd[3138192]: Disconnected from invalid user ubuntu 164.92.106.89 port 45854 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.176.115.34
country_id: 1269750
description:
Jan  4 15:00:41 host2 sshd[3138537]: Disconnected from invalid user mantis 122.176.115.34 port 32952 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.106.89
country_id: 6252001
description:
Jan  4 15:01:33 host2 sshd[3139406]: Disconnected from invalid user steam 164.92.106.89 port 49890 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 164.92.106.89
country_id: 6252001
description:
Jan  4 15:02:08 host2 sshd[3139897]: Disconnected from invalid user claude 164.92.106.89 port 42744 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.92.134.8
country_id: 3469034
description:
Jan  4 15:03:20 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=177.92.134.8, lip=66.85.158.91, TLS, session=<Sbn+oIxHVryxXIYI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.112.56.47
country_id: 798544
description:
Jan  4 15:02:38 host2 sshd[3140298]: Disconnected from invalid user claude 134.112.56.47 port 54738 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.106.89
country_id: 6252001
description:
Jan  4 15:02:44 host2 sshd[3140372]: Disconnected from invalid user gino 164.92.106.89 port 55142 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 84.20.67.98
country_id: 783754
description:
Jan  4 15:03:38 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<charanaw>, method=PLAIN, rip=84.20.67.98, lip=66.85.158.91, TLS, session=<iIsmooxHBKlUFENi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-04 15:03:46 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (parchic) [87.103.126.54]:25381: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.106.89
country_id: 6252001
description:
Jan  4 15:03:48 host2 sshd[3141577]: Disconnected from invalid user ben 164.92.106.89 port 42432 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.176.115.34
country_id: 1269750
description:
Jan  4 15:04:56 host2 sshd[3142947]: Disconnected from invalid user frank 122.176.115.34 port 45290 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 134.112.56.47
country_id: 798544
description:
Jan  4 15:07:04 host2 sshd[3145581]: Disconnected from invalid user murad 134.112.56.47 port 44182 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.112.56.47
country_id: 798544
description:
Jan  4 15:07:54 host2 sshd[3146217]: Disconnected from invalid user gino 134.112.56.47 port 37204 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 15:08:42 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<8mUgtYxH0mcjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 15:12:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<gXiPwYxHIHSuijvy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.10
country_id: 798549
description:
Jan  4 15:13:59 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=85.217.140.10, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<XWYvyIxHXs5V2YwK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 15:17:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<jbou1IxHBu5A46ZK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.236.66
country_id: 6252001
description:
2026-01-04 15:19:01 dovecot_plain authenticator failed for H=c-73-213-236-66.hsd1.va.comcast.net (cogably) [73.213.236.66]:59162: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-04 15:20:14 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:55501: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 15:21:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<Mffa44xHcLWOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 15:32:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shop@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<Ln81C41H3sZnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.180
country_id: 99237
description:
2026-01-04 15:34:54 dovecot_login authenticator failed for H=([65.20.250.180]) [65.20.250.180]:37142: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.153
country_id: 2186224
description:
2026-01-04 15:35:11 dovecot_login authenticator failed for H=([121.73.162.153]) [121.73.162.153]:38656: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 15:41:49 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<dJaPK41HGtojupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 15:45:32 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<azflOI1HBmKuijvy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.220.97.188
country_id: 6252001
description:
2026-01-04 15:50:42 dovecot_login authenticator failed for H=c-98-220-97-188.hsd1.il.comcast.net [98.220.97.188]:52080: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2026-01-04 15:50:54 dovecot_login authenticator failed for H=([38.226.118.9]) [38.226.118.0]:38232: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  4 15:50:17 host2 pure-ftpd[3191247]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.83.145.39
country_id: 6252001
description:
Jan  4 15:51:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.83.145.39, lip=66.85.158.92, TLS, session=<IOhYTY1HHsIDU5En>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 15:51:59 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<dqLvT41HSIFA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 15:53:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<L03CU41Hhq+Oq2dI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.221.60.108
country_id: 6252001
description:
Jan  4 15:55:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.221.60.108, lip=66.85.158.91, session=<ui2kXI1HoOIU3Txs>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 15:59:24 host2 sshd[3201663]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.170.231.167
country_id: 3469034
description:
Jan  4 16:04:40 host2 sshd[3209053]: Disconnected from invalid user claude 177.170.231.167 port 48286 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 14.97.117.34
country_id: 1269750
description:
Jan  4 16:04:42 host2 sshd[3209090]: Disconnected from invalid user abc 14.97.117.34 port 53493 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  4 16:05:53 host2 sshd[3210561]: Disconnected from invalid user admin 2.57.121.112 port 35780 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.170.231.167
country_id: 3469034
description:
Jan  4 16:06:10 host2 sshd[3210934]: Disconnected from invalid user abc 177.170.231.167 port 40482 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.37.11.87
country_id: 3469034
description:
Jan  4 16:08:07 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=191.37.11.87, lip=66.85.158.91, TLS, session=<vi6TiI1HLKm/JQtX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.90.12.192
country_id: 6252001
description:
Jan  4 16:08:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.90.12.192, lip=66.85.158.91, TLS, session=<LVbFiY1HUOQDWgzA>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 14.97.117.34
country_id: 1269750
description:
Jan  4 16:09:05 host2 sshd[3214218]: Disconnected from invalid user web 14.97.117.34 port 16457 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.207.35.155
country_id: 6290252
description:
Jan  4 16:08:25 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<charanaw>, method=PLAIN, rip=109.207.35.155, lip=66.85.158.91, TLS, session=<K5jYiY1H1IttzyOb>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.170.231.167
country_id: 3469034
description:
Jan  4 16:08:54 host2 sshd[3213961]: Disconnected from invalid user claude 177.170.231.167 port 60866 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.70
country_id: 1269750
description:
2026-01-04 16:09:20 dovecot_login authenticator failed for H=([182.66.214.70]) [182.66.214.70]:45232: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 16:09:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<2dl1j41HMIZnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.221.88
country_id: 1880251
description:
Jan  4 16:09:49 host2 sshd[3215000]: Disconnected from invalid user tester 45.78.221.88 port 52256 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.12
country_id: 798549
description:
Jan  4 16:09:42 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.140.12, lip=66.85.158.91, TLS: Connection closed, session=<PRJqj41H4tlV2YwM>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.170.231.167
country_id: 3469034
description:
Jan  4 16:09:33 host2 sshd[3214782]: Disconnected from invalid user user2 177.170.231.167 port 44786 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.186.104.101
country_id: 6252001
description:
2026-01-04 16:09:40 dovecot_login authenticator failed for H=wsip-184-186-104-101.lv.lv.cox.net [184.186.104.101]:59213: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.12
country_id: 798549
description:
Jan  4 16:10:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=85.217.140.12, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<x34dkY1HbK5V2YwM>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 14.97.117.34
country_id: 1269750
description:
Jan  4 16:10:20 host2 sshd[3215727]: Disconnected from invalid user claude 14.97.117.34 port 20589 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.221.88
country_id: 1880251
description:
Jan  4 16:11:05 host2 sshd[3216613]: Disconnected from invalid user readonly 45.78.221.88 port 53872 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.243.236.86
country_id: 290557
description:
Jan  4 16:11:19 host2 sshd[3216836]: Disconnected from invalid user claude 74.243.236.86 port 48004 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 74.243.236.86
country_id: 290557
description:
Jan  4 16:12:36 host2 sshd[3218302]: Disconnected from invalid user claude 74.243.236.86 port 44970 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.221.88
country_id: 1880251
description:
Jan  4 16:13:34 host2 sshd[3219335]: Disconnected from invalid user sshuser 45.78.221.88 port 42380 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.243.236.86
country_id: 290557
description:
Jan  4 16:13:53 host2 sshd[3219646]: Disconnected from invalid user claude 74.243.236.86 port 39004 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 16:15:08 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<nXzAoo1HgKYjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.140.19.22
country_id: 1269750
description:
Jan  4 16:16:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=103.140.19.22, lip=66.85.158.91, session=<2yO+po1HaqtnjBMW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.118
country_id: 6252001
description:
Jan  4 16:16:10 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.118, lip=66.85.158.92, TLS: Connection closed, session=<cteOpo1HwmxChJl2>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.231.109.115
country_id: 2661886
description:
Jan  4 16:17:31 host2 sshd[3223692]: error: maximum authentication attempts exceeded for invalid user admin from 85.231.109.115 port 60730 ssh2 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 85.231.109.115
country_id: 2661886
description:
Jan  4 16:17:34 host2 sshd[3223757]: Disconnecting invalid user admin 85.231.109.115 port 32926: Too many authentication failures [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 85.231.109.115
country_id: 2661886
description:
Jan  4 16:17:22 host2 sshd[3223525]: Disconnecting authenticating user root 85.231.109.115 port 58974: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 85.231.109.115
country_id: 2661886
description:
Jan  4 16:17:22 host2 sshd[3223525]: error: maximum authentication attempts exceeded for root from 85.231.109.115 port 58974 ssh2 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 16:19:04 host2 sshd[3225467]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 16:19:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<bfE4sY1HRNuuijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 16:24:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<Otzqw41HftSOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 16:27:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<dNhXzY1HMrNA46ZK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  4 16:27:33 host2 sshd[3235073]: Disconnected from invalid user user 2.57.121.25 port 36528 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.126
country_id: 3865483
description:
Jan  4 16:39:03 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=179.0.252.126, lip=66.85.158.91, TLS, session=<3wM2941HBsWzAPx+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.8.99
country_id: 3175395
description:
Jan  4 16:39:20 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.197.8.99, lip=66.85.158.91, TLS, session=<FDlw+I1Hbei5xQhj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.141
country_id: 6252001
description:
Jan  4 16:44:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.141, lip=66.85.158.91, TLS: Connection closed, session=<cE7cDI5HiAtChJmN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 16:46:21 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<OhFYEo5H0pJnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 16:48:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<4Cb0GI5HaG0jupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2026-01-04 16:49:20 dovecot_plain authenticator failed for H=c-73-145-107-251.hsd1.mi.comcast.net (zierm) [73.145.107.251]:37036: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 16:52:29 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<e6RSKI5H8kSuijvy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.208.253.156
country_id: 130758
description:
Jan  4 16:54:45 host2 sshd[3267951]: Disconnected from invalid user claude 85.208.253.156 port 48052 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.137.142.115
country_id: 1655842
description:
Jan  4 16:56:04 host2 sshd[3269727]: Disconnected from invalid user claude 202.137.142.115 port 48842 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  4 16:55:28 host2 pure-ftpd[3268940]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 16:55:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<YygONI5H0KqOq2dI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.237.173.220
country_id: 6252001
description:
Jan  4 16:55:47 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.237.173.220, lip=66.85.158.92, session=<L7I7NI5H6OoD7a3c>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.227.237.176
country_id: 1861060
description:
Jan  4 16:56:18 host2 sshd[3270068]: Disconnected from invalid user dev 156.227.237.176 port 36034 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.137.142.115
country_id: 1655842
description:
Jan  4 16:56:54 host2 sshd[3270738]: Disconnected from invalid user bitrix 202.137.142.115 port 33650 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.137.142.115
country_id: 1655842
description:
Jan  4 16:58:25 host2 sshd[3272424]: Disconnected from invalid user vadim 202.137.142.115 port 45558 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.48.144.19
country_id: 6252001
description:
Jan  4 16:58:31 host2 sshd[3272551]: Disconnected from invalid user ubuntu 74.48.144.19 port 38578 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.227.237.176
country_id: 1861060
description:
Jan  4 16:58:53 host2 sshd[3272926]: Disconnected from invalid user bitrix 156.227.237.176 port 54006 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.227.237.176
country_id: 1861060
description:
Jan  4 16:59:33 host2 sshd[3273713]: Disconnected from invalid user wilson 156.227.237.176 port 33456 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.208.253.156
country_id: 130758
description:
Jan  4 17:00:59 host2 sshd[3275950]: Disconnected from invalid user junin 85.208.253.156 port 45444 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 74.48.144.19
country_id: 6252001
description:
Jan  4 17:00:20 host2 sshd[3275038]: Disconnected from invalid user ubuntu 74.48.144.19 port 43376 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.130
country_id: 1269750
description:
2026-01-04 17:01:56 dovecot_login authenticator failed for H=([27.123.114.130]) [27.123.114.130]:57822: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.48.144.19
country_id: 6252001
description:
Jan  4 17:01:28 host2 sshd[3276543]: Disconnected from invalid user claude 74.48.144.19 port 33548 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 17:01:29 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<nPN4SI5H2OdA46ZK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.221.122
country_id: 3144096
description:
2026-01-04 17:02:18 dovecot_login authenticator failed for H=([178.232.221.122]) [178.232.221.122]:56658: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 85.208.253.156
country_id: 130758
description:
Jan  4 17:03:11 host2 sshd[3278317]: Disconnected from invalid user vincent 85.208.253.156 port 48012 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.143.238.207
country_id: 1819730
description:
Jan  4 17:09:13 host2 sshd[3285785]: Disconnected from invalid user claude 103.143.238.207 port 35512 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.78
country_id: 6252001
description:
Jan  4 17:09:21 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=195.184.76.78, lip=66.85.158.91, TLS: Connection closed, session=<hlbDZI5HZ6HDuExO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.74
country_id: 6252001
description:
Jan  4 17:09:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=195.184.76.74, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<MCh9ZY5HX4/DuExK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.157
country_id: 6252001
description:
Jan  4 17:09:36 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.157, lip=66.85.158.91, TLS: Connection closed, session=<VBWsZY5HJ+XDuEyd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.79
country_id: 6252001
description:
Jan  4 17:09:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.79, lip=66.85.158.91, TLS handshaking: Connection closed, session=<RKwlZI5Hk63DuExP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.143.238.207
country_id: 1819730
description:
Jan  4 17:10:56 host2 sshd[3288146]: Disconnected from invalid user postgres 103.143.238.207 port 42242 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.143.238.207
country_id: 1819730
description:
Jan  4 17:12:03 host2 sshd[3289549]: Disconnected from invalid user deployer 103.143.238.207 port 37320 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 17:21:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<DbK7jo5HVOojupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 17:23:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<SQoZl45HIuBnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.195.138.52
country_id: 6252001
description:
2026-01-04 17:24:12 dovecot_plain authenticator failed for H=c-98-195-138-52.hsd1.tx.comcast.net (prolatar) [98.195.138.52]:39772: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.63
country_id: 6252001
description:
Jan  4 17:25:16 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.63, lip=66.85.158.92, TLS: Connection closed, session=<GN+mnY5H8AynXpI/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.96.233.67
country_id: 6251999
description:
2026-01-04 17:25:23 dovecot_login authenticator failed for H=208-96-233-67.resi.cgocable.ca [208.96.233.67]:54182: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.158
country_id: 1269750
description:
2026-01-04 17:25:39 dovecot_login authenticator failed for H=(nsg-corporate-185.188.186.122.airtel.in) [182.95.178.158]:49648: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 17:25:37 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<jgfOno5HWtSuijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 17:26:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<ctQgo45HZq2Oq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.140.19.22
country_id: 1269750
description:
Jan  4 17:28:01 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lezzarotech.com>, method=PLAIN, rip=103.140.19.22, lip=66.85.158.91, session=<Eb5op45HyolnjBMW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.113
country_id: 6252001
description:
Jan  4 17:34:26 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 1 secs): user=<>, rip=66.132.153.113, lip=66.85.158.91, session=<tRJ4vo5Hnq1ChJlx>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.122.87.24
country_id: 2921044
description:
Jan  4 17:34:37 host2 sshd[3319031]: Disconnected from invalid user db 134.122.87.24 port 50566 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 17:36:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<yLfMxY5H6rdA46ZK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.122.87.24
country_id: 2921044
description:
Jan  4 17:39:51 host2 sshd[3324472]: Disconnected from invalid user claude 134.122.87.24 port 60314 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 134.122.87.24
country_id: 2921044
description:
Jan  4 17:40:57 host2 sshd[3326117]: Disconnected from invalid user ghost 134.122.87.24 port 60852 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.122.87.24
country_id: 2921044
description:
Jan  4 17:41:33 host2 sshd[3326793]: Disconnected from invalid user ricoh 134.122.87.24 port 49792 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.134.235
country_id: 6252001
description:
Jan  4 17:44:04 host2 dovecot[1170291]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=71.6.134.235, lip=66.85.158.92, TLS, session=<SSPh4I5H0KpHBobr>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 17:45:51 host2 sshd[3332823]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.219
country_id: 1643084
description:
Jan  4 17:45:28 host2 sshd[3332306]: Disconnected from invalid user claude 103.171.85.219 port 37098 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.227.245.154
country_id: 690791
description:
2026-01-04 17:47:03 dovecot_login authenticator failed for H=(213-227-245-154.static.vega-ua.net) [213.227.245.154]:19501: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.171.85.219
country_id: 1643084
description:
Jan  4 17:46:19 host2 sshd[3333419]: Disconnected from invalid user username 103.171.85.219 port 52280 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.36.204
country_id: 3144096
description:
2026-01-04 17:47:21 dovecot_login authenticator failed for H=(cm-178.232.36.204.get.no) [178.232.36.204]:56741: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.219
country_id: 1643084
description:
Jan  4 17:47:23 host2 sshd[3334611]: Disconnected from invalid user claude 103.171.85.219 port 41344 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.109
country_id: 2186224
description:
2026-01-04 17:47:54 dovecot_login authenticator failed for H=([121.73.169.109]) [121.73.169.109]:33788: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.219
country_id: 1643084
description:
Jan  4 17:48:27 host2 sshd[3335707]: Disconnected from invalid user claude 103.171.85.219 port 55164 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  4 17:49:16 host2 sshd[3336578]: Disconnected from invalid user user 2.57.121.25 port 35070 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 17:54:01 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<K9tZBI9HdIMjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  4 17:54:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<CCctBY9HLIkFhXlo>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.135.112.20
country_id: 6252001
description:
Jan  4 17:56:41 host2 pure-ftpd[3346258]: (?@103.135.112.20) [INFO] New connection from 103.135.112.20


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 17:58:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<tdfiFI9HgpuOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 17:59:21 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<lNt1F49HHOCuijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 17:59:35 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<VzdDGI9HHMRnmud6>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  4 18:00:49 host2 pure-ftpd[3351022]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 18:05:42 host2 sshd[3357680]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.208.24.217
country_id: 6252001
description:
Jan  4 18:10:20 host2 sshd[3363489]: Disconnected from invalid user dmdba 172.208.24.217 port 50342 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.54.170.192
country_id: 3175395
description:
Jan  4 18:10:49 host2 sshd[3364038]: Disconnected from invalid user mostafa 156.54.170.192 port 43427 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.208.24.217
country_id: 6252001
description:
Jan  4 18:10:51 host2 sshd[3364074]: Disconnected from invalid user tejas 172.208.24.217 port 18096 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.54.170.192
country_id: 3175395
description:
Jan  4 18:11:56 host2 sshd[3365568]: Disconnected from invalid user tejas 156.54.170.192 port 55070 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.54.170.192
country_id: 3175395
description:
Jan  4 18:13:04 host2 sshd[3366943]: Disconnected from invalid user claude 156.54.170.192 port 38480 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.208.24.217
country_id: 6252001
description:
Jan  4 18:13:12 host2 sshd[3367060]: Disconnected from invalid user sshuser 172.208.24.217 port 64444 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 18:12:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<tFdXRo9HyoZA46ZK>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 13.200.128.216
country_id: 1269750
description:
Jan  4 18:12:47 host2 sshd[3366523]: Disconnected from invalid user sftpuser 13.200.128.216 port 51728 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.54.170.192
country_id: 3175395
description:
Jan  4 18:13:37 host2 sshd[3367432]: Disconnected from invalid user admin 156.54.170.192 port 44302 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.236.103
country_id: 2921044
description:
Jan  4 18:13:51 host2 sshd[3367642]: Disconnected from invalid user admin 164.92.236.103 port 55556 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 13.200.128.216
country_id: 1269750
description:
Jan  4 18:14:06 host2 sshd[3367940]: Disconnected from invalid user admin 13.200.128.216 port 60566 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 164.92.236.103
country_id: 2921044
description:
Jan  4 18:14:55 host2 sshd[3369016]: Disconnected from invalid user claude 164.92.236.103 port 57466 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.236.103
country_id: 2921044
description:
Jan  4 18:14:23 host2 sshd[3368295]: Disconnected from invalid user mostafa 164.92.236.103 port 39378 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 13.200.128.216
country_id: 1269750
description:
Jan  4 18:14:46 host2 sshd[3368769]: Disconnected from invalid user hadoop 13.200.128.216 port 53908 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.236.103
country_id: 2921044
description:
Jan  4 18:15:30 host2 sshd[3369897]: Disconnected from invalid user testuser 164.92.236.103 port 42414 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.19.168.235
country_id: 3175395
description:
Jan  4 18:16:24 host2 sshd[3370897]: Disconnected from invalid user tempuser 151.19.168.235 port 23719 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.114
country_id: 6252001
description:
Jan  4 18:16:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=713) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=66.132.153.114, lip=66.85.158.92, TLS: read(size=713) failed: Connection reset by peer, session=<0lVQVo9HArNChJly>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.184.50.251
country_id: 3686110
description:
Jan  4 18:18:27 host2 sshd[3373356]: Disconnected from invalid user clamav 201.184.50.251 port 46400 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.113.63.124
country_id: 298795
description:
Jan  4 18:18:31 host2 sshd[3373419]: Disconnected from invalid user furukawa 93.113.63.124 port 52302 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.209.166.253
country_id: 6252001
description:
Jan  4 18:18:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=134.209.166.253, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<DS0iXI9HCMqG0ab9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.158.23.150
country_id: 99237
description:
Jan  4 18:19:17 host2 sshd[3374521]: Disconnected from invalid user ubuntu 185.158.23.150 port 31701 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.59.124.195
country_id: 2658434
description:
Jan  4 18:20:00 host2 sshd[3375458]: Disconnected from invalid user user1 45.59.124.195 port 52756 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.104.136
country_id: 2750405
description:
Jan  4 18:20:31 host2 sshd[3376256]: Disconnected from invalid user joaquin 188.166.104.136 port 38766 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.59.124.195
country_id: 2658434
description:
Jan  4 18:20:33 host2 sshd[3376297]: Disconnected from invalid user ubuntu 45.59.124.195 port 41350 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.59.124.195
country_id: 2658434
description:
Jan  4 18:21:03 host2 sshd[3376828]: Disconnected from invalid user steam 45.59.124.195 port 48956 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.60.142
country_id: 1269750
description:
2026-01-04 18:21:15 dovecot_login authenticator failed for H=(nsg-corporate-142.60.186.122.airtel.in) [122.186.60.142]:59590: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.59.124.195
country_id: 2658434
description:
Jan  4 18:21:33 host2 sshd[3377356]: Disconnected from invalid user claude 45.59.124.195 port 53032 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.8.12
country_id: 614540
description:
2026-01-04 18:21:36 dovecot_login authenticator failed for H=([194.31.8.12]) [194.31.8.12]:65519: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.158.23.150
country_id: 99237
description:
Jan  4 18:21:44 host2 sshd[3377546]: Disconnected from invalid user claude 185.158.23.150 port 33200 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.158.23.150
country_id: 99237
description:
Jan  4 18:22:17 host2 sshd[3378247]: Disconnected from invalid user lek 185.158.23.150 port 9905 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.224.109.126
country_id: 6252001
description:
Jan  4 18:22:29 host2 sshd[3378482]: Disconnected from invalid user caja01 52.224.109.126 port 56198 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.19.168.235
country_id: 3175395
description:
Jan  4 18:22:47 host2 sshd[3378835]: Disconnected from invalid user claude 151.19.168.235 port 23126 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.113.63.124
country_id: 298795
description:
Jan  4 18:23:07 host2 sshd[3379237]: Disconnected from invalid user claude 93.113.63.124 port 42854 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 52.224.109.126
country_id: 6252001
description:
Jan  4 18:23:34 host2 sshd[3379670]: Disconnected from invalid user newroot 52.224.109.126 port 46684 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.113.63.124
country_id: 298795
description:
Jan  4 18:24:51 host2 sshd[3381277]: Disconnected from invalid user claude 93.113.63.124 port 55080 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.190.34.123
country_id: 6252001
description:
Jan  4 18:25:22 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=146.190.34.123, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<0XaVdI9HAOWSviJ7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.224.109.126
country_id: 6252001
description:
Jan  4 18:25:53 host2 sshd[3382735]: Disconnected from invalid user ftpuser 52.224.109.126 port 37314 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 93.113.63.124
country_id: 298795
description:
Jan  4 18:26:02 host2 sshd[3382879]: Disconnected from invalid user claude 93.113.63.124 port 34846 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.104.136
country_id: 2750405
description:
Jan  4 18:26:40 host2 sshd[3383770]: Disconnected from invalid user usuario1 188.166.104.136 port 59786 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 18:27:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<wlZte49HjDkjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.19.168.235
country_id: 3175395
description:
Jan  4 18:28:17 host2 sshd[3386204]: Disconnected from invalid user kamil 151.19.168.235 port 23053 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 188.166.104.136
country_id: 2750405
description:
Jan  4 18:29:12 host2 sshd[3387227]: Disconnected from invalid user clamav 188.166.104.136 port 44586 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 18:31:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<SXnUiY9HbumOq2dI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.173.58.47
country_id: 6252001
description:
2026-01-04 18:31:55 dovecot_plain authenticator failed for H=c-67-173-58-47.hsd1.il.comcast.net (skinon) [67.173.58.47]:43920: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.130.206
country_id: 3144096
description:
2026-01-04 18:33:06 dovecot_login authenticator failed for H=([178.232.130.206]) [178.232.130.206]:38870: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.158
country_id: 1269750
description:
2026-01-04 18:32:40 dovecot_login authenticator failed for H=(nsg-corporate-199.152.185.122.airtel.in) [182.95.178.158]:45334: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  4 18:33:17 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<AujQkI9HBuYFhXlo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.9.243
country_id: 2635167
description:
Jan  4 18:33:27 host2 sshd[3392382]: Disconnected from invalid user vadim 185.196.9.243 port 50602 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.82
country_id: 1269750
description:
2026-01-04 18:33:44 dovecot_login authenticator failed for H=([182.95.61.82]) [182.95.61.82]:33336: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 18:34:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<mkVgk49HXuiuijvy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.169.171.169
country_id: 6252001
description:
2026-01-04 18:34:06 dovecot_login authenticator failed for H=([69.169.171.169]) [69.169.171.169]:51000: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 140.238.186.185
country_id: 3469034
description:
Jan  4 18:36:55 host2 sshd[3396635]: Disconnected from invalid user erpnext 140.238.186.185 port 49204 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.9.243
country_id: 2635167
description:
Jan  4 18:38:26 host2 sshd[3398031]: Disconnected from invalid user claude 185.196.9.243 port 50194 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 18:38:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<isYXpI9HJJFnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.210.103.210
country_id: 3017382
description:
Jan  4 18:39:47 host2 sshd[3399238]: Disconnected from invalid user newuser 51.210.103.210 port 23258 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.196.9.243
country_id: 2635167
description:
Jan  4 18:39:27 host2 sshd[3398886]: Disconnected from invalid user ubuntu 185.196.9.243 port 35688 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.11.64.145
country_id: 241170
description:
Jan  4 18:39:40 host2 sshd[3399110]: Disconnected from invalid user ceo 212.11.64.145 port 49148 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.174.210.161
country_id: 2661886
description:
Jan  4 18:40:18 host2 sshd[3399844]: Disconnected from invalid user angela 158.174.210.161 port 4234 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.169.4.104
country_id: 2635167
description:
Jan  4 18:40:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=185.169.4.104, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<CCThqo9HJf+5qQRo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.11.64.145
country_id: 241170
description:
Jan  4 18:40:47 host2 sshd[3400505]: Disconnected from invalid user claude 212.11.64.145 port 49356 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 79.6.181.195
country_id: 3175395
description:
Jan  4 18:41:40 host2 sshd[3401417]: Disconnected from invalid user devuser 79.6.181.195 port 58134 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.169.4.104
country_id: 2635167
description:
Jan  4 18:41:51 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=185.169.4.104, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<uwmJr49HUf25qQRo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-04 18:41:17 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:55069: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.174.210.161
country_id: 2661886
description:
Jan  4 18:41:40 host2 sshd[3401413]: Disconnected from invalid user claude 158.174.210.161 port 13679 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.6.181.195
country_id: 3175395
description:
Jan  4 18:42:23 host2 sshd[3402186]: Disconnected from invalid user claude 79.6.181.195 port 48304 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.174.210.161
country_id: 2661886
description:
Jan  4 18:42:58 host2 sshd[3402796]: Disconnected from invalid user artem 158.174.210.161 port 58115 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.210.103.210
country_id: 3017382
description:
Jan  4 18:43:58 host2 sshd[3403810]: Disconnected from invalid user support 51.210.103.210 port 52144 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.202
country_id: 3469034
description:
Jan  4 18:44:06 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=187.120.72.202, lip=66.85.158.91, TLS, session=<dNBzto9HFJq7eEjK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.174.210.161
country_id: 2661886
description:
Jan  4 18:43:38 host2 sshd[3403458]: Disconnected from invalid user vlad 158.174.210.161 port 11259 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.199.117.9
country_id: 6252001
description:
Jan  4 18:44:44 host2 sshd[3404484]: Disconnected from invalid user system 24.199.117.9 port 44488 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.131.116
country_id: 690791
description:
Jan  4 18:44:26 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw>, method=PLAIN, rip=37.221.131.116, lip=66.85.158.91, TLS, session=<Z3i+t49HfIYl3YN0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.210.103.210
country_id: 3017382
description:
Jan  4 18:44:30 host2 sshd[3404279]: Disconnected from invalid user ubuntu 51.210.103.210 port 29382 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 24.199.117.9
country_id: 6252001
description:
Jan  4 18:45:22 host2 sshd[3405365]: Disconnected from invalid user admin 24.199.117.9 port 38932 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.210.103.210
country_id: 3017382
description:
Jan  4 18:45:32 host2 sshd[3405585]: Disconnected from invalid user test 51.210.103.210 port 63248 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.199.117.9
country_id: 6252001
description:
Jan  4 18:46:33 host2 sshd[3407262]: Disconnected from invalid user vnc 24.199.117.9 port 39136 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 18:49:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<N49lyY9Hmq1A46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 212.104.231.204
country_id: 1227603
description:
Jan  4 18:49:25 host2 dovecot[1170291]: pop3-login: Disconnected: Aborted login by logging out (auth failed, 1 attempts in 3 secs): user=<chamath.chamupathi@saara.lk>, method=PLAIN, rip=212.104.231.204, lip=66.85.158.91, TLS, session=<CK11yo9H/MDUaOfM>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 140.238.186.185
country_id: 3469034
description:
Jan  4 18:50:41 host2 sshd[3411578]: Disconnected from invalid user kamil 140.238.186.185 port 49020 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-04 18:55:30 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (czemipled) [87.103.126.54]:50351: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.168.194.41
country_id: 1269750
description:
Jan  4 18:55:33 host2 sshd[3416873]: Disconnected from invalid user claude 122.168.194.41 port 49048 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.44.173.68
country_id: 3175395
description:
Jan  4 18:55:43 host2 sshd[3417023]: Disconnected from invalid user claude 151.44.173.68 port 3795 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.155.223.9
country_id: 1605651
description:
Jan  4 18:55:45 host2 sshd[3416934]: Disconnected from invalid user claude 122.155.223.9 port 24168 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.230.228.16
country_id: 6252001
description:
2026-01-04 18:57:00 dovecot_plain authenticator failed for H=c-71-230-228-16.hsd1.de.comcast.net (trasceake) [71.230.228.16]:49448: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.28.190.247
country_id: 2510769
description:
Jan  4 18:57:51 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=139.28.190.247, lip=66.85.158.91, TLS, session=<bQWO549Hfs2LHL73>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.36.202.157
country_id: 3469034
description:
Jan  4 18:58:11 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=138.36.202.157, lip=66.85.158.91, TLS, session=<5m3i6I9Hc6CKJMqd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.125.150
country_id: 6252001
description:
Jan  4 18:57:17 host2 sshd[3418327]: Disconnected from invalid user claude 205.185.125.150 port 52430 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 31.14.114.105
country_id: 130758
description:
Jan  4 18:58:49 host2 sshd[3420443]: Disconnected from invalid user developer 31.14.114.105 port 33302 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.168.194.41
country_id: 1269750
description:
Jan  4 18:59:35 host2 sshd[3421231]: Disconnected from invalid user claude 122.168.194.41 port 42246 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 19:00:47 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<l2kp849HJqMjupN+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.168.194.41
country_id: 1269750
description:
Jan  4 19:00:19 host2 sshd[3422229]: Disconnected from invalid user admin 122.168.194.41 port 60144 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.125.150
country_id: 6252001
description:
Jan  4 19:00:31 host2 sshd[3422411]: Disconnected from invalid user claude 205.185.125.150 port 54032 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 148.113.24.68
country_id: 1269750
description:
Jan  4 19:01:23 host2 sshd[3423325]: Disconnected from invalid user xiaoli 148.113.24.68 port 59648 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.155.223.9
country_id: 1605651
description:
Jan  4 19:02:35 host2 sshd[3424472]: Disconnected from invalid user elasticuser 122.155.223.9 port 30558 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2026-01-04 19:02:14 dovecot_plain authenticator failed for H=(matic) [94.201.22.158]:50734: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.125.150
country_id: 6252001
description:
Jan  4 19:03:36 host2 sshd[3425490]: Disconnected from invalid user ubuntu 205.185.125.150 port 55640 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.44.173.68
country_id: 3175395
description:
Jan  4 19:03:52 host2 sshd[3425749]: Disconnected from invalid user claude 151.44.173.68 port 3028 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 19:03:56 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<n4Np/o9HHo6Oq2dI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.237.94.18
country_id: 6252001
description:
Jan  4 19:03:19 host2 sshd[3425233]: Disconnected from invalid user copia 35.237.94.18 port 39012 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.237.94.18
country_id: 6252001
description:
Jan  4 19:04:13 host2 sshd[3426295]: Disconnected from invalid user claude 35.237.94.18 port 54424 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.44.173.68
country_id: 3175395
description:
Jan  4 19:04:49 host2 sshd[3426901]: Disconnected from invalid user ubuntu 151.44.173.68 port 3204 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.174.115.196
country_id: 1643084
description:
Jan  4 19:05:56 host2 sshd[3428242]: Disconnected from invalid user ftp_admin 103.174.115.196 port 33674 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.237.94.18
country_id: 6252001
description:
Jan  4 19:06:04 host2 sshd[3428455]: Disconnected from invalid user steam 35.237.94.18 port 38168 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.86
country_id: 1269750
description:
2026-01-04 19:06:11 dovecot_login authenticator failed for H=([125.17.17.201]) [27.123.113.86]:60636: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2026-01-04 19:05:28 dovecot_plain authenticator failed for H=c-24-127-53-61.hsd1.mi.comcast.net (mintations) [24.127.53.61]:49406: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.237.94.18
country_id: 6252001
description:
Jan  4 19:05:30 host2 sshd[3427907]: Disconnected from invalid user ubuntu 35.237.94.18 port 53006 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 31.14.114.105
country_id: 130758
description:
Jan  4 19:05:38 host2 sshd[3428041]: Disconnected from invalid user claude 31.14.114.105 port 53214 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.32.75.127
country_id: 3585968
description:
2026-01-04 19:07:13 dovecot_login authenticator failed for H=([186.32.75.127]) [186.32.75.127]:59541: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.174.115.196
country_id: 1643084
description:
Jan  4 19:06:40 host2 sshd[3428904]: Disconnected from invalid user claude 103.174.115.196 port 51432 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.130.95
country_id: 99237
description:
2026-01-04 19:07:34 dovecot_login authenticator failed for H=([65.20.130.95]) [65.20.130.95]:55961: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.204.15
country_id: 1643084
description:
Jan  4 19:07:46 host2 sshd[3429903]: Disconnected from invalid user mcserver 103.172.204.15 port 56838 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 148.113.24.68
country_id: 1269750
description:
Jan  4 19:07:55 host2 sshd[3430082]: Disconnected from invalid user logviewer 148.113.24.68 port 44960 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  4 19:07:27 host2 pure-ftpd[3429742]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 19:08:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<ebWDD5BHhoWuijvy>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 148.113.24.68
country_id: 1269750
description:
Jan  4 19:09:50 host2 sshd[3432328]: Disconnected from invalid user claude 148.113.24.68 port 50618 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.68.71.16
country_id: 2921044
description:
Jan  4 19:10:04 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=138.68.71.16, lip=66.85.158.92, TLS, session=<rKd6FJBHqCiKREcQ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 148.113.24.68
country_id: 1269750
description:
Jan  4 19:10:31 host2 sshd[3433440]: Disconnected from invalid user elsearch 148.113.24.68 port 32898 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.204.15
country_id: 1643084
description:
Jan  4 19:11:44 host2 sshd[3434586]: Disconnected from invalid user admin 103.172.204.15 port 53838 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  4 19:15:42 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: Connection closed, session=<4eiaKJBHQrcDgmBb>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 161.118.215.229
country_id: 1880251
description:
Jan  4 19:15:21 host2 pure-ftpd[3439170]: (?@161.118.215.229) [INFO] New connection from 161.118.215.229


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 161.118.215.229
country_id: 1880251
description:
Jan  4 19:15:25 host2 pure-ftpd[3439280]: (?@161.118.215.229) [INFO] New connection from 161.118.215.229


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.140.19.22
country_id: 1269750
description:
Jan  4 19:16:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<info@gemtrails.com>, method=PLAIN, rip=103.140.19.22, lip=66.85.158.91, session=<yysQLJBHPN1njBMW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 19:16:49 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<vel6LJBH3NNnmud6>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 161.118.215.229
country_id: 1880251
description:
Jan  4 19:16:13 host2 pure-ftpd[3440304]: (?@161.118.215.229) [INFO] New connection from 161.118.215.229


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 161.118.215.229
country_id: 1880251
description:
Jan  4 19:16:14 host2 pure-ftpd[3440316]: (?@161.118.215.229) [INFO] New connection from 161.118.215.229


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.139.157
country_id: 1269750
description:
Jan  4 19:17:57 host2 sshd[3442207]: Disconnected from invalid user user5 64.227.139.157 port 39246 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.172.204.15
country_id: 1643084
description:
Jan  4 19:18:42 host2 sshd[3442860]: Disconnected from invalid user claude 103.172.204.15 port 59404 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  4 19:19:05 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<X9m7NJBH3rADgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  4 19:20:02 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS, session=<bbAcOJBHepgDgmBb>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.145.145.75
country_id: 1819730
description:
Jan  4 19:20:27 host2 sshd[3445262]: Disconnected from invalid user debian 103.145.145.75 port 40126 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.139.157
country_id: 1269750
description:
Jan  4 19:20:44 host2 sshd[3445555]: Disconnected from invalid user user 64.227.139.157 port 38240 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  4 19:21:24 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: Connection closed, session=<6fAEPZBHXIEDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.139.157
country_id: 1269750
description:
Jan  4 19:21:28 host2 sshd[3446341]: Disconnected from invalid user deploy 64.227.139.157 port 34544 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.227.139.157
country_id: 1269750
description:
Jan  4 19:22:52 host2 sshd[3447596]: Disconnected from invalid user testuser 64.227.139.157 port 54916 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  4 19:22:48 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<NlP7QZBHbpcDgmBb>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.105.224.72
country_id: 1861060
description:
Jan  4 19:24:07 host2 pure-ftpd[3448963]: (?@172.105.224.72) [INFO] New connection from 172.105.224.72


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  4 19:24:13 host2 sshd[3449011]: Disconnected from invalid user user 2.57.121.25 port 17105 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.152.61
country_id: 6252001
description:
2026-01-04 19:24:22 dovecot_login authenticator failed for H=(c-50-187-152-61.unallocated.comcastbusiness.net) [50.187.152.61]:41836: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.65.59.241
country_id: 3686110
description:
2026-01-04 19:24:36 dovecot_login authenticator failed for H=([190.65.59.241]) [190.65.59.241]:55892: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  4 19:24:43 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS, session=<G2TdSJBH0rwDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 19:25:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<WQuVS5BHCKxA46ZK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.152
country_id: 3703430
description:
Jan  4 19:25:53 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.227.254.152, lip=66.85.158.91, session=<D/8NTZBHtf8t4/6Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2026-01-04 19:29:14 dovecot_plain authenticator failed for H=c-68-60-77-128.hsd1.mi.comcast.net (fackate) [68.60.77.128]:57698: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 19:33:14 host2 sshd[3458695]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 19:34:21 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<cE4ra5BHrugjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.23.68
country_id: 3144096
description:
2026-01-04 19:35:27 dovecot_login authenticator failed for H=([178.232.23.68]) [178.232.23.68]:46149: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.50.155
country_id: 1269750
description:
2026-01-04 19:35:38 dovecot_login authenticator failed for H=(abts-north-static-155.50.160.122.airtelbroadband.in) [122.160.50.155]:35384: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 19:36:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<FFp3cpBHKuyOq2dI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.119.139
country_id: 2661886
description:
2026-01-04 19:36:37 dovecot_plain authenticator failed for H=78-66-119-139-no600.tbcn.telia.com (eines) [78.66.119.139]:48142: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2026-01-04 19:36:40 dovecot_plain authenticator failed for H=c-174-161-27-82.hsd1.tn.comcast.net (tochass) [174.161.27.82]:43579: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 19:43:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<PL1njJBHUPGuijvy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.225.176.238
country_id: 6252001
description:
Jan  4 19:46:34 host2 sshd[3475802]: Disconnected from invalid user oem 50.225.176.238 port 57406 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.93.128.179
country_id: 1269750
description:
Jan  4 19:46:56 host2 sshd[3476068]: Disconnected from invalid user es 34.93.128.179 port 44014 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.64.68.99
country_id: 1643084
description:
Jan  4 19:47:01 host2 sshd[3476150]: Disconnected from invalid user master 36.64.68.99 port 49040 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.121.76.190
country_id: 732800
description:
2026-01-04 19:47:13 dovecot_plain authenticator failed for H=(reakfic) [87.121.76.190]:40089: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2026-01-04 19:47:24 dovecot_login authenticator failed for H=([186.239.240.127]) [186.215.245.175]:40170: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.115.237.19
country_id: 3923057
description:
2026-01-04 19:47:38 dovecot_login authenticator failed for H=([181.115.237.19]) [181.115.237.19]:64842: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 50.225.176.238
country_id: 6252001
description:
Jan  4 19:48:23 host2 sshd[3477357]: Disconnected from invalid user claude 50.225.176.238 port 38524 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.93.128.179
country_id: 1269750
description:
Jan  4 19:48:55 host2 sshd[3477755]: Disconnected from invalid user claude 34.93.128.179 port 38216 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.225.176.238
country_id: 6252001
description:
Jan  4 19:49:29 host2 sshd[3478426]: Disconnected from invalid user claude 50.225.176.238 port 46430 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.64.68.99
country_id: 1643084
description:
Jan  4 19:49:46 host2 sshd[3478787]: Disconnected from invalid user pippo 36.64.68.99 port 36050 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.93.128.179
country_id: 1269750
description:
Jan  4 19:50:48 host2 sshd[3480498]: Disconnected from invalid user claude 34.93.128.179 port 52880 [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 1.32.41.192
country_id: 1733045
description:
Jan  4 19:51:24 host2 sshd[3481218]: Disconnecting authenticating user root 1.32.41.192 port 37151: Too many authentication failures [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 1.32.41.192
country_id: 1733045
description:
Jan  4 19:51:43 host2 sshd[3481624]: error: maximum authentication attempts exceeded for invalid user admin from 1.32.41.192 port 37712 ssh2 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 1.32.41.192
country_id: 1733045
description:
Jan  4 19:51:48 host2 sshd[3481722]: Disconnecting invalid user admin 1.32.41.192 port 37904: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 1.32.41.192
country_id: 1733045
description:
Jan  4 19:51:24 host2 sshd[3481218]: error: maximum authentication attempts exceeded for root from 1.32.41.192 port 37151 ssh2 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 19:53:10 host2 sshd[3482966]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.152.90
country_id: 1605651
description:
Jan  4 19:53:40 host2 sshd[3483300]: Disconnected from invalid user claude 27.254.152.90 port 57716 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.152.90
country_id: 1605651
description:
Jan  4 19:55:06 host2 sshd[3484964]: Disconnected from invalid user claude 27.254.152.90 port 56682 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 19:54:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<JbSUtJBHGMRnmud6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.107.233
country_id: 1819730
description:
Jan  4 19:55:36 host2 sshd[3485570]: Disconnected from invalid user ftpuser 101.36.107.233 port 59884 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.107.233
country_id: 1819730
description:
Jan  4 19:56:21 host2 sshd[3486143]: Disconnected from invalid user trevor 101.36.107.233 port 16456 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  4 19:56:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<82T0uZBHAM0FhXlo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.135.95
country_id: 1880251
description:
Jan  4 19:56:48 host2 sshd[3486600]: Disconnected from invalid user minecraft 101.47.135.95 port 49856 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 20:02:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<Y88PzpBHKthA46ZK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.135.95
country_id: 1880251
description:
Jan  4 20:03:06 host2 sshd[3492719]: Disconnected from invalid user ubuntu 101.47.135.95 port 57948 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.135.95
country_id: 1880251
description:
Jan  4 20:04:09 host2 sshd[3493717]: Disconnected from invalid user claude 101.47.135.95 port 48446 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.8.81
country_id: 2750405
description:
Jan  4 20:03:36 host2 sshd[3493210]: Disconnected from invalid user lex 159.223.8.81 port 42534 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 142.93.212.130
country_id: 1269750
description:
Jan  4 20:03:59 host2 sshd[3493543]: Disconnected from invalid user tezos 142.93.212.130 port 41738 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 77.87.40.114
country_id: 690791
description:
Jan  4 20:04:43 host2 sshd[3494218]: Disconnected from invalid user yuri 77.87.40.114 port 40140 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.135.95
country_id: 1880251
description:
Jan  4 20:06:11 host2 sshd[3495875]: Disconnected from invalid user claude 101.47.135.95 port 55566 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 77.87.40.114
country_id: 690791
description:
Jan  4 20:06:33 host2 sshd[3496261]: Disconnected from invalid user claude 77.87.40.114 port 43014 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.231.192
country_id: 1880251
description:
Jan  4 20:07:34 host2 sshd[3497318]: Disconnected from invalid user joe 45.78.231.192 port 46122 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 77.87.40.114
country_id: 690791
description:
Jan  4 20:07:39 host2 sshd[3497394]: Disconnected from invalid user joe 77.87.40.114 port 38400 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 20:08:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<rtDb5JBH6msjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 77.87.40.114
country_id: 690791
description:
Jan  4 20:08:43 host2 sshd[3498553]: Disconnected from invalid user claude 77.87.40.114 port 33774 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 96.77.54.153
country_id: 6252001
description:
Jan  4 20:09:54 host2 sshd[3499873]: Disconnected from invalid user joe 96.77.54.153 port 35304 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Jan  4 20:10:05 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<eBny6pBHxIEFhH+s>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.135.95
country_id: 1880251
description:
Jan  4 20:09:15 host2 sshd[3498963]: Disconnected from invalid user ali 101.47.135.95 port 50246 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 20:09:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<PAdo6JBH3NSOq2dI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 96.77.54.153
country_id: 6252001
description:
Jan  4 20:10:33 host2 sshd[3500951]: Disconnected from invalid user ansible 96.77.54.153 port 47802 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 142.93.212.130
country_id: 1269750
description:
Jan  4 20:10:51 host2 sshd[3501338]: Disconnected from invalid user claude 142.93.212.130 port 56182 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.8.81
country_id: 2750405
description:
Jan  4 20:11:07 host2 sshd[3501751]: Disconnected from invalid user test 159.223.8.81 port 33752 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 96.77.54.153
country_id: 6252001
description:
Jan  4 20:11:15 host2 sshd[3501891]: Disconnected from invalid user uploader 96.77.54.153 port 59346 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 142.93.212.130
country_id: 1269750
description:
Jan  4 20:12:11 host2 sshd[3502876]: Disconnected from invalid user tech 142.93.212.130 port 35678 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.23.180.137
country_id: 6252001
description:
Jan  4 20:14:24 host2 sshd[3505566]: Disconnected from invalid user minecraft 64.23.180.137 port 53210 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.216.177.55
country_id: 1643084
description:
Jan  4 20:15:23 host2 sshd[3506888]: Disconnected from invalid user saeid 41.216.177.55 port 55002 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.223.40.77
country_id: 3351879
description:
Jan  4 20:15:40 host2 sshd[3507524]: Disconnected from invalid user steam 41.223.40.77 port 56242 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.231.192
country_id: 1880251
description:
Jan  4 20:16:39 host2 sshd[3508583]: Disconnected from invalid user serv 45.78.231.192 port 52982 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.0.212.86
country_id: 3469034
description:
Jan  4 20:16:24 host2 sshd[3508333]: Disconnected from invalid user jagdish 177.0.212.86 port 37896 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.39.20.135
country_id: 6251999
description:
Jan  4 20:17:56 host2 sshd[3510604]: Disconnected from invalid user john 54.39.20.135 port 57734 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.95.157.171
country_id: 1861060
description:
Jan  4 20:17:23 host2 sshd[3509894]: Disconnected from invalid user odoo 150.95.157.171 port 37738 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.0.212.86
country_id: 3469034
description:
Jan  4 20:17:45 host2 sshd[3510384]: Disconnected from invalid user ubuntu 177.0.212.86 port 39508 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.95.157.171
country_id: 1861060
description:
Jan  4 20:18:44 host2 sshd[3511545]: Disconnected from invalid user admin1 150.95.157.171 port 60638 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 20:18:49 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<dPs6CpFHzDCuijvy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.0.212.86
country_id: 3469034
description:
Jan  4 20:19:04 host2 sshd[3512026]: Disconnected from invalid user yaya 177.0.212.86 port 37855 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.131.135.89
country_id: 2750405
description:
Jan  4 20:18:34 host2 sshd[3511373]: Disconnected from invalid user mcserver 45.131.135.89 port 46444 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.23.180.137
country_id: 6252001
description:
Jan  4 20:19:27 host2 sshd[3512432]: Disconnected from invalid user roots 64.23.180.137 port 56800 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.216.177.55
country_id: 1643084
description:
Jan  4 20:19:38 host2 sshd[3512590]: Disconnected from invalid user deploy 41.216.177.55 port 41480 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.213.129
country_id: 6251999
description:
Jan  4 20:19:41 host2 sshd[3512663]: Disconnected from invalid user claude 158.69.213.129 port 41336 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.223.40.77
country_id: 3351879
description:
Jan  4 20:19:50 host2 sshd[3512819]: Disconnected from invalid user ubuntu 41.223.40.77 port 59702 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.70.65.229
country_id: 1282988
description:
Jan  4 20:20:58 host2 sshd[3514234]: Disconnected from invalid user claude 202.70.65.229 port 40038 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.213.129
country_id: 6251999
description:
Jan  4 20:20:17 host2 sshd[3513616]: Disconnected from invalid user bitrix 158.69.213.129 port 34496 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.223.40.77
country_id: 3351879
description:
Jan  4 20:20:30 host2 sshd[3513815]: Disconnected from invalid user gao 41.223.40.77 port 38658 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.140.19.22
country_id: 1269750
description:
Jan  4 20:20:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=103.140.19.22, lip=66.85.158.91, session=<OOxiEJFHvMBnjBMW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.23.180.137
country_id: 6252001
description:
Jan  4 20:21:18 host2 sshd[3514586]: Disconnected from invalid user sol 64.23.180.137 port 37592 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 158.69.213.129
country_id: 6251999
description:
Jan  4 20:21:21 host2 sshd[3514626]: Disconnected from invalid user sol 158.69.213.129 port 46062 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.39.20.135
country_id: 6251999
description:
Jan  4 20:22:49 host2 sshd[3516167]: Disconnected from invalid user claude 54.39.20.135 port 32968 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.131.135.89
country_id: 2750405
description:
Jan  4 20:22:10 host2 sshd[3515470]: Disconnected from invalid user claude 45.131.135.89 port 57494 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.216.177.55
country_id: 1643084
description:
Jan  4 20:22:22 host2 sshd[3515666]: Disconnected from invalid user yujie 41.216.177.55 port 49618 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.23.180.137
country_id: 6252001
description:
Jan  4 20:22:24 host2 sshd[3515731]: Disconnected from invalid user ftpuser 64.23.180.137 port 36360 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.70.65.229
country_id: 1282988
description:
Jan  4 20:23:34 host2 sshd[3516950]: Disconnected from invalid user paul 202.70.65.229 port 53780 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.131.135.89
country_id: 2750405
description:
Jan  4 20:23:09 host2 sshd[3516599]: Disconnected from invalid user ubuntu 45.131.135.89 port 48656 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.70.65.229
country_id: 1282988
description:
Jan  4 20:24:17 host2 sshd[3517735]: Disconnected from invalid user spotlight 202.70.65.229 port 38776 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 174.138.87.242
country_id: 6252001
description:
Jan  4 20:24:29 host2 sshd[3517973]: Disconnected from invalid user sdtdserver 174.138.87.242 port 57184 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.216.20.24
country_id: 3469034
description:
Jan  4 20:25:04 host2 sshd[3518590]: Disconnected from invalid user claude 179.216.20.24 port 32462 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 174.138.87.242
country_id: 6252001
description:
Jan  4 20:25:42 host2 sshd[3519359]: Disconnected from invalid user amsftp 174.138.87.242 port 39372 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.131.135.89
country_id: 2750405
description:
Jan  4 20:26:10 host2 sshd[3519832]: Disconnected from invalid user claude 45.131.135.89 port 53700 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 174.138.87.242
country_id: 6252001
description:
Jan  4 20:26:22 host2 sshd[3520037]: Disconnected from invalid user claude 174.138.87.242 port 57520 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.159.248
country_id: 6252001
description:
Jan  4 20:26:55 host2 sshd[3520475]: Disconnected from invalid user claude 107.175.159.248 port 39576 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.204.152
country_id: 1643084
description:
Jan  4 20:28:24 host2 sshd[3521804]: Disconnected from invalid user claude 103.172.204.152 port 42856 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.131.135.89
country_id: 2750405
description:
Jan  4 20:28:41 host2 sshd[3522196]: Disconnected from invalid user ftpuser 45.131.135.89 port 58830 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.216.20.24
country_id: 3469034
description:
Jan  4 20:30:18 host2 sshd[3524218]: Disconnected from invalid user wanghao 179.216.20.24 port 34856 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.0.212.86
country_id: 3469034
description:
Jan  4 20:32:17 host2 sshd[3526110]: Disconnected from invalid user ftpuser 177.0.212.86 port 40775 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 20:32:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<NnLaOpFHJptnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.216.20.24
country_id: 3469034
description:
Jan  4 20:34:15 host2 sshd[3528066]: Disconnected from invalid user claude 179.216.20.24 port 34914 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.175.159.248
country_id: 6252001
description:
Jan  4 20:37:04 host2 sshd[3531483]: Disconnected from invalid user rw 107.175.159.248 port 39992 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 20:38:41 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<qhZFUZFHxOFA46ZK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.185.243.158
country_id: 6252001
description:
Jan  4 20:42:15 host2 sshd[3538260]: Disconnected from invalid user carl 20.185.243.158 port 39104 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 20:42:37 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<vY5IX5FHUrGOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 20:42:36 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<Z2NHX5FHcGQjupN+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.185.243.158
country_id: 6252001
description:
Jan  4 20:42:51 host2 sshd[3538855]: Disconnected from invalid user db2inst 20.185.243.158 port 33368 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.185.243.158
country_id: 6252001
description:
Jan  4 20:43:24 host2 sshd[3539530]: Disconnected from invalid user storage 20.185.243.158 port 43826 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.198.40.225
country_id: 241170
description:
Jan  4 20:43:40 host2 sshd[3539745]: Disconnected from invalid user elasticsearch 154.198.40.225 port 38894 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  4 20:46:10 host2 sshd[3542831]: Disconnected from invalid user user 2.57.121.25 port 19697 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.234.138.43
country_id: 690791
description:
Jan  4 20:46:33 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=91.234.138.43, lip=66.85.158.91, TLS, session=<I95qbJFH2Yxb6oor>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.243.150
country_id: 798544
description:
Jan  4 20:46:52 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=109.125.243.150, lip=66.85.158.91, TLS, session=<OtmYbZFHPKZtffOW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2026-01-04 20:49:46 dovecot_plain authenticator failed for H=(soxonmen) [176.113.155.132]:53353: 535 Incorrect authentication data (set_id=sales@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.0.32.181
country_id: 298795
description:
Jan  4 20:50:01 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=95.0.32.181, lip=66.85.158.91, TLS, session=<iVvZeJFHp6tfACC1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.172.11.140
country_id: 1269750
description:
Jan  4 20:50:05 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=103.172.11.140, lip=66.85.158.91, TLS, session=<uYLkeJFHDqxnrAuM>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.198.40.225
country_id: 241170
description:
Jan  4 20:50:37 host2 sshd[3547713]: Disconnected from invalid user setup 154.198.40.225 port 57146 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.129.206.42
country_id: 3469034
description:
Jan  4 20:50:22 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<hr>, method=PLAIN, rip=177.129.206.42, lip=66.85.158.91, TLS, session=<GL0RepFHPcKxgc4q>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.1.216.16
country_id: 3865483
description:
Jan  4 20:50:25 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<hr>, method=PLAIN, rip=186.1.216.16, lip=66.85.158.91, TLS, session=<spxEepFH24i6AdgQ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.198.40.225
country_id: 241170
description:
Jan  4 20:51:47 host2 sshd[3549078]: Disconnected from invalid user user100 154.198.40.225 port 33544 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.25.232.7
country_id: 953987
description:
Jan  4 20:52:36 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<amila@euroentertainmentlk.com>, method=PLAIN, rip=41.25.232.7, lip=66.85.158.91, session=<TgYIg5FH38IpGegH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 20:54:02 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<s0otiJFHLJuuijvy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.203.138
country_id: 1269750
description:
2026-01-04 20:55:54 dovecot_login authenticator failed for H=(nsg-corporate-201.0.185.122.airtel.in) [125.23.203.138]:36208: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2026-01-04 20:55:43 dovecot_plain authenticator failed for H=c-73-137-7-97.hsd1.ga.comcast.net (varupred) [73.137.7.97]:60836: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.205
country_id: 337996
description:
2026-01-04 20:56:14 dovecot_login authenticator failed for H=([196.188.187.205]) [196.188.187.205]:33128: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 21:05:19 host2 sshd[3565411]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.224.171.101
country_id: 6252001
description:
2026-01-04 21:08:42 dovecot_plain authenticator failed for H=c-73-224-171-101.hsd1.fl.comcast.net (nonize) [73.224.171.101]:47658: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 21:10:39 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<OGaZw5FHfrpnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2026-01-04 21:13:45 dovecot_plain authenticator failed for H=c-73-13-220-220.hsd1.de.comcast.net (unsamately) [73.13.220.220]:53488: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 21:14:35 host2 sshd[3575973]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 21:15:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<R8zJ05FHTNJA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 21:15:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<bFNX1pFHfM+Oq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 21:16:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<YrE/15FHkOMjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.255.223.75
country_id: 1880251
description:
Jan  4 21:17:09 host2 sshd[3578543]: Disconnected from invalid user ftpuser1 36.255.223.75 port 32450 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.255.223.75
country_id: 1880251
description:
Jan  4 21:18:54 host2 sshd[3580518]: Disconnected from invalid user ramesh 36.255.223.75 port 56424 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  4 21:19:21 host2 pure-ftpd[3581027]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.255.223.75
country_id: 1880251
description:
Jan  4 21:19:30 host2 sshd[3581157]: Disconnected from invalid user cristina 36.255.223.75 port 13472 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.255.223.75
country_id: 1880251
description:
Jan  4 21:21:19 host2 sshd[3583521]: Disconnected from invalid user claude 36.255.223.75 port 49608 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.206.160
country_id: 6252001
description:
Jan  4 21:22:34 host2 sshd[3584951]: Disconnected from invalid user spark 152.32.206.160 port 52658 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.206.160
country_id: 6252001
description:
Jan  4 21:23:10 host2 sshd[3585631]: Disconnected from invalid user smbguest 152.32.206.160 port 35234 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.206.160
country_id: 6252001
description:
Jan  4 21:24:27 host2 sshd[3587269]: Disconnected from invalid user fauzi 152.32.206.160 port 56080 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 21:25:12 host2 sshd[3588207]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 21:29:14 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<zCcJBpJHtnuuijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.60.212.126
country_id: 3175395
description:
Jan  4 21:30:43 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=194.60.212.126, lip=66.85.158.91, TLS, session=<4qx8CpJHZaDCPNR+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.85.107.170
country_id: 3469034
description:
Jan  4 21:31:04 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<charanaw>, method=PLAIN, rip=187.85.107.170, lip=66.85.158.91, TLS, session=<x6OdC5JHsou7VWuq>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.135.112.20
country_id: 6252001
description:
Jan  4 21:36:18 host2 pure-ftpd[3600889]: (?@103.135.112.20) [INFO] New connection from 103.135.112.20


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.94.146.61
country_id: 6252001
description:
Jan  4 21:40:51 host2 pure-ftpd[3605296]: (?@167.94.146.61) [INFO] New connection from 167.94.146.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.92.66.188
country_id: 6251999
description:
2026-01-04 21:46:47 dovecot_login authenticator failed for H=([147.92.66.188]) [147.92.66.188]:48438: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.219.80
country_id: 3144096
description:
2026-01-04 21:47:05 dovecot_login authenticator failed for H=(cm-84.210.219.80.get.no) [84.210.219.80]:60488: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 21:48:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<qR6tSZJHiIRnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 21:48:56 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<gwp+TJJHcKaOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 21:49:58 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<Ex8qUJJHtK4jupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.144
country_id: 1269750
description:
2026-01-04 21:50:56 dovecot_login authenticator failed for H=(nsg-corporate-144.230.187.122.airtel.in) [122.187.230.144]:52001: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.170.59
country_id: 99237
description:
2026-01-04 21:50:26 dovecot_login authenticator failed for H=([65.20.170.59]) [65.20.170.59]:59504: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 21:51:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<SWudVJJH1M1A46ZK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-04 21:53:07 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (asswale) [87.103.126.54]:46486: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  4 21:57:48 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<G54wbJJHfqgFhXlo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.98.45.238
country_id: 6252001
description:
2026-01-04 21:59:48 dovecot_plain authenticator failed for H=c-24-98-45-238.hsd1.ga.comcast.net (apsans) [24.98.45.238]:44584: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.40.48.59
country_id: 2635167
description:
[2026-01-04 21:59:15 +0530] info [webmaild] 149.40.48.59 - washeera@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.16.55.198
country_id: 6252001
description:
[2026-01-04 22:00:39 +0530] info [webmaild] 178.16.55.198 - 587hr@lezzarotech.com "GET /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-04 22:04:01 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:54585: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 22:04:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<nXiGg5JHsuGuijvy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.4
country_id: 798549
description:
Jan  4 22:08:11 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=85.217.140.4, lip=66.85.158.91, session=<6mdvkZJHoKBV2YwE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.248.19.102
country_id: 1269750
description:
2026-01-04 22:20:08 dovecot_login authenticator failed for H=([218.248.19.102]) [218.248.19.102]:60572: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 178.128.242.174
country_id: 2750405
description:
Jan  4 22:21:18 host2 pure-ftpd[3666255]: (?@178.128.242.174) [INFO] New connection from 178.128.242.174


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 22:21:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<xzMtwpJHGMuOq2dI>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.64.105.169
country_id: 6252001
description:
Jan  4 22:23:17 host2 pure-ftpd[3668938]: (?@20.64.105.169) [INFO] New connection from 20.64.105.169


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 22:23:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<26dHyZJH4jMjupN+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  4 22:24:44 host2 pure-ftpd[3670480]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 22:26:58 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<kfln1JJHptVnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 22:27:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<nUIg1pJHDL5A46ZK>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 22:29:32 host2 sshd[3676324]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.196.9.141
country_id: 2635167
description:
Jan  4 22:30:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=185.196.9.141, lip=66.85.158.91, session=<umIz4ZJHspa5xAmN>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.70
country_id: 6252001
description:
Jan  4 22:32:27 host2 pure-ftpd[3679336]: (?@198.235.24.70) [INFO] New connection from 198.235.24.70


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 22:38:32 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<iFrl/ZJHJMauijvy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.235.64.126
country_id: 1269750
description:
2026-01-04 22:41:07 dovecot_login authenticator failed for H=([223.235.64.126]) [223.235.64.126]:54127: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.108
country_id: 6252001
description:
Jan  4 22:40:27 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.108, lip=66.85.158.92, TLS handshaking: Connection closed, session=<JIjeBJNHpG9BMQFs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.247.239.202
country_id: 1269750
description:
2026-01-04 22:40:47 dovecot_login authenticator failed for H=(abts-north-static-194.142.160.122.airtelbroadband.in) [117.247.239.202]:47174: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.217.120
country_id: 6252001
description:
Jan  4 22:46:26 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.65.217.120, lip=66.85.158.91, session=<PAZBGpNHEIIUQdl4>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.136.113.72
country_id: 2264397
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 193.136.113.72 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 22:52:07 host2 sshd[3700757]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 51.83.164.92
country_id: 3017382
description:
Jan  4 22:51:41 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=51.83.164.92, lip=66.85.158.91, session=<MhsKLZNHquUzU6Rc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 22:55:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<kjO+OJNHSsuOq2dI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2026-01-04 22:55:54 dovecot_plain authenticator failed for H=(fitize) [102.53.15.180]:51883: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  4 22:56:47 host2 sshd[3705953]: Disconnected from invalid user admin 2.57.121.112 port 26187 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 22:57:49 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<XmfdQpNHMFIjupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.171.28.177
country_id: 6252001
description:
Jan  4 22:58:09 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.171.28.177, lip=66.85.158.92, session=<iC8vRJNHqLIUqxyx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.190.40
country_id: 2542007
description:
2026-01-04 23:01:15 dovecot_plain authenticator failed for H=(bacal) [105.73.190.40]:36552: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 23:03:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<AT4RWJNHKKVA46ZK>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.104
country_id: 6252001
description:
Jan  4 23:06:01 host2 pure-ftpd[3715754]: (?@198.235.24.104) [INFO] New connection from 198.235.24.104


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 23:06:32 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<lsH9YZNHXN5nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.154
country_id: 3865483
description:
Jan  4 23:06:36 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=179.0.250.154, lip=66.85.158.91, TLS, session=<oQ03YZNHOcOzAPqa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.146.167
country_id: 99237
description:
Jan  4 23:06:54 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<charanaw>, method=PLAIN, rip=65.20.146.167, lip=66.85.158.91, TLS, session=<wDFyYpNHZ+lBFJKn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-04 23:08:44 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (unwei) [87.103.126.54]:49761: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.229.6
country_id: 149590
description:
2026-01-04 23:10:58 dovecot_login authenticator failed for H=([41.59.229.6]) [41.59.229.6]:33474: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 23:11:51 host2 sshd[3722174]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.216.66
country_id: 1269750
description:
2026-01-04 23:11:59 dovecot_login authenticator failed for H=([182.66.234.193]) [125.19.216.66]:53320: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.27.76.210
country_id: 3469034
description:
2026-01-04 23:12:17 dovecot_login authenticator failed for H=([187.8.89.120]) [177.27.76.210]:32807: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 23:12:32 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<oNR9d5NHzDKuijvy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.113
country_id: 6252001
description:
Jan  4 23:16:08 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 14 secs): user=<>, rip=162.216.150.113, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<gHNyhJNHrMui2JZx>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.113
country_id: 6252001
description:
Jan  4 23:17:49 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=162.216.150.113, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=</3h6ipNHiOCi2JZx>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.181.104
country_id: 6252001
description:
Jan  4 23:19:40 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 1 secs): user=<>, rip=45.79.181.104, lip=66.85.158.91, session=<8J0UkZNHwJwtT7Vo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.105.128.12
country_id: 6252001
description:
Jan  4 23:19:40 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.105.128.12, lip=66.85.158.92, session=<KKYakZNHNpesaYAM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.157.219.158
country_id: 6252001
description:
2026-01-04 23:21:22 dovecot_plain authenticator failed for H=c-76-157-219-158.hsd1.il.comcast.net (litingis) [76.157.219.158]:49612: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.113
country_id: 6252001
description:
Jan  4 23:23:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=162.216.150.113, lip=66.85.158.92, TLS, session=<mv9HoJNHIP2i2JZx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 23:28:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<u0YasJNHQt2Oq2dI>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  4 23:29:12 host2 pure-ftpd[3740441]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 23:32:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<9eXpvpNHJHAjupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.225
country_id: 2635167
description:
Jan  4 23:35:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=35.203.210.225, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<6Dp3yJNHX84jy9Lh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.100.208.88
country_id: 1819730
description:
Jan  4 23:39:48 host2 sshd[3753499]: Disconnected from invalid user claude 103.100.208.88 port 41255 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.72.204
country_id: 2661886
description:
2026-01-04 23:40:04 dovecot_login authenticator failed for H=h-155-4-72-204.a192.priv.bahnhof.se [155.4.72.204]:47588: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.8.118.24
country_id: 1269750
description:
Jan  4 23:40:17 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@jrdc.lk>, method=PLAIN, rip=103.8.118.24, lip=66.85.158.91, TLS, session=<Y32d2ZNHiKNnCHYY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.164
country_id: 3865483
description:
Jan  4 23:40:26 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@jrdc.lk>, method=PLAIN, rip=179.0.251.164, lip=66.85.158.91, TLS, session=<wuc62pNHH8izAPuk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.107.195
country_id: 3469034
description:
Jan  4 23:40:39 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=191.53.107.195, lip=66.85.158.91, TLS, session=<eTX12pNH5cy/NWvD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 154.127.43.4
country_id: 2395170
description:
Jan  4 23:40:47 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=154.127.43.4, lip=66.85.158.91, TLS, session=<OJaF25NHm5yafysE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.150.101.190
country_id: 798544
description:
Jan  4 23:40:13 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@jrdc.lk>, method=PLAIN, rip=194.150.101.190, lip=66.85.158.91, TLS, session=<rMGS2ZNH88fClmW+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.28.190.210
country_id: 2510769
description:
Jan  4 23:40:12 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@jrdc.lk>, method=PLAIN, rip=139.28.190.210, lip=66.85.158.91, TLS, session=<dKSP2ZNHJdiLHL7S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.53.165.249
country_id: 3469034
description:
Jan  4 23:40:18 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@jrdc.lk>, method=PLAIN, rip=177.53.165.249, lip=66.85.158.91, TLS, session=<MwSr2ZNHR+2xNaX5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.86.130
country_id: 1269750
description:
2026-01-04 23:40:25 dovecot_login authenticator failed for H=(nsg-static-130.86.76.182-airtel.com) [182.76.86.130]:57820: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.0.171.73
country_id: 298795
description:
Jan  4 23:40:36 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=95.0.171.73, lip=66.85.158.91, TLS, session=<AN302pNHytJfAKtJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.239.11.219
country_id: 617790
description:
Jan  4 23:40:30 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=91.239.11.219, lip=66.85.158.91, TLS, session=<La6j2pNHmglb7wvb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 23:40:40 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<GDIW3JNHUuJA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.128.210
country_id: 99237
description:
Jan  4 23:40:42 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info>, method=PLAIN, rip=65.20.128.210, lip=66.85.158.91, TLS, session=<1Dj82pNHmadBFIDS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.100.208.88
country_id: 1819730
description:
Jan  4 23:41:42 host2 sshd[3756581]: Disconnected from invalid user yaya 103.100.208.88 port 56189 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.100.208.88
country_id: 1819730
description:
Jan  4 23:42:22 host2 sshd[3757458]: Disconnected from invalid user mcserver 103.100.208.88 port 34316 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  4 23:42:34 host2 sshd[3757700]: Disconnected from invalid user user 2.57.121.25 port 34577 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.225
country_id: 2635167
description:
Jan  4 23:42:59 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.225, lip=66.85.158.91, TLS, session=<bWyF5JNH5uEjy9Lh>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 23:46:21 host2 sshd[3762852]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 23:46:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<hya/75NHBshnmud6>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 23:47:14 host2 sshd[3763777]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 23:47:39 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<zgEX9ZNHOPKuijvy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.156.80.11
country_id: 1269750
description:
2026-01-04 23:53:00 dovecot_login authenticator failed for H=([182.156.80.11]) [182.156.80.11]:48750: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.170.26.169
country_id: 2077456
description:
2026-01-04 23:53:22 dovecot_login authenticator failed for H=(124-170-26-169.tpgi.com.au) [124.170.26.169]:37313: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 23:54:49 host2 sshd[3772837]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 183.82.126.193
country_id: 1269750
description:
Jan  5 00:00:39 host2 sshd[3780045]: Disconnected from invalid user steam 183.82.126.193 port 57150 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 183.82.126.193
country_id: 1269750
description:
Jan  5 00:01:17 host2 sshd[3780863]: Disconnected from invalid user ali 183.82.126.193 port 42304 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 00:01:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<1s1dJ5RHnM6Oq2dI>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 183.82.126.193
country_id: 1269750
description:
Jan  5 00:03:08 host2 sshd[3782876]: Disconnected from invalid user claude 183.82.126.193 port 54238 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 183.82.126.193
country_id: 1269750
description:
Jan  5 00:02:31 host2 sshd[3782039]: Disconnected from invalid user oracle 183.82.126.193 port 40846 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.140.19.22
country_id: 1269750
description:
Jan  5 00:03:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=103.140.19.22, lip=66.85.158.91, session=<blKbLJRHHr1njBMW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 00:07:37 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<20d6PJRH/H0jupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  5 00:11:35 host2 sshd[3793257]: Disconnected from invalid user admin 2.57.121.112 port 47087 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 00:18:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<hAyTYZRHlLNA46ZK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.79
country_id: 6252001
description:
Jan  5 00:18:28 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.132.79, lip=66.85.158.91, TLS, session=<m8ddY5RH0OaTuYRP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 00:22:49 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<IaTXcpRHdF+uijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 00:25:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<S3Pte5RHgo5nmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.0.120.211
country_id: 226074
description:
Jan  5 00:25:42 host2 sshd[3810320]: Disconnected from invalid user ftp1 196.0.120.211 port 33920 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.39.201.205
country_id: 2510769
description:
Jan  5 00:26:25 host2 sshd[3811050]: Disconnected from invalid user hadoop 95.39.201.205 port 52854 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2026-01-05 00:28:51 dovecot_plain authenticator failed for H=c-73-197-194-98.hsd1.nj.comcast.net (foredom) [73.197.194.98]:35794: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2026-01-05 00:28:47 dovecot_plain authenticator failed for H=c-24-23-125-83.hsd1.pa.comcast.net (sisener) [24.23.125.83]:51486: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.0.120.211
country_id: 226074
description:
Jan  5 00:29:38 host2 sshd[3814293]: Disconnected from invalid user claude 196.0.120.211 port 34132 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.53.236.155
country_id: 1168579
description:
Jan  5 00:29:40 host2 sshd[3814323]: Disconnected from invalid user claude 101.53.236.155 port 56324 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.39.9.137
country_id: 1168579
description:
Jan  5 00:30:24 host2 sshd[3815285]: Disconnected from invalid user guest2 110.39.9.137 port 38096 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.39.9.137
country_id: 1168579
description:
Jan  5 00:31:39 host2 sshd[3816258]: Disconnected from invalid user claude 110.39.9.137 port 36304 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 110.39.9.137
country_id: 1168579
description:
Jan  5 00:32:19 host2 sshd[3816813]: Disconnected from invalid user claude 110.39.9.137 port 49530 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  5 00:32:53 host2 pure-ftpd[3817332]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2026-01-05 00:33:18 dovecot_plain authenticator failed for H=(adhartal) [176.113.155.132]:41441: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.0.120.211
country_id: 226074
description:
Jan  5 00:33:36 host2 sshd[3817983]: Disconnected from invalid user claude 196.0.120.211 port 47132 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.0.120.211
country_id: 226074
description:
Jan  5 00:34:13 host2 sshd[3818636]: Disconnected from invalid user amir 196.0.120.211 port 58710 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 00:35:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<f67Pn5RHroiOq2dI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.39.201.205
country_id: 2510769
description:
Jan  5 00:35:40 host2 sshd[3820292]: Disconnected from invalid user claude 95.39.201.205 port 49040 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  5 00:38:02 host2 sshd[3822783]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.59.32.88
country_id: 1269750
description:
Jan  5 00:37:39 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=139.59.32.88, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<wUz5p5RHlNaLOyBY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.42.225.40
country_id: 2510769
description:
2026-01-05 00:38:01 dovecot_login authenticator failed for H=40.red-81-42-225.staticip.rima-tde.net [81.42.225.40]:47824: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.39.201.205
country_id: 2510769
description:
Jan  5 00:37:28 host2 sshd[3822133]: Disconnected from invalid user guest 95.39.201.205 port 46464 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.183.103.121
country_id: 2635167
description:
2026-01-05 00:38:10 dovecot_login authenticator failed for H=(185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:51248: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 95.39.201.205
country_id: 2510769
description:
Jan  5 00:38:23 host2 sshd[3823162]: Disconnected from invalid user testftp 95.39.201.205 port 48476 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.249
country_id: 6252001
description:
Jan  5 00:41:04 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.249, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Xpg4tJRHZdTG6xj5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 00:42:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<YQWauJRHnMQjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.11.198
country_id: 690791
description:
Jan  5 00:43:51 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=176.103.11.198, lip=66.85.158.91, TLS, session=<kcsCvZRHrJSwZwvG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.11.228
country_id: 2300660
description:
Jan  5 00:44:13 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=41.139.11.228, lip=66.85.158.91, TLS, session=<az9LvpRHoKMpiwvk>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.45.112
country_id: 1880251
description:
Jan  5 00:53:49 host2 sshd[3840867]: Disconnected from invalid user michael 159.223.45.112 port 38080 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 95.0.252.5
country_id: 298795
description:
Jan  5 00:54:04 host2 sshd[3841225]: Disconnected from invalid user github-runner 95.0.252.5 port 60538 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 00:54:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<lvQH5ZRHsIZA46ZK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.45.112
country_id: 1880251
description:
Jan  5 00:54:39 host2 sshd[3842228]: Disconnected from invalid user gildata 159.223.45.112 port 32804 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.70.19.11
country_id: 3469034
description:
2026-01-05 00:56:00 dovecot_login authenticator failed for H=([45.70.19.11]) [45.70.19.11]:33677: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 174.138.59.242
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[174.138.59.242] [Remote Port]=[44708] [Authentication Database]=[mail] [Username]=[sales@anandaobauae.org] (10/10 failures) (blocked until [Mon Jan  5 19:26:19 2026 UTC/Tue Jan  6 00:56:19 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 00:56:21 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=</TTH6pRHpK6uijvy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.0.252.5
country_id: 298795
description:
Jan  5 00:56:28 host2 sshd[3844581]: Disconnected from invalid user mini 95.0.252.5 port 51844 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.45.112
country_id: 1880251
description:
Jan  5 00:56:46 host2 sshd[3844894]: Disconnected from invalid user claude 159.223.45.112 port 36702 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.142
country_id: 6252001
description:
Jan  5 00:56:53 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.142, lip=66.85.158.91, TLS: Connection closed, session=<nu7M7JRHetFChJmO>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  5 00:57:42 host2 sshd[3845925]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.114.73
country_id: 1168579
description:
2026-01-05 00:57:13 dovecot_login authenticator failed for H=([103.186.114.73]) [103.186.114.73]:46283: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 159.223.45.112
country_id: 1880251
description:
Jan  5 00:58:09 host2 sshd[3846346]: Disconnected from invalid user jacky 159.223.45.112 port 50412 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2026-01-05 01:02:51 dovecot_plain authenticator failed for H=c-24-15-216-41.hsd1.il.comcast.net (trize) [24.15.216.41]:42176: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2026-01-05 01:02:54 dovecot_plain authenticator failed for H=c-73-197-194-98.hsd1.nj.comcast.net (aphauts) [73.197.194.98]:56690: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.207.181
country_id: 6252001
description:
Jan  5 01:03:06 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.79.207.181, lip=66.85.158.92, session=<0XMDA5VHP6MtT8+1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 01:03:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<vhxMBZVHgLdnmud6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.8
country_id: 798549
description:
Jan  5 01:05:51 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=85.217.149.8, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<cBrbDJVHnMVV2ZUI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.224
country_id: 6252001
description:
Jan  5 01:07:37 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.224, lip=66.85.158.92, session=<T1MpE5VHbvnN0h/g>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 01:07:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<3SrSE5VH5pSOq2dI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.31.74
country_id: 1522867
description:
2026-01-05 01:09:23 dovecot_plain authenticator failed for H=2.135.31.74.dynamic.telecom.kz (esclism) [2.135.31.74]:52715: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.67
country_id: 6252001
description:
Jan  5 01:10:49 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.20.67, lip=66.85.158.92, session=<aY2VHpVHCDhBMRRD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.67
country_id: 6252001
description:
Jan  5 01:11:16 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=65.49.20.67, lip=66.85.158.92, session=<tkgzIJVH7HdBMRRD>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.29.135.63
country_id: 294640
description:
Jan  5 01:13:54 host2 sshd[3865161]: Disconnected from invalid user ubuntu 5.29.135.63 port 42196 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.29.135.63
country_id: 294640
description:
Jan  5 01:15:47 host2 sshd[3867574]: Disconnected from invalid user patrol 5.29.135.63 port 47840 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.29.135.63
country_id: 294640
description:
Jan  5 01:16:21 host2 sshd[3868279]: Disconnected from invalid user icinga 5.29.135.63 port 40598 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 01:16:42 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<8DWJM5VHyH0jupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.120.169
country_id: 2963597
description:
Jan  5 01:16:17 host2 sshd[3868200]: Disconnected from invalid user claude 20.123.120.169 port 42126 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 5.29.135.63
country_id: 294640
description:
Jan  5 01:17:29 host2 sshd[3869675]: Disconnected from invalid user admin 5.29.135.63 port 51708 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  5 01:18:25 host2 sshd[3870732]: Disconnected from invalid user admin 2.57.121.112 port 53614 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.120.169
country_id: 2963597
description:
Jan  5 01:19:44 host2 sshd[3872129]: Disconnected from invalid user claude 20.123.120.169 port 43158 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.123.120.169
country_id: 2963597
description:
Jan  5 01:20:18 host2 sshd[3872949]: Disconnected from invalid user ftptest 20.123.120.169 port 53348 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.195.138.52
country_id: 6252001
description:
2026-01-05 01:20:43 dovecot_plain authenticator failed for H=c-98-195-138-52.hsd1.tx.comcast.net (hallar) [98.195.138.52]:37470: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.208.106.186
country_id: 3175395
description:
Jan  5 01:21:06 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=185.208.106.186, lip=66.85.158.91, TLS, session=<q4ZrQpVHdeq50Gq6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.120.169
country_id: 2963597
description:
Jan  5 01:21:26 host2 sshd[3874141]: Disconnected from invalid user ubuntu 20.123.120.169 port 48606 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.32.117
country_id: 953987
description:
Jan  5 01:21:27 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw>, method=PLAIN, rip=102.64.32.117, lip=66.85.158.91, TLS, session=<VOKKQ5VHOotmQCB1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.190.155.43
country_id: 6252001
description:
2026-01-05 01:22:17 dovecot_plain authenticator failed for H=(devetrical) [76.190.155.43]:57573: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.67
country_id: 99237
description:
2026-01-05 01:23:15 dovecot_plain authenticator failed for H=(minge) [65.20.129.67]:48360: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 01:30:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<cTReZZVH3nOuijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 01:31:42 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<3xsmaZVHEMxA46ZK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.193
country_id: 6252001
description:
Jan  5 01:32:54 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.193, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<0RiZbZVHO8rN0h/B>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-05 01:33:55 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:54453: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.69.236.207
country_id: 3865483
description:
Jan  5 01:36:21 host2 sshd[3889307]: Disconnected from invalid user claude 200.69.236.207 port 47263 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.92.222
country_id: 1880251
description:
Jan  5 01:36:10 host2 sshd[3889151]: Disconnected from invalid user claude 178.128.92.222 port 47920 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  5 01:36:17 host2 pure-ftpd[3889261]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.195.66
country_id: 1269750
description:
2026-01-05 01:38:49 dovecot_login authenticator failed for H=([128.185.169.25]) [125.19.195.66]:52650: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.115.144.103
country_id: 3469034
description:
2026-01-05 01:39:02 dovecot_login authenticator failed for H=(191.34.253.17.dynamic.adsl.gvt.net.br) [187.115.144.103]:33479: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.92.222
country_id: 1880251
description:
Jan  5 01:38:27 host2 sshd[3891234]: Disconnected from invalid user claude 178.128.92.222 port 50430 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 178.128.92.222
country_id: 1880251
description:
Jan  5 01:39:53 host2 sshd[3892720]: Disconnected from invalid user claude 178.128.92.222 port 48934 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.69.236.207
country_id: 3865483
description:
Jan  5 01:39:11 host2 sshd[3891982]: Disconnected from invalid user test2 200.69.236.207 port 45958 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 01:40:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<6Y/rh5VHVNuOq2dI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.69.236.207
country_id: 3865483
description:
Jan  5 01:40:32 host2 sshd[3893709]: Disconnected from invalid user milad 200.69.236.207 port 59422 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 01:42:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<Kdb3j5VHerZnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.92.222
country_id: 1880251
description:
Jan  5 01:43:28 host2 sshd[3896350]: Disconnected from invalid user es1 178.128.92.222 port 42922 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.44.174.254
country_id: 357994
description:
2026-01-05 01:48:14 dovecot_plain authenticator failed for H=(breabic) [102.44.174.254]:43918: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.167
country_id: 6252001
description:
Jan  5 01:50:06 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.167, lip=66.85.158.92, TLS handshaking: Connection closed, session=<tA8dq5VHn9RBMQGn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.162
country_id: 6252001
description:
Jan  5 01:50:26 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.162, lip=66.85.158.92, TLS handshaking: Connection closed, session=<q1pIrJVH0B5BMQGi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 01:50:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shop@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<yr3srZVHcM8jupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.211.99.142
country_id: 6252001
description:
Jan  5 02:02:42 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=198.211.99.142, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<whQk2JVHWuLG02OO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 02:03:41 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<dPiD25VHFM2uijvy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.54.242.253
country_id: 2186224
description:
2026-01-05 02:05:53 dovecot_login authenticator failed for H=210-54-242-253.adsl.xtra.co.nz [210.54.242.253]:56762: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.68.220.15
country_id: 6252001
description:
2026-01-05 02:06:15 dovecot_plain authenticator failed for H=c-73-68-220-15.hsd1.ma.comcast.net (minda) [73.68.220.15]:46832: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.83.98
country_id: 1269750
description:
2026-01-05 02:06:43 dovecot_login authenticator failed for H=([182.71.132.193]) [182.79.83.98]:59690: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.100.41.198
country_id: 798549
description:
2026-01-05 02:07:00 dovecot_login authenticator failed for H=([109.100.41.198]) [109.100.41.198]:48197: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.50
country_id: 6252001
description:
Jan  5 02:07:04 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.50, lip=66.85.158.92, TLS: Connection closed, session=<zTDK55VHBkKnXpIy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2026-01-05 02:06:12 dovecot_plain authenticator failed for H=c-24-15-216-41.hsd1.il.comcast.net (choopedus) [24.15.216.41]:57840: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.50
country_id: 6252001
description:
Jan  5 02:07:12 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=167.94.146.50, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<5iw56JVH7K6nXpIy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 02:08:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<xerl65VH2I5A46ZK>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 157.245.122.12
country_id: 6252001
description:
Jan  5 02:12:01 host2 pure-ftpd[3924590]: (?@157.245.122.12) [INFO] New connection from 157.245.122.12


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2026-01-05 02:14:47 dovecot_plain authenticator failed for H=c-98-204-134-124.hsd1.md.comcast.net (nonaurs) [98.204.134.124]:56136: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.67
country_id: 6252001
description:
Jan  5 02:15:31 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=216.218.206.67, lip=66.85.158.91, session=<Ekz8BZZHkEDY2s5D>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 02:20:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<QP78FpZHaKxnmud6>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  5 02:23:54 host2 sshd[3937170]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  5 02:23:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<R05LI5ZH2rcFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 02:25:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<bxl9KJZHuGsjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-05 02:27:48 dovecot_plain authenticator failed for H=(untied) [64.72.74.162]:55804: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.207
country_id: 6252001
description:
Jan  5 02:28:46 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.207, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<1hlcNZZH9cyTuYTP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.104.9
country_id: 6252001
description:
Jan  5 02:30:53 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (disconnected before auth was ready, waited 0 secs): user=<>, rip=20.64.104.9, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<aT30PJZHEqEUQGgJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  5 02:36:16 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<MjIYUJZHFNoFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 02:37:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<AFwaVJZHGpuuijvy>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  5 02:39:42 host2 pure-ftpd[3955973]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.128
country_id: 6252001
description:
Jan  5 02:42:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.128, lip=66.85.158.91, TLS handshaking: Connection closed, session=<iH0mZZZHH4RAPpyA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.122
country_id: 6252001
description:
Jan  5 02:42:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.122, lip=66.85.158.91, TLS handshaking: Connection closed, session=<zP82ZpZHCqhAPpx6>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  5 02:43:23 host2 sshd[3960478]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.221.172.97
country_id: 1269750
description:
Jan  5 02:44:40 host2 sshd[3961691]: Disconnected from invalid user claude 117.221.172.97 port 39563 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 02:45:04 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<flqKb5ZHdJFA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 02:45:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<KyT3b5ZH1NKOq2dI>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 117.221.172.97
country_id: 1269750
description:
Jan  5 02:46:15 host2 sshd[3963682]: Disconnected from invalid user claude 117.221.172.97 port 56457 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.221.172.97
country_id: 1269750
description:
Jan  5 02:49:29 host2 sshd[3966927]: Disconnected from invalid user claude 117.221.172.97 port 37252 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.244
country_id: 6252001
description:
Jan  5 02:57:26 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.244, lip=66.85.158.91, TLS, session=<XmXpm5ZHROzN0h/0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.248.244.75
country_id: 2921044
description:
Jan  5 02:57:32 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=104.248.244.75, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<kDE8nJZHbKRo+PRL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 02:58:21 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<rVoGn5ZHkOhnmud6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.172.21
country_id: 6252001
description:
Jan  5 02:59:49 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:140943F2:SSL routines:ssl3_read_bytes:sslv3 alert unexpected message: SSL alert number 10 (no auth attempts in 0 secs): user=<>, rip=45.79.172.21, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:140943F2:SSL routines:ssl3_read_bytes:sslv3 alert unexpected message: SSL alert number 10, session=<mRNwpJZHWkctT6wV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 03:00:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<6FLvpJZHcu0jupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-05 03:01:39 dovecot_plain authenticator failed for H=(cerow) [64.72.74.162]:45374: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.46.17.63
country_id: 6252001
description:
Jan  5 03:06:14 host2 sshd[3985290]: Disconnected from invalid user dylan 37.46.17.63 port 35982 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.51.174.253
country_id: 3017382
description:
2026-01-05 03:06:19 dovecot_login authenticator failed for H=mastergateway.ville-saint-louis.fr [212.51.174.253]:63691: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.35.240
country_id: 2077456
description:
2026-01-05 03:06:35 dovecot_login authenticator failed for H=([101.168.35.240]) [101.168.35.240]:54204: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.65.229.156
country_id: 6252001
description:
Jan  5 03:08:37 host2 sshd[3987627]: Disconnected from invalid user elsearch 159.65.229.156 port 38684 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 03:11:04 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<Z5yHzJZH/qWuijvy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.65.229.156
country_id: 6252001
description:
Jan  5 03:11:20 host2 sshd[3990899]: Disconnected from invalid user oracle 159.65.229.156 port 35058 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 159.65.229.156
country_id: 6252001
description:
Jan  5 03:12:14 host2 sshd[3991995]: Disconnected from invalid user rms 159.65.229.156 port 40188 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.65.229.156
country_id: 6252001
description:
Jan  5 03:13:16 host2 sshd[3993346]: Disconnected from invalid user hari 159.65.229.156 port 52594 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.46.17.63
country_id: 6252001
description:
Jan  5 03:13:39 host2 sshd[3993755]: Disconnected from invalid user rms 37.46.17.63 port 57176 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.248.40.17
country_id: 6252001
description:
Jan  5 03:16:26 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 1 secs): user=<>, rip=52.248.40.17, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<UHPS35ZHQpo0+CgR>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 37.46.17.63
country_id: 6252001
description:
Jan  5 03:17:33 host2 sshd[3999102]: Disconnected from invalid user fsc 37.46.17.63 port 54118 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 03:18:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<FEqE5ZZHeMqOq2dI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2026-01-05 03:20:33 dovecot_plain authenticator failed for H=c-73-137-7-97.hsd1.ga.comcast.net (wanteryst) [73.137.7.97]:41346: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.56.103.154
country_id: 6252001
description:
Jan  5 03:20:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.56.103.154, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Sma575ZHNoItOGea>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 03:22:08 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<7yUa9JZHFr5A46ZK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.168.136
country_id: 1269750
description:
2026-01-05 03:26:52 dovecot_login authenticator failed for H=([203.193.168.136]) [203.193.168.136]:49266: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.172.189.13
country_id: 3017382
description:
[2026-01-05 03:30:33 +0530] info [cpaneld] 217.172.189.13 - lezzarotech "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  5 03:31:53 host2 sshd[4017556]: Disconnected from invalid user admin 2.57.121.112 port 54770 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 03:35:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<iAewIpdHmrQjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 03:36:41 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<FaseKJdHjOVnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2026-01-05 03:39:40 dovecot_login authenticator failed for H=([128.185.18.217]) [122.185.176.126]:40130: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.237.113.106
country_id: 587116
description:
2026-01-05 03:39:58 dovecot_login authenticator failed for H=([109.237.113.106]) [109.237.113.106]:43348: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  5 03:42:59 host2 pure-ftpd[4029385]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.157.219.158
country_id: 6252001
description:
2026-01-05 03:43:02 dovecot_plain authenticator failed for H=c-76-157-219-158.hsd1.il.comcast.net (oversh) [76.157.219.158]:45994: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.174
country_id: 732800
description:
2026-01-05 03:43:07 dovecot_plain authenticator failed for H=(unshersia) [92.62.243.174]:59643: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.251.121.70
country_id: 1861060
description:
2026-01-05 03:43:42 dovecot_login authenticator failed for H=works.ssc-gr.info [160.251.121.70]:44550: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.242
country_id: 2186224
description:
2026-01-05 03:44:11 dovecot_login authenticator failed for H=([121.73.162.242]) [121.73.162.242]:58542: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 03:45:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<CtieRpdHQI6uijvy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.167
country_id: 2993457
description:
Jan  5 03:49:54 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.167, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<s3OFV5dHDv7CpRCn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 03:51:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<Ft8CXZdH6OCOq2dI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2026-01-05 03:51:39 dovecot_plain authenticator failed for H=c-98-40-101-10.hsd1.tn.comcast.net (rariverict) [98.40.101.10]:55190: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2026-01-05 03:54:00 dovecot_plain authenticator failed for H=(trinonania) [94.201.22.158]:59409: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.214.92.14
country_id: 6252001
description:
Jan  5 03:54:34 host2 sshd[4044032]: Disconnected from invalid user www-data 162.214.92.14 port 60540 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-05 03:55:22 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (unnon) [87.103.126.54]:32049: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 192.155.90.220
country_id: 6252001
description:
Jan  5 03:56:21 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=192.155.90.220, lip=66.85.158.91, session=<NtWabpdHuBHAm1rc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.214.92.14
country_id: 6252001
description:
Jan  5 03:57:23 host2 sshd[4047474]: Disconnected from invalid user myadmin 162.214.92.14 port 43676 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.155.21.198
country_id: 1819730
description:
Jan  5 03:58:15 host2 sshd[4048458]: Disconnected from invalid user satis 43.155.21.198 port 38922 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 03:59:02 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<KjkVeJdHUrpA46ZK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.155.21.198
country_id: 1819730
description:
Jan  5 03:59:30 host2 sshd[4049740]: Disconnected from invalid user richard 43.155.21.198 port 36788 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.52
country_id: 6252001
description:
Jan  5 04:07:26 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.52, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<NC02lpdHqd+TuYQ0>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  5 04:08:11 host2 sshd[4061752]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.211
country_id: 6252001
description:
Jan  5 04:08:32 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.211, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<0v4smpdHx8DG6xjT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 04:09:47 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<lJGLnpdHWDgjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.193.18.148
country_id: 660013
description:
Jan  5 04:11:47 host2 sshd[4067784]: Disconnected from invalid user ubuntu 212.193.18.148 port 45728 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 04:14:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<qtLlrpdHBNJnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.215.228.18
country_id: 298795
description:
Jan  5 04:14:28 host2 sshd[4071959]: Disconnected from invalid user test 81.215.228.18 port 52936 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.193.18.148
country_id: 660013
description:
Jan  5 04:15:15 host2 sshd[4073161]: Disconnected from invalid user ubuntu 212.193.18.148 port 59590 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 81.215.228.18
country_id: 298795
description:
Jan  5 04:15:31 host2 sshd[4073653]: Disconnected from invalid user claude 81.215.228.18 port 48012 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.117
country_id: 1643084
description:
Jan  5 04:16:07 host2 sshd[4074466]: Disconnected from invalid user taiga 103.171.85.117 port 47396 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.190.155.43
country_id: 6252001
description:
2026-01-05 04:15:46 dovecot_plain authenticator failed for H=(esess) [76.190.155.43]:55488: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.31.39.143
country_id: 1643084
description:
Jan  5 04:16:48 host2 sshd[4075444]: Disconnected from invalid user cinema 103.31.39.143 port 55842 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.171.85.117
country_id: 1643084
description:
Jan  5 04:17:41 host2 sshd[4076944]: Disconnected from invalid user claude 103.171.85.117 port 41132 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.31.39.143
country_id: 1643084
description:
Jan  5 04:17:36 host2 sshd[4076881]: Disconnected from invalid user claude 103.31.39.143 port 39066 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.117
country_id: 1643084
description:
Jan  5 04:18:28 host2 sshd[4077894]: Disconnected from invalid user jagdish 103.171.85.117 port 46868 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 04:18:41 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<xTJUvpdHpJauijvy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.93
country_id: 2750405
description:
Jan  5 04:18:45 host2 sshd[4078351]: Disconnected from invalid user bitnami 20.123.146.93 port 49508 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.117
country_id: 1643084
description:
Jan  5 04:19:09 host2 sshd[4078761]: Disconnected from invalid user yaya 103.171.85.117 port 60486 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.228.53.204
country_id: 6252001
description:
Jan  5 04:19:28 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=66.228.53.204, lip=66.85.158.92, TLS, session=<xkFHwZdHtvpC5DXM>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.94
country_id: 2750405
description:
Jan  5 04:19:39 host2 sshd[4079584]: Disconnected from invalid user mis 20.123.146.94 port 24810 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.193.18.148
country_id: 660013
description:
Jan  5 04:20:46 host2 sshd[4081592]: Disconnected from invalid user mac 212.193.18.148 port 47308 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.193.18.148
country_id: 660013
description:
Jan  5 04:22:17 host2 sshd[4083634]: Disconnected from invalid user ftpuser 212.193.18.148 port 43056 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.210.186.201
country_id: 2750405
description:
Jan  5 04:23:20 host2 sshd[4085162]: Disconnected from invalid user contas 4.210.186.201 port 53944 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 04:23:49 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<y3a60JdHPpiOq2dI>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 142.171.103.72
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[142.171.103.72] [Remote Port]=[38974] [Authentication Database]=[mail] [Username]=[no-reply@anandaobauae.org] (10/10 failures) (blocked until [Mon Jan  5 22:53:47 2026 UTC/Tue Jan  6 04:23:47 2026 LOCAL])


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.64.179
country_id: 1269750
description:
Jan  5 04:25:39 host2 sshd[4088439]: Disconnected from invalid user smile 139.59.64.179 port 52956 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.185.168.78
country_id: 3469034
description:
Jan  5 04:26:16 host2 sshd[4089301]: Disconnected from invalid user ubuntu 191.185.168.78 port 37886 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.24.183.76
country_id: 6252001
description:
2026-01-05 04:27:22 dovecot_login authenticator failed for H=(173-24-183-76.client.mchsi.com) [173.24.183.76]:57456: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.185.168.78
country_id: 3469034
description:
Jan  5 04:27:40 host2 sshd[4091675]: Disconnected from invalid user claude 191.185.168.78 port 57002 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.145.54
country_id: 1269750
description:
2026-01-05 04:27:43 dovecot_login authenticator failed for H=([128.185.135.33]) [122.185.145.54]:55348: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  5 04:28:11 host2 sshd[4092676]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.19.77
country_id: 3932488
description:
Jan  5 04:28:53 host2 sshd[4094530]: Disconnected from invalid user ftpuser 161.132.19.77 port 50872 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 130.250.191.230
country_id: 1269750
description:
Jan  5 04:28:55 host2 sshd[4094604]: Disconnected from invalid user sims 130.250.191.230 port 53682 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 191.185.168.78
country_id: 3469034
description:
Jan  5 04:28:21 host2 sshd[4092903]: Disconnected from invalid user readonly 191.185.168.78 port 40444 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-05 04:28:31 dovecot_plain authenticator failed for H=(shnudono) [64.72.74.162]:51671: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-05 04:28:35 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (hiatheg) [87.103.126.54]:34127: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 51.83.164.92
country_id: 3017382
description:
Jan  5 04:29:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=51.83.164.92, lip=66.85.158.92, session=<fIuw5JdH9YAzU6Rc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.93
country_id: 2750405
description:
Jan  5 04:29:10 host2 sshd[4095020]: Disconnected from invalid user indra 20.123.146.93 port 39069 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.93
country_id: 2750405
description:
Jan  5 04:30:57 host2 sshd[4097982]: Disconnected from invalid user leonard 20.123.146.93 port 59542 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.212
country_id: 2635167
description:
Jan  5 04:31:03 host2 dovecot[1170291]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.212, lip=66.85.158.91, TLS, session=<yNyx6pdHg4tX7LDU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.19.77
country_id: 3932488
description:
Jan  5 04:31:46 host2 sshd[4099169]: Disconnected from invalid user k8s 161.132.19.77 port 44240 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 139.59.64.179
country_id: 1269750
description:
Jan  5 04:31:18 host2 sshd[4098621]: Disconnected from invalid user claude 139.59.64.179 port 56328 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.19.77
country_id: 3932488
description:
Jan  5 04:32:23 host2 sshd[4099815]: Disconnected from invalid user ubuntu 161.132.19.77 port 45306 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 130.250.191.230
country_id: 1269750
description:
Jan  5 04:32:45 host2 sshd[4100104]: Disconnected from invalid user debian 130.250.191.230 port 59240 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.93
country_id: 2750405
description:
Jan  5 04:32:48 host2 sshd[4100118]: Disconnected from invalid user claude 20.123.146.93 port 28412 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.248
country_id: 1880251
description:
Jan  5 04:32:55 host2 sshd[4100256]: Disconnected from invalid user claude 45.78.201.248 port 50074 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 130.250.191.230
country_id: 1269750
description:
Jan  5 04:33:24 host2 sshd[4100802]: Disconnected from invalid user testuser 130.250.191.230 port 52672 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.140.19.22
country_id: 1269750
description:
Jan  5 04:34:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colourmarklabels.com>, method=PLAIN, rip=103.140.19.22, lip=66.85.158.91, session=<vBpi95dHgthnjBMW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.248
country_id: 1880251
description:
Jan  5 04:35:30 host2 sshd[4103328]: Disconnected from invalid user smile 45.78.201.248 port 36668 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.95
country_id: 2750405
description:
Jan  5 04:36:27 host2 sshd[4104139]: Disconnected from invalid user guest2 20.123.146.95 port 4718 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.201.248
country_id: 1880251
description:
Jan  5 04:38:03 host2 sshd[4105812]: Disconnected from invalid user ubuntu 45.78.201.248 port 58138 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.4
country_id: 798549
description:
Jan  5 04:39:49 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=85.217.140.4, lip=66.85.158.92, TLS, session=<eCsTCphHVrRV2YwE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.92
country_id: 2750405
description:
Jan  5 04:39:55 host2 sshd[4107440]: Disconnected from invalid user ana 20.123.146.92 port 61209 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.4
country_id: 798549
description:
Jan  5 04:40:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=85.217.140.4, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<bu7sC5hHiLxV2YwE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 04:40:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<7JLiC5hHJr1A46ZK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.248
country_id: 1880251
description:
Jan  5 04:40:31 host2 sshd[4108538]: Disconnected from invalid user hoster 45.78.201.248 port 40918 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.14
country_id: 798549
description:
Jan  5 04:41:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.140.14, lip=66.85.158.92, session=<JoXVEJhHQOhV2YwO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.123.109.114
country_id: 732800
description:
Jan  5 04:42:14 host2 sshd[4110202]: Invalid user sivagnanamfoundation from 93.123.109.114 port 50860


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 04:42:47 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<DCuQFJhHXrcjupN+>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 35.186.147.126
country_id: 1880251
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[35.186.147.126] [Remote Port]=[46942] [Authentication Database]=[mail] [Username]=[postfix@anandaobauae.org] (10/10 failures) (blocked until [Mon Jan  5 23:12:45 2026 UTC/Tue Jan  6 04:42:45 2026 LOCAL])


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  5 04:46:20 host2 pure-ftpd[4114969]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-05 04:49:28 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:53921: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 04:50:29 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<ZhMVMJhHTliuijvy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.158.162.24
country_id: 2510769
description:
Jan  5 04:50:51 host2 sshd[4119644]: Disconnected from invalid user user5 146.158.162.24 port 47576 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 04:51:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<O9ZvMphHMpJnmud6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.156
country_id: 3703430
description:
Jan  5 04:52:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.227.254.156, lip=66.85.158.91, session=<Zdp/NphHev8t4/6c>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 04:55:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<rntqQZhHTLyOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.140.19.22
country_id: 1269750
description:
Jan  5 04:55:39 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=103.140.19.22, lip=66.85.158.91, session=<H2mNQphHaqJnjBMW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.158.162.24
country_id: 2510769
description:
Jan  5 04:55:46 host2 sshd[4125380]: Disconnected from invalid user oracle 146.158.162.24 port 39990 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 146.158.162.24
country_id: 2510769
description:
Jan  5 04:56:24 host2 sshd[4126039]: Disconnected from invalid user test2 146.158.162.24 port 51710 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.92
country_id: 2750405
description:
Jan  5 04:57:09 host2 sshd[4126666]: Disconnected from invalid user pagar 20.123.146.92 port 2982 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.161.207.2
country_id: 1643084
description:
Jan  5 04:59:18 host2 sshd[4128551]: Disconnected from invalid user admin 103.161.207.2 port 51200 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2026-01-05 05:01:07 dovecot_plain authenticator failed for H=(colorptice) [91.73.188.251]:42296: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.8.155
country_id: 3175395
description:
Jan  5 05:01:39 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=185.197.8.155, lip=66.85.158.91, TLS, session=<3j8vV5hH49+5xQib>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.161.207.2
country_id: 1643084
description:
Jan  5 05:02:03 host2 sshd[4131142]: Disconnected from invalid user claude 103.161.207.2 port 49062 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.181.167.52
country_id: 3865483
description:
Jan  5 05:02:07 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info>, method=PLAIN, rip=45.181.167.52, lip=66.85.158.91, TLS, session=<gd12WJhHCcAttac0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.182.125.210
country_id: 6252001
description:
2026-01-05 05:01:36 dovecot_plain authenticator failed for H=(urginsters) [12.182.125.210]:40585: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.158.162.24
country_id: 2510769
description:
Jan  5 05:02:22 host2 sshd[4131530]: Disconnected from invalid user reza 146.158.162.24 port 51588 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.161.207.2
country_id: 1643084
description:
Jan  5 05:04:18 host2 sshd[4133604]: Disconnected from invalid user claude 103.161.207.2 port 33342 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 212.104.231.204
country_id: 1227603
description:
Jan  5 05:06:26 host2 dovecot[1170291]: imap-login: Disconnected: Inactivity (auth failed, 1 attempts in 178 secs): user=<chamath.chamupathi@saara.lk>, method=PLAIN, rip=212.104.231.204, lip=66.85.158.91, TLS, session=<fZaaXphHWDXUaOfM>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.161.207.2
country_id: 1643084
description:
Jan  5 05:06:33 host2 sshd[4135983]: Disconnected from invalid user admin 103.161.207.2 port 45852 [preauth]


plugin: ossec
rule: 9711
name: Multiple Dovecot authentication failures on disconnect.
abuser: 212.104.231.204
country_id: 1227603
description:
Jan  5 05:07:05 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 33 secs): user=<chamath.chamupathi@saara.lk>, method=PLAIN, rip=212.104.231.204, lip=66.85.158.91, TLS: Connection closed, session=<HYSbaZhHXzXUaOfM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.34
country_id: 2186224
description:
2026-01-05 05:07:26 dovecot_login authenticator failed for H=([121.73.168.34]) [121.73.168.34]:52244: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.211.156
country_id: 1269750
description:
2026-01-05 05:07:43 dovecot_login authenticator failed for H=(dhcp-192-211-156.in2cable.com) [203.192.211.156]:60082: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2026-01-05 05:07:55 dovecot_plain authenticator failed for H=(akess) [12.150.243.22]:10070: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.95
country_id: 2750405
description:
Jan  5 05:09:42 host2 sshd[4138880]: Disconnected from invalid user install 20.123.146.95 port 40212 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.104.231.204
country_id: 1227603
description:
Jan  5 05:10:10 host2 dovecot[1170291]: imap-login: Disconnected: Inactivity (no auth attempts in 181 secs): user=<>, rip=212.104.231.204, lip=66.85.158.91, TLS handshaking, session=<OymRdphHYTXUaOfM>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.176.122.24
country_id: 1269750
description:
Jan  5 05:14:36 host2 sshd[4144555]: Disconnected from invalid user cron 122.176.122.24 port 51316 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 05:15:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<vsOsiphHfLJA46ZK>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 64.227.166.74
country_id: 1269750
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[64.227.166.74] [Remote Port]=[45692] [Authentication Database]=[mail] [Username]=[support@anandaobauae.org] (10/10 failures) (blocked until [Mon Jan  5 23:45:48 2026 UTC/Tue Jan  6 05:15:48 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 05:15:58 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<tP4xi5hHnJMjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.57.150
country_id: 1643084
description:
Jan  5 05:16:27 host2 sshd[4146907]: Disconnected from invalid user ftpuser2 103.179.57.150 port 45656 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.140.19.22
country_id: 1269750
description:
Jan  5 05:17:08 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=103.140.19.22, lip=66.85.158.91, session=<L9hej5hHaLhnjBMW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2026-01-05 05:17:19 dovecot_login authenticator failed for H=(netcomafrica.com) [41.219.149.74]:16933: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2026-01-05 05:17:39 dovecot_login authenticator failed for H=([189.57.81.137]) [186.201.54.90]:40677: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 133.117.72.88
country_id: 1861060
description:
Jan  5 05:18:18 host2 sshd[4148989]: Disconnected from invalid user admin 133.117.72.88 port 60036 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.176.122.24
country_id: 1269750
description:
Jan  5 05:18:57 host2 sshd[4149646]: Disconnected from invalid user mail1 122.176.122.24 port 40678 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 133.117.72.88
country_id: 1861060
description:
Jan  5 05:19:21 host2 sshd[4150077]: Disconnected from invalid user ftpuser 133.117.72.88 port 35408 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.176.122.24
country_id: 1269750
description:
Jan  5 05:19:35 host2 sshd[4150353]: Disconnected from invalid user webmaster 122.176.122.24 port 52054 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.57.150
country_id: 1643084
description:
Jan  5 05:20:09 host2 sshd[4151081]: Disconnected from invalid user runo 103.179.57.150 port 50010 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.176.122.24
country_id: 1269750
description:
Jan  5 05:20:12 host2 sshd[4151154]: Disconnected from invalid user media 122.176.122.24 port 35192 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.183.74.214
country_id: 1643084
description:
Jan  5 05:20:36 host2 sshd[4151642]: Disconnected from invalid user bitrix 103.183.74.214 port 34708 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.179.57.150
country_id: 1643084
description:
Jan  5 05:21:49 host2 sshd[4153075]: Disconnected from invalid user slr 103.179.57.150 port 33116 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 05:22:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<Zgdbo5hHFliuijvy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.57.150
country_id: 1643084
description:
Jan  5 05:22:34 host2 sshd[4153929]: Disconnected from invalid user pro 103.179.57.150 port 47306 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.152.83.202
country_id: 2264397
description:
Jan  5 05:24:23 host2 sshd[4155911]: Disconnected from invalid user claude 89.152.83.202 port 51256 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.183.74.214
country_id: 1643084
description:
Jan  5 05:24:47 host2 sshd[4156321]: Disconnected from invalid user shares 103.183.74.214 port 42102 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.152.83.202
country_id: 2264397
description:
Jan  5 05:25:43 host2 sshd[4157810]: Disconnected from invalid user deploy 89.152.83.202 port 44148 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 89.152.83.202
country_id: 2264397
description:
Jan  5 05:26:15 host2 sshd[4158420]: Disconnected from invalid user dns 89.152.83.202 port 38890 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.176.79.139
country_id: 1643084
description:
Jan  5 05:26:28 host2 sshd[4158643]: Disconnected from invalid user claude 103.176.79.139 port 55656 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 05:26:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<bQsUsZhH5oiOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 05:27:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<HSaUtJhHvqtnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.152.83.202
country_id: 2264397
description:
Jan  5 05:27:51 host2 sshd[4160159]: Disconnected from invalid user UBUNTU 89.152.83.202 port 43440 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.152.83.202
country_id: 2264397
description:
Jan  5 05:28:21 host2 sshd[4160801]: Disconnected from invalid user claude 89.152.83.202 port 40548 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.176.79.139
country_id: 1643084
description:
Jan  5 05:29:39 host2 sshd[4162204]: Disconnected from invalid user amir 103.176.79.139 port 33676 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.176.79.139
country_id: 1643084
description:
Jan  5 05:31:59 host2 sshd[4164690]: Disconnected from invalid user user1 103.176.79.139 port 39136 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.123
country_id: 6252001
description:
Jan  5 05:34:41 host2 pure-ftpd[4167356]: (?@66.132.153.123) [INFO] New connection from 66.132.153.123


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.141.132.26
country_id: 130758
description:
Jan  5 05:44:06 host2 sshd[4176766]: Disconnected from invalid user beth 185.141.132.26 port 57778 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.5.189.189
country_id: 241170
description:
Jan  5 05:43:07 host2 sshd[4175742]: Disconnected from invalid user gabriel 69.5.189.189 port 54156 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.213.175.140
country_id: 2510769
description:
Jan  5 05:44:47 host2 sshd[4177441]: Disconnected from invalid user holu 185.213.175.140 port 1932 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  5 05:44:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<cHMS8JhHVOgFhXlo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.213.175.140
country_id: 2510769
description:
Jan  5 05:45:51 host2 sshd[4178994]: Disconnected from invalid user claude 185.213.175.140 port 28806 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.18.236.229
country_id: 3175395
description:
Jan  5 05:45:51 host2 sshd[4179031]: Disconnected from invalid user ganesh 85.18.236.229 port 43390 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.75.194.10
country_id: 3017382
description:
Jan  5 05:45:40 host2 sshd[4178734]: Disconnected from invalid user ts 51.75.194.10 port 57740 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.213.175.140
country_id: 2510769
description:
Jan  5 05:46:23 host2 sshd[4179778]: Disconnected from invalid user deployer 185.213.175.140 port 42652 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 85.18.236.229
country_id: 3175395
description:
Jan  5 05:47:59 host2 sshd[4181359]: Disconnected from invalid user jumpuser 85.18.236.229 port 32992 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.213.175.140
country_id: 2510769
description:
Jan  5 05:47:22 host2 sshd[4180781]: Disconnected from invalid user claude 185.213.175.140 port 6412 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.62.87.27
country_id: 3469034
description:
Jan  5 05:48:16 host2 sshd[4181649]: Disconnected from invalid user ubuntu 187.62.87.27 port 59712 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 05:48:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shop@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<iCeDAJlH/n0jupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 192.155.90.118
country_id: 6252001
description:
Jan  5 05:48:10 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=192.155.90.118, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<Smt6/phH2EPAm1p2>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.10.98
country_id: 6252001
description:
Jan  5 05:49:23 host2 sshd[4182707]: Disconnected from invalid user elastic 107.173.10.98 port 31920 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.75.161
country_id: 6252001
description:
Jan  5 05:49:14 host2 sshd[4182582]: Disconnected from invalid user claude 107.172.75.161 port 35346 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  5 05:49:29 host2 pure-ftpd[4182805]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.62.87.27
country_id: 3469034
description:
Jan  5 05:49:33 host2 sshd[4182853]: Disconnected from invalid user elastic 187.62.87.27 port 45558 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 69.5.189.189
country_id: 241170
description:
Jan  5 05:49:34 host2 sshd[4182864]: Disconnected from invalid user user 69.5.189.189 port 56204 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 05:50:53 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<TnEUCJlHRN5A46ZK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.10.98
country_id: 6252001
description:
Jan  5 05:50:18 host2 sshd[4183692]: Disconnected from invalid user kapil 107.173.10.98 port 58084 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.123.109.114
country_id: 732800
description:
Jan  5 05:50:48 host2 sshd[4184144]: Invalid user sivagnanamfoundation from 93.123.109.114 port 46956


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.75.194.10
country_id: 3017382
description:
Jan  5 05:51:23 host2 sshd[4184736]: Disconnected from invalid user radio 51.75.194.10 port 57000 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.141.132.26
country_id: 130758
description:
Jan  5 05:51:11 host2 sshd[4184471]: Disconnected from invalid user it 185.141.132.26 port 36178 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.75.161
country_id: 6252001
description:
Jan  5 05:52:10 host2 sshd[4185525]: Disconnected from invalid user claude 107.172.75.161 port 28686 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.10.98
country_id: 6252001
description:
Jan  5 05:52:15 host2 sshd[4185604]: Disconnected from invalid user hpc 107.173.10.98 port 55142 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  5 05:53:24 host2 sshd[4186570]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-01-05 05:54:30 dovecot_plain authenticator failed for H=(comium) [102.53.15.18]:51418: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 05:55:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<scsbGJlHkC6uijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 05:57:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<TkZhH5lHXpeOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  5 05:58:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<ElRUI5lHOuoFhXlo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.182.38
country_id: 1269750
description:
Jan  5 05:58:59 host2 sshd[4192039]: Disconnected from invalid user admin 64.227.182.38 port 46966 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.251.10
country_id: 6252001
description:
Jan  5 06:00:14 host2 sshd[4193444]: Disconnected from invalid user claude 199.195.251.10 port 42704 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.239.10.198
country_id: 357994
description:
2026-01-05 06:00:47 dovecot_login authenticator failed for H=([154.239.10.205]) [154.239.10.198]:50842: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.162.163
country_id: 298795
description:
2026-01-05 06:01:16 dovecot_login authenticator failed for H=([5.11.162.163]) [5.11.162.163]:55568: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 199.195.251.10
country_id: 6252001
description:
Jan  5 06:02:16 host2 sshd[1715]: Disconnected from invalid user rishabh 199.195.251.10 port 60206 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.251.10
country_id: 6252001
description:
Jan  5 06:01:33 host2 sshd[988]: Disconnected from invalid user claude 199.195.251.10 port 43622 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.251.10
country_id: 6252001
description:
Jan  5 06:03:41 host2 sshd[2986]: Disconnected from invalid user roo 199.195.251.10 port 36456 [preauth]


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 103.154.231.122
country_id: 1643084
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[103.154.231.122] [Remote Port]=[33518] [Authentication Database]=[mail] [Username]=[admin@anandaobauae.org] (10/10 failures) (blocked until [Tue Jan  6 00:34:10 2026 UTC/Tue Jan  6 06:04:10 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 06:04:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<6pmuN5lH7oJnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2026-01-05 06:05:41 dovecot_plain authenticator failed for H=c-73-13-220-220.hsd1.de.comcast.net (overbung) [73.13.220.220]:52646: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.182.38
country_id: 1269750
description:
Jan  5 06:06:33 host2 sshd[5614]: Disconnected from invalid user elasticsearch 64.227.182.38 port 47424 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.227.182.38
country_id: 1269750
description:
Jan  5 06:08:17 host2 sshd[7119]: Disconnected from invalid user claude 64.227.182.38 port 47564 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.64.215.64
country_id: 298795
description:
[2026-01-05 06:08:51 +0530] info [cpaneld] 212.64.215.64 - lezzarotech "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.2.4.105
country_id: 1819730
description:
Jan  5 06:12:15 host2 sshd[10705]: Disconnected from invalid user myuser 20.2.4.105 port 35288 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  5 06:12:57 host2 sshd[11791]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Jan  5 06:13:51 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.116.22, lip=66.85.158.92, TLS: Connection closed, session=<+ZpRWplH6KCLonQW>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.240.223.202
country_id: 6252001
description:
Jan  5 06:15:36 host2 pure-ftpd[14481]: (?@66.240.223.202) [INFO] New connection from 66.240.223.202


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.140.19.22
country_id: 1269750
description:
Jan  5 06:17:16 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=103.140.19.22, lip=66.85.158.91, session=<APtuZplHpsVnjBMW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.162.8.14
country_id: 3469034
description:
Jan  5 06:18:02 host2 sshd[16735]: Disconnected from invalid user administrator 45.162.8.14 port 42636 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.84.236.242
country_id: 1269750
description:
Jan  5 06:18:12 host2 sshd[16879]: Disconnected from invalid user david 103.84.236.242 port 59768 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.126
country_id: 6252001
description:
Jan  5 06:19:03 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.126, lip=66.85.158.92, TLS: Connection closed, session=<32frbJlHUvtChJl+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.162.8.14
country_id: 3469034
description:
Jan  5 06:18:42 host2 sshd[17247]: Disconnected from invalid user claude 45.162.8.14 port 55296 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.162.8.14
country_id: 3469034
description:
Jan  5 06:20:42 host2 sshd[19185]: Disconnected from invalid user claude 45.162.8.14 port 36808 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.233
country_id: 6252001
description:
Jan  5 06:20:49 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.233, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<jz9Bc5lHXMPG6xjp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.154.255
country_id: 1269750
description:
Jan  5 06:20:53 host2 sshd[19340]: Disconnected from invalid user claude 103.172.154.255 port 40968 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.162.8.14
country_id: 3469034
description:
Jan  5 06:22:05 host2 sshd[20468]: Disconnected from invalid user centos 45.162.8.14 port 33902 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.154.255
country_id: 1269750
description:
Jan  5 06:21:46 host2 sshd[20180]: Disconnected from invalid user admin 103.172.154.255 port 60930 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 06:21:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<QxKPdplHzE8jupN+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.172.154.255
country_id: 1269750
description:
Jan  5 06:22:03 host2 sshd[20425]: Disconnected from invalid user claude 103.172.154.255 port 57096 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 103.172.154.255
country_id: 1269750
description:
Jan  5 06:22:35 host2 sshd[20862]: Received disconnect from 103.172.154.255 port 45736:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.154.255
country_id: 1269750
description:
Jan  5 06:22:35 host2 sshd[20862]: Disconnected from invalid user developer 103.172.154.255 port 45736 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 06:25:48 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<uuXvhJlHNpVA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 06:27:34 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<zUZDi5lHIGuuijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 06:28:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<sam1jZlHVpSOq2dI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.15.170.124
country_id: 3017382
description:
Jan  5 06:31:09 host2 sshd[28718]: Disconnected from invalid user administrador 51.15.170.124 port 41602 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.212.34.236
country_id: 3895114
description:
Jan  5 06:31:13 host2 sshd[28798]: Disconnected from invalid user ubuntu 181.212.34.236 port 46214 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.15.170.124
country_id: 3017382
description:
Jan  5 06:31:45 host2 sshd[29406]: Disconnected from invalid user flink 51.15.170.124 port 47980 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.212.34.236
country_id: 3895114
description:
Jan  5 06:31:57 host2 sshd[29592]: Disconnected from invalid user dmdba 181.212.34.236 port 36214 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.212.34.236
country_id: 3895114
description:
Jan  5 06:32:36 host2 sshd[30242]: Disconnected from invalid user owncloud 181.212.34.236 port 34866 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.15.170.124
country_id: 3017382
description:
Jan  5 06:32:49 host2 sshd[30430]: Disconnected from invalid user claude 51.15.170.124 port 43904 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.212.34.236
country_id: 3895114
description:
Jan  5 06:33:15 host2 sshd[30868]: Disconnected from invalid user guest 181.212.34.236 port 58602 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.74.115.25
country_id: 1861060
description:
Jan  5 06:33:22 host2 sshd[30968]: Disconnected from invalid user testuser 40.74.115.25 port 32798 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.212.34.236
country_id: 3895114
description:
Jan  5 06:33:52 host2 sshd[31372]: Disconnected from invalid user park 181.212.34.236 port 46250 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.197.53.204
country_id: 1269750
description:
Jan  5 06:34:18 host2 sshd[31768]: Disconnected from invalid user test1 20.197.53.204 port 42950 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 40.74.115.25
country_id: 1861060
description:
Jan  5 06:34:41 host2 sshd[32086]: Disconnected from invalid user teamspeak 40.74.115.25 port 49384 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.74.115.25
country_id: 1861060
description:
Jan  5 06:35:21 host2 sshd[32877]: Disconnected from invalid user db-user 40.74.115.25 port 52172 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.120.182
country_id: 3144096
description:
2026-01-05 06:37:19 dovecot_login authenticator failed for H=(cm-178.232.120.182.get.no) [178.232.120.182]:43174: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.181.87.33
country_id: 298795
description:
Jan  5 06:37:37 host2 sshd[35081]: Disconnected from invalid user webadm 5.181.87.33 port 34304 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.50.221
country_id: 3144096
description:
2026-01-05 06:38:18 dovecot_login authenticator failed for H=([178.232.50.221]) [178.232.50.221]:33322: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.170
country_id: 1643084
description:
Jan  5 06:37:35 host2 sshd[35052]: Disconnected from invalid user claude 27.112.78.170 port 43226 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.51.153.37
country_id: 3469034
description:
Jan  5 06:38:27 host2 sshd[35831]: Disconnected from invalid user reza 179.51.153.37 port 36402 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.248.139
country_id: 1880251
description:
Jan  5 06:38:45 host2 sshd[36018]: Disconnected from invalid user sns 188.166.248.139 port 60770 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.181.87.33
country_id: 298795
description:
Jan  5 06:40:51 host2 sshd[38368]: Disconnected from invalid user service 5.181.87.33 port 33600 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.170
country_id: 1643084
description:
Jan  5 06:41:33 host2 sshd[39147]: Disconnected from invalid user cssserver 27.112.78.170 port 40902 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 06:41:40 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<SqSrvZlHAJBnmud6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 5.181.87.33
country_id: 298795
description:
Jan  5 06:41:25 host2 sshd[38926]: Disconnected from invalid user jeffrey 5.181.87.33 port 35252 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.181.87.33
country_id: 298795
description:
Jan  5 06:42:32 host2 sshd[40075]: Disconnected from invalid user sandbox 5.181.87.33 port 37058 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.112.78.170
country_id: 1643084
description:
Jan  5 06:43:08 host2 sshd[40674]: Disconnected from invalid user marcela 27.112.78.170 port 40050 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.170
country_id: 1643084
description:
Jan  5 06:43:51 host2 sshd[41393]: Disconnected from invalid user admin4 27.112.78.170 port 42052 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.124.127
country_id: 1819730
description:
Jan  5 06:44:00 host2 sshd[41536]: Disconnected from invalid user ubuntu 101.36.124.127 port 50122 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2026-01-05 06:44:17 dovecot_plain authenticator failed for H=c-73-197-194-98.hsd1.nj.comcast.net (rated) [73.197.194.98]:34198: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.202.197.108
country_id: 6252001
description:
2026-01-05 06:44:20 dovecot_plain authenticator failed for H=(martar) [50.202.197.108]:55974: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.124.127
country_id: 1819730
description:
Jan  5 06:44:42 host2 sshd[42170]: Disconnected from invalid user postgres 101.36.124.127 port 52014 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.51.153.37
country_id: 3469034
description:
Jan  5 06:44:51 host2 sshd[42317]: Disconnected from invalid user localhost 179.51.153.37 port 58886 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.51.153.37
country_id: 3469034
description:
Jan  5 06:46:17 host2 sshd[44387]: Disconnected from invalid user ubuntu 179.51.153.37 port 46396 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.124.127
country_id: 1819730
description:
Jan  5 06:45:21 host2 sshd[43273]: Disconnected from invalid user claude 101.36.124.127 port 42444 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.248.139
country_id: 1880251
description:
Jan  5 06:45:49 host2 sshd[43871]: Disconnected from invalid user claude 188.166.248.139 port 54344 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.51.153.37
country_id: 3469034
description:
Jan  5 06:48:25 host2 sshd[46625]: Disconnected from invalid user pq 179.51.153.37 port 53742 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2026-01-05 06:51:13 dovecot_plain authenticator failed for H=(nomer) [178.250.191.189]:41348: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  5 06:52:35 host2 pure-ftpd[50845]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.73.195.150
country_id: 290557
description:
Jan  5 06:53:30 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<enveng@lezzarotech.com>, method=PLAIN, rip=91.73.195.150, lip=66.85.158.91, session=<gsHz55lH6ZhbScOW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.226.88.121
country_id: 2661886
description:
Jan  5 06:53:30 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<eng_env@lezzarotech.com>, method=PLAIN, rip=81.226.88.121, lip=66.85.158.91, session=<P9f455lHbJBR4lh5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.233.140.250
country_id: 3469034
description:
Jan  5 06:53:57 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<env>, method=PLAIN, rip=181.233.140.250, lip=66.85.158.91, session=<tAiG6ZlH2KG16Yz6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.19.195.12
country_id: 3144096
description:
Jan  5 06:54:14 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<env.eng>, method=PLAIN, rip=85.19.195.12, lip=66.85.158.91, TLS, session=<HjHN6ZlHLulVE8MM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.148.194
country_id: 99237
description:
Jan  5 06:53:24 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<eng@lezzarotech.com>, method=PLAIN, rip=65.20.148.194, lip=66.85.158.91, session=<+AOa55lH/a1BFJTC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.59.202.241
country_id: 149590
description:
Jan  5 06:53:32 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<env.eng@lezzarotech.com>, method=PLAIN, rip=41.59.202.241, lip=66.85.158.91, session=<mnAX6JlHIqcpO8rx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 105.72.176.66
country_id: 2542007
description:
Jan  5 06:53:55 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<engenv>, method=PLAIN, rip=105.72.176.66, lip=66.85.158.91, TLS, session=<Ze2q6JlHVMJpSLBC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.200.6.38
country_id: 3469034
description:
Jan  5 06:53:58 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 25 secs): user=<enveng@lezzarotech.com>, method=PLAIN, rip=186.200.6.38, lip=66.85.158.91, TLS, session=<VKRL6JlH+Ma6yAYm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.218.95.154
country_id: 6252001
description:
Jan  5 06:53:37 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<engenv@lezzarotech.com>, method=PLAIN, rip=74.218.95.154, lip=66.85.158.91, TLS, session=<km5855lHFeVK2l+a>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.163.103
country_id: 99237
description:
Jan  5 06:53:42 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<eng_env@lezzarotech.com>, method=PLAIN, rip=65.20.163.103, lip=66.85.158.91, session=<if266JlH/o1BFKNn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 130.255.96.29
country_id: 3175395
description:
Jan  5 06:53:56 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<env.eng@lezzarotech.com>, method=PLAIN, rip=130.255.96.29, lip=66.85.158.91, session=<X9eJ6ZlHOxWC/2Ad>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.68.22.140
country_id: 1269750
description:
Jan  5 06:54:00 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<eng.env>, method=PLAIN, rip=103.68.22.140, lip=66.85.158.91, session=<ecPJ6ZlHsexnRBaM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.174.34.49
country_id: 1269750
description:
Jan  5 06:54:02 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<eng_env@lezzarotech.com>, method=PLAIN, rip=103.174.34.49, lip=66.85.158.91, session=<JhfL6ZlHLO9nriIx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.171.12.170
country_id: 1269750
description:
Jan  5 06:54:13 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<enveng>, method=PLAIN, rip=103.171.12.170, lip=66.85.158.91, session=<kexw6plH0uJnqwyq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 61.2.44.54
country_id: 1269750
description:
Jan  5 06:53:31 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<eng-env@lezzarotech.com>, method=PLAIN, rip=61.2.44.54, lip=66.85.158.91, session=<S/H755lH7uk9Aiw2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 78.68.37.25
country_id: 2661886
description:
Jan  5 06:53:34 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<env@lezzarotech.com>, method=PLAIN, rip=78.68.37.25, lip=66.85.158.91, TLS, session=<BlFr55lH4MJORCUZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.235.31.47
country_id: 6252001
description:
Jan  5 06:53:38 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<eng.env@lezzarotech.com>, method=PLAIN, rip=50.235.31.47, lip=66.85.158.91, TLS, session=<0a1555lH+qAy6x8v>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.241.132.152
country_id: 1269750
description:
Jan  5 06:53:47 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<env.eng@lezzarotech.com>, method=PLAIN, rip=43.241.132.152, lip=66.85.158.91, session=<Mdzu6JlH8Kgr8YSY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.212.178
country_id: 732800
description:
Jan  5 06:53:59 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<eng-env@lezzarotech.com>, method=PLAIN, rip=185.255.212.178, lip=66.85.158.91, session=<45S86ZlH7VG5/9Sy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.57.184.151
country_id: 1269750
description:
Jan  5 06:54:04 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 9 secs): user=<eng>, method=PLAIN, rip=103.57.184.151, lip=66.85.158.91, session=<gZmd6ZlHwrFnObiX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.153.146
country_id: 99237
description:
Jan  5 06:54:21 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<eng.env>, method=PLAIN, rip=65.20.153.146, lip=66.85.158.91, TLS, session=<X6US6plHHqRBFJmS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.93.68.178
country_id: 3469034
description:
Jan  5 06:54:23 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<eng>, method=PLAIN, rip=187.93.68.178, lip=66.85.158.91, TLS, session=<5eAc6plH6+C7XUSy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.93.154.207
country_id: 1643084
description:
Jan  5 06:54:41 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=36.93.154.207, lip=66.85.158.91, session=<52wU7JlHbN0kXZrP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.220.10.60
country_id: 1269750
description:
Jan  5 06:54:20 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<env>, method=PLAIN, rip=117.220.10.60, lip=66.85.158.91, TLS, session=<rHPf6ZlHXMR13Ao8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 59.183.56.107
country_id: 1269750
description:
Jan  5 06:55:09 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<eng-env>, method=PLAIN, rip=59.183.56.107, lip=66.85.158.91, session=<G0bT7ZlHnac7tzhr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.7
country_id: 2635167
description:
Jan  5 06:55:09 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.7, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<2f8H7plHJaZX7LAH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.47.172.253
country_id: 2287781
description:
Jan  5 06:54:59 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<env-eng>, method=PLAIN, rip=196.47.172.253, lip=66.85.158.91, TLS, session=<o3NN7JlH+cXEL6z9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.32.99.14
country_id: 290557
description:
Jan  5 06:55:01 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=5.32.99.14, lip=66.85.158.91, TLS, session=<d3937JlHKJwFIGMO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.187.226.13
country_id: 1269750
description:
Jan  5 06:54:37 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<enveng>, method=PLAIN, rip=122.187.226.13, lip=66.85.158.91, TLS, session=<bVvQ6plHaM56u+IN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 80.227.102.242
country_id: 290557
description:
Jan  5 06:54:21 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<eng-env@lezzarotech.com>, method=PLAIN, rip=80.227.102.242, lip=66.85.158.91, TLS, session=<A68A6plHZaFQ42by>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.100
country_id: 2635167
description:
Jan  5 06:55:08 host2 dovecot[1170291]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.100, lip=66.85.158.92, TLS, session=<B/797ZlHqaFX7LBk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.129.28
country_id: 99237
description:
Jan  5 06:54:20 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<eng_env>, method=PLAIN, rip=65.20.129.28, lip=66.85.158.91, TLS, session=<y/MY6plHK7dBFIEc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.174.63
country_id: 99237
description:
Jan  5 06:56:05 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<eng-env>, method=PLAIN, rip=65.20.174.63, lip=66.85.158.91, session=<egMn8ZlHm6NBFK4/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.193.122.91
country_id: 690791
description:
Jan  5 06:56:17 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<eng-env>, method=PLAIN, rip=82.193.122.91, lip=66.85.158.91, session=<bTPs8ZlHEalSwXpb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.27
country_id: 2635167
description:
Jan  5 06:56:16 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=185.247.137.27, lip=66.85.158.92, TLS handshaking: Connection closed, session=<HLME8plHUd+594kb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 06:55:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<GKGN7plH9NsjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.233.235.203
country_id: 2661886
description:
Jan  5 06:55:19 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<env_eng>, method=PLAIN, rip=81.233.235.203, lip=66.85.158.91, TLS, session=<G32o7ZlHMsBR6evL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.12
country_id: 2635167
description:
Jan  5 06:55:42 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.12, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<bHkD8JlHi+dX7LAM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.30
country_id: 2635167
description:
Jan  5 06:56:49 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.30, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<ExoA9JlH3btX7LAe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.68.22.140
country_id: 1269750
description:
Jan  5 06:57:15 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<eng-env>, method=PLAIN, rip=103.68.22.140, lip=66.85.158.91, session=<jv9Q9ZlHocpnRBaM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.26
country_id: 2635167
description:
Jan  5 06:57:22 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.26, lip=66.85.158.92, TLS handshaking: Connection closed, session=<OID79ZlHZ85X7LAa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.26
country_id: 2635167
description:
Jan  5 06:57:56 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.26, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<MDIE+JlH0YW594ka>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.6
country_id: 2635167
description:
Jan  5 06:58:30 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.6, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<bmMB+plHu69X7LAG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.24
country_id: 2635167
description:
Jan  5 06:59:03 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.24, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<Or38+5lH8aq594kY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 06:59:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<o4EK/ZlHxoWOq2dI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.17
country_id: 2635167
description:
Jan  5 06:59:36 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.17, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<eCv2/ZlHg+q594kR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.23
country_id: 2635167
description:
Jan  5 07:00:09 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (disconnected before auth was ready, waited 0 secs): user=<>, rip=87.236.176.23, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<xKDx/5lH1blX7LAX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 07:00:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shop@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<ccVUAJpHpoyuijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 07:00:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<Qs49AppHtNhA46ZK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.36.108
country_id: 3932488
description:
2026-01-05 07:08:04 dovecot_login authenticator failed for H=([190.223.36.108]) [190.223.36.108]:49126: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.64
country_id: 1733045
description:
2026-01-05 07:08:28 dovecot_login authenticator failed for H=([49.125.201.64]) [49.125.201.64]:43774: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.245.117.221
country_id: 1880251
description:
Jan  5 07:10:34 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=47.245.117.221, lip=66.85.158.92, session=<AwwtJZpH+oQv9XXd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  5 07:11:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<82e2J5pHnKIFhXlo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.202
country_id: 6252001
description:
Jan  5 07:14:50 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.202, lip=66.85.158.91, session=<sPtpNJpH7ujG6xjK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.190.22.247
country_id: 2750405
description:
Jan  5 07:16:04 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=146.190.22.247, lip=66.85.158.91, session=<bl+JOJpHKsCSvhb3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.84.211.204
country_id: 6252001
description:
Jan  5 07:17:06 host2 sshd[79415]: Disconnected from invalid user invoices 50.84.211.204 port 50672 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.62.43.176
country_id: 2635167
description:
Jan  5 07:17:51 host2 sshd[80075]: Disconnected from invalid user cssserver 178.62.43.176 port 58120 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.84.211.204
country_id: 6252001
description:
Jan  5 07:18:04 host2 sshd[80340]: Disconnected from invalid user josh 50.84.211.204 port 39024 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.174.129.232
country_id: 2542007
description:
Jan  5 07:18:05 host2 sshd[80353]: Disconnected from invalid user denise 160.174.129.232 port 55008 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 80.82.77.139
country_id: 2750405
description:
Jan  5 07:18:31 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=80.82.77.139, lip=66.85.158.92, session=<25WaQZpHEr5QUk2L>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 80.82.77.139
country_id: 2750405
description:
Jan  5 07:18:30 host2 dovecot[1170291]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=80.82.77.139, lip=66.85.158.92, session=<ke6KQZpHZrZQUk2L>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 50.84.211.204
country_id: 6252001
description:
Jan  5 07:18:37 host2 sshd[80841]: Disconnected from invalid user emma 50.84.211.204 port 51468 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 160.174.129.232
country_id: 2542007
description:
Jan  5 07:19:41 host2 sshd[81946]: Disconnected from invalid user steam 160.174.129.232 port 28514 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.84.211.204
country_id: 6252001
description:
Jan  5 07:19:43 host2 sshd[81983]: Disconnected from invalid user system 50.84.211.204 port 48122 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 07:19:57 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<x3GbRppHwLVnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.62.43.176
country_id: 2635167
description:
Jan  5 07:21:10 host2 sshd[83614]: Disconnected from invalid user claude 178.62.43.176 port 54586 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.62.43.176
country_id: 2635167
description:
Jan  5 07:21:40 host2 sshd[84066]: Disconnected from invalid user ben 178.62.43.176 port 56598 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 178.62.43.176
country_id: 2635167
description:
Jan  5 07:22:10 host2 sshd[84526]: Disconnected from invalid user iptv 178.62.43.176 port 39336 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.62.43.176
country_id: 2635167
description:
Jan  5 07:22:39 host2 sshd[84918]: Disconnected from invalid user ftptest 178.62.43.176 port 42500 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  5 07:25:15 host2 sshd[87532]: Disconnected from invalid user admin 2.57.121.112 port 28482 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 07:28:16 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shop@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<LR5UZJpH7ukjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.54.62.66
country_id: 3469034
description:
Jan  5 07:27:21 host2 sshd[89607]: Disconnected from invalid user sandeep 177.54.62.66 port 63361 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2026-01-05 07:28:32 dovecot_plain authenticator failed for H=(howely) [102.53.15.180]:58199: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2026-01-05 07:28:28 dovecot_plain authenticator failed for H=c-71-224-169-28.hsd1.pa.comcast.net (anemeling) [71.224.169.28]:35116: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.54.62.66
country_id: 3469034
description:
Jan  5 07:28:44 host2 sshd[90982]: Disconnected from invalid user radio 177.54.62.66 port 61176 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2026-01-05 07:30:02 dovecot_plain authenticator failed for H=(unhonia) [91.73.195.150]:41364: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 07:30:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<uSega5pH4puOq2dI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.54.62.66
country_id: 3469034
description:
Jan  5 07:30:38 host2 sshd[92820]: Disconnected from invalid user frontend 177.54.62.66 port 53063 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 07:32:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<+N+0cZpHnMeuijvy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2026-01-05 07:33:45 dovecot_plain authenticator failed for H=c-68-60-77-128.hsd1.mi.comcast.net (reake) [68.60.77.128]:33056: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2026-01-05 07:33:49 dovecot_plain authenticator failed for H=c-68-40-189-43.hsd1.mi.comcast.net (conity) [68.40.189.43]:56508: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 07:35:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<Fn2nf5pHYuFA46ZK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  5 07:37:40 host2 sshd[99108]: Disconnected from invalid user user 2.57.121.25 port 42863 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.123.109.114
country_id: 732800
description:
Jan  5 07:44:26 host2 sshd[104883]: Invalid user sivagnanamfoundation from 93.123.109.114 port 57576


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.251.92.56
country_id: 6252001
description:
Jan  5 07:46:30 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=783) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=47.251.92.56, lip=66.85.158.92, TLS handshaking: read(size=783) failed: Connection reset by peer, session=<NaOopZpHnEYv+1w4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.251.53.147
country_id: 6252001
description:
Jan  5 07:47:00 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=47.251.53.147, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<uoRzp5pHjEkv+zWT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  5 07:48:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<8X1NrppHaNoDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  5 07:49:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<URnZsZpH9q4DgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  5 07:51:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: Connection closed, session=<EbyZt5pHAoIDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.190.155.43
country_id: 6252001
description:
2026-01-05 07:51:58 dovecot_plain authenticator failed for H=(shorkly) [76.190.155.43]:48724: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  5 07:52:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<vhuiu5pHcIIDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  5 07:53:43 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<rYaEv5pH/psDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  5 07:55:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<0/3LxJpH/LwDgmBb>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  5 07:56:22 host2 pure-ftpd[117649]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2026-01-05 07:56:25 dovecot_plain authenticator failed for H=(freption) [90.161.217.228]:54213: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  5 07:56:34 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: Connection closed, session=<25KqyZpHsr4DgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  5 07:57:49 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<kQ4hzppHMooDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 07:58:01 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<ZMXAzppHVr5nmud6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  5 07:58:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS, session=<q0N50JpHdMwDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 08:01:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<0r7D2ppHdGwjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 08:01:35 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<YNx725pHXpqOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 08:04:08 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<QtOe5JpH8Miuijvy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-05 08:04:21 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:53290: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.196.9.141
country_id: 2635167
description:
Jan  5 08:05:40 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=978) failed: Connection reset by peer (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=185.196.9.141, lip=66.85.158.91, session=<coYh6ppHXIy5xAmN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.203.138
country_id: 1269750
description:
2026-01-05 08:07:49 dovecot_login authenticator failed for H=([122.185.0.201]) [125.23.203.138]:39016: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.228.234
country_id: 1269750
description:
2026-01-05 08:08:12 dovecot_login authenticator failed for H=([182.76.228.234]) [182.76.228.234]:45590: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.53.124
country_id: 6252001
description:
Jan  5 08:08:25 host2 sshd[128733]: Disconnected from invalid user administrator 209.141.53.124 port 55848 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.46
country_id: 1269750
description:
2026-01-05 08:08:59 dovecot_login authenticator failed for H=([125.19.156.46]) [125.19.156.46]:58416: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.53.124
country_id: 6252001
description:
Jan  5 08:09:40 host2 sshd[129976]: Disconnected from invalid user admin 209.141.53.124 port 42934 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.76.188.180
country_id: 1819730
description:
2026-01-05 08:09:24 dovecot_login authenticator failed for H=180.188.76.219.static.netvigator.com [219.76.188.180]:63875: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 08:11:35 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<es5J/5pHftlA46ZK>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.141.53.124
country_id: 6252001
description:
Jan  5 08:13:43 host2 sshd[134317]: Disconnected from invalid user sammy 209.141.53.124 port 42910 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.158.255
country_id: 1227603
description:
Jan  5 08:14:35 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=175.157.158.255, lip=66.85.158.91, TLS handshaking: Connection closed, session=<bVYZCptHLeSvnZ7/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.37.253.93
country_id: 6252001
description:
2026-01-05 08:15:46 dovecot_plain authenticator failed for H=([169.254.167.31]) [193.37.253.93]:12179: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.53.124
country_id: 6252001
description:
Jan  5 08:15:19 host2 sshd[135978]: Disconnected from invalid user db2inst1 209.141.53.124 port 37254 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 193.37.253.93
country_id: 6252001
description:
Jan  5 08:16:12 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=193.37.253.93, lip=66.85.158.91, TLS handshaking: Connection closed, session=<BajnD5tHXOHBJf1d>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.120.138.3
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 37.120.138.3 - env_eng@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  5 08:21:34 host2 sshd[141698]: Disconnected from invalid user user 2.57.121.25 port 38781 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.140.19.22
country_id: 1269750
description:
Jan  5 08:21:14 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=103.140.19.22, lip=66.85.158.91, session=<vZXCIZtH2MlnjBMW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.171.8.85
country_id: 6252001
description:
Jan  5 08:32:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.171.8.85, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<JF+qS5tHuMIUqwhV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 08:32:57 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<i5SpS5tHOJqOq2dI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2026-01-05 08:34:40 dovecot_login authenticator failed for H=([196.191.212.235]) [213.55.85.202]:4084: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 08:34:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<9gKtUptH8kMjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.47
country_id: 3469034
description:
Jan  5 08:34:58 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=190.89.137.47, lip=66.85.158.91, TLS, session=<oFrhUZtHE+6+WYkv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.221.254.250
country_id: 783754
description:
2026-01-05 08:35:01 dovecot_login authenticator failed for H=([185.221.254.250]) [185.221.254.250]:38899: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.196.70
country_id: 3469034
description:
Jan  5 08:35:00 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=179.189.196.70, lip=66.85.158.91, TLS, session=<Ld/lUZtHbaWzvcRG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.74.5.68
country_id: 2395170
description:
Jan  5 08:35:19 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<hr>, method=PLAIN, rip=41.74.5.68, lip=66.85.158.91, TLS, session=<jiQkU5tHSr0pSgVE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.245.219.226
country_id: 6290252
description:
Jan  5 08:35:19 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<hr>, method=PLAIN, rip=109.245.219.226, lip=66.85.158.91, TLS, session=<I95BU5tHTqFt9dvi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.9.200.229
country_id: 2510769
description:
2026-01-05 08:36:08 dovecot_login authenticator failed for H=229.red-88-9-200.dynamicip.rima-tde.net [88.9.200.229]:52954: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.48.229.117
country_id: 3469034
description:
2026-01-05 08:36:48 dovecot_login authenticator failed for H=ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:58532: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.236.66
country_id: 6252001
description:
2026-01-05 08:36:50 dovecot_plain authenticator failed for H=c-73-213-236-66.hsd1.va.comcast.net (spallarin) [73.213.236.66]:43688: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.170.59
country_id: 99237
description:
2026-01-05 08:37:00 dovecot_login authenticator failed for H=([65.20.170.59]) [65.20.170.59]:53536: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.143.166
country_id: 1819730
description:
2026-01-05 08:36:33 dovecot_login authenticator failed for H=166.143.48.116.static.netvigator.com [116.48.143.166]:56466: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 08:36:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<26Q+WZtHhNVnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 08:37:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<UWu8XJtH/oSuijvy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.114
country_id: 6252001
description:
Jan  5 08:43:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=147.185.133.114, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<F3dYcptH1MaTuYVy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.114
country_id: 6252001
description:
Jan  5 08:44:59 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 12 secs): user=<>, rip=147.185.133.114, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<k1jTdptHxOSTuYVy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  5 08:46:31 host2 sshd[163936]: Disconnected from invalid user admin 2.57.121.112 port 56541 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 08:47:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<zx9uf5tHzsxA46ZK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.151.91.78
country_id: 732800
description:
Jan  5 08:49:54 host2 sshd[168704]: Disconnected from invalid user me 45.151.91.78 port 58904 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.254.149.199
country_id: 1605651
description:
Jan  5 08:49:19 host2 sshd[167952]: Disconnected from invalid user data 27.254.149.199 port 59714 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.149.199
country_id: 1605651
description:
Jan  5 08:50:35 host2 sshd[169793]: Disconnected from invalid user debian 27.254.149.199 port 53896 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.218.244
country_id: 1880251
description:
Jan  5 08:50:57 host2 sshd[170069]: Disconnected from invalid user facturacion 152.32.218.244 port 34220 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.149.199
country_id: 1605651
description:
Jan  5 08:51:17 host2 sshd[170422]: Disconnected from invalid user claude 27.254.149.199 port 36876 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.81.244.142
country_id: 1269750
description:
Jan  5 08:51:45 host2 sshd[170921]: Disconnected from invalid user onkar 40.81.244.142 port 36880 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.114
country_id: 6252001
description:
Jan  5 08:52:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.133.114, lip=66.85.158.91, TLS, session=<PeawkJtHEOGTuYVy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.218.244
country_id: 1880251
description:
Jan  5 08:52:20 host2 sshd[171657]: Disconnected from invalid user userftp 152.32.218.244 port 58498 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.151.91.78
country_id: 732800
description:
Jan  5 08:52:36 host2 sshd[171976]: Disconnected from invalid user user 45.151.91.78 port 47412 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.216.116.13
country_id: 1819730
description:
Jan  5 08:52:51 host2 sshd[172161]: Disconnected from invalid user server 185.216.116.13 port 59268 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  5 08:53:48 host2 sshd[172912]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.218.244
country_id: 1880251
description:
Jan  5 08:54:47 host2 sshd[174242]: Disconnected from invalid user claude 152.32.218.244 port 33200 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.234.207.202
country_id: 6252001
description:
Jan  5 08:54:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.234.207.202, lip=66.85.158.91, TLS handshaking: Connection closed, session=<aCG0l5tHxIys6s/K>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.151.91.78
country_id: 732800
description:
Jan  5 08:54:11 host2 sshd[173463]: Disconnected from invalid user tim 45.151.91.78 port 56044 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.53.184.147
country_id: 2782113
description:
Jan  5 08:55:54 host2 sshd[175771]: Disconnected from invalid user panel 152.53.184.147 port 51952 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.31.255.21
country_id: 6252001
description:
Jan  5 08:56:16 host2 sshd[176119]: Disconnected from invalid user test01 144.31.255.21 port 33014 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.197.78.36
country_id: 6252001
description:
Jan  5 08:56:50 host2 sshd[176654]: Disconnected from invalid user claude 138.197.78.36 port 40208 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.97.44.51
country_id: 3175395
description:
Jan  5 08:56:55 host2 sshd[176727]: Disconnected from invalid user qiyuesuo 62.97.44.51 port 43816 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.38.130.3
country_id: 3017382
description:
Jan  5 08:56:12 host2 sshd[176037]: Disconnected from invalid user ftpuser 51.38.130.3 port 53318 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.216.116.13
country_id: 1819730
description:
Jan  5 08:56:20 host2 sshd[176195]: Disconnected from invalid user ts3 185.216.116.13 port 33830 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.97.44.51
country_id: 3175395
description:
Jan  5 08:56:22 host2 sshd[176214]: Disconnected from invalid user test 62.97.44.51 port 32976 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.38.130.3
country_id: 3017382
description:
Jan  5 08:57:18 host2 sshd[177247]: Disconnected from invalid user ubuntu 51.38.130.3 port 48834 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.197.78.36
country_id: 6252001
description:
Jan  5 08:57:24 host2 sshd[177332]: Disconnected from invalid user compta 138.197.78.36 port 59478 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.253.156.184
country_id: 1643084
description:
Jan  5 08:57:48 host2 sshd[177680]: Disconnected from invalid user gabriel 182.253.156.184 port 45696 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.97.44.51
country_id: 3175395
description:
Jan  5 08:57:59 host2 sshd[177825]: Disconnected from invalid user arduino 62.97.44.51 port 38716 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.216.116.13
country_id: 1819730
description:
Jan  5 08:57:41 host2 sshd[177582]: Disconnected from invalid user kafka 185.216.116.13 port 57116 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.38.130.3
country_id: 3017382
description:
Jan  5 08:58:21 host2 sshd[178205]: Disconnected from invalid user ubuntu 51.38.130.3 port 49830 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.253.156.184
country_id: 1643084
description:
Jan  5 08:58:25 host2 sshd[178274]: Disconnected from invalid user newuser 182.253.156.184 port 57498 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.53.184.147
country_id: 2782113
description:
Jan  5 08:59:04 host2 sshd[178961]: Disconnected from invalid user claude 152.53.184.147 port 40828 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.216.116.13
country_id: 1819730
description:
Jan  5 08:58:23 host2 sshd[178242]: Disconnected from invalid user kamil 185.216.116.13 port 40532 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.197.78.36
country_id: 6252001
description:
Jan  5 08:58:35 host2 sshd[178476]: Disconnected from invalid user ito 138.197.78.36 port 60666 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.31.255.21
country_id: 6252001
description:
Jan  5 08:58:44 host2 sshd[178583]: Disconnected from invalid user steam 144.31.255.21 port 48438 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.31.255.21
country_id: 6252001
description:
Jan  5 08:59:13 host2 sshd[179121]: Disconnected from invalid user ate 144.31.255.21 port 43942 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.237.126.9
country_id: 6252001
description:
Jan  5 08:59:34 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=135.237.126.9, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<VIj5qptHsOGH7X4J>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.253.156.184
country_id: 1643084
description:
Jan  5 08:59:39 host2 sshd[179504]: Disconnected from invalid user steam 182.253.156.184 port 52870 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.53.184.147
country_id: 2782113
description:
Jan  5 08:59:41 host2 sshd[179537]: Disconnected from invalid user claude 152.53.184.147 port 37042 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.221.50.123
country_id: 3865483
description:
Jan  5 08:59:52 host2 sshd[179696]: Disconnected from invalid user claude 190.221.50.123 port 47326 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  5 09:00:19 host2 pure-ftpd[180378]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.221.50.123
country_id: 3865483
description:
Jan  5 09:00:30 host2 sshd[180533]: Disconnected from invalid user user 190.221.50.123 port 39150 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.221.50.123
country_id: 3865483
description:
Jan  5 09:01:08 host2 sshd[181106]: Disconnected from invalid user user 190.221.50.123 port 39628 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.230.228.16
country_id: 6252001
description:
2026-01-05 09:01:40 dovecot_plain authenticator failed for H=c-71-230-228-16.hsd1.de.comcast.net (chypotly) [71.230.228.16]:35696: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.31.74
country_id: 1522867
description:
2026-01-05 09:01:42 dovecot_plain authenticator failed for H=2.135.31.74.dynamic.telecom.kz (louts) [2.135.31.74]:58426: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.221.50.123
country_id: 3865483
description:
Jan  5 09:02:26 host2 sshd[182476]: Disconnected from invalid user ate 190.221.50.123 port 44454 [preauth]


