# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.147.96
country_id: 1733045
description:
2026-01-02 20:12:16 dovecot_login authenticator failed for H=([49.124.147.96]) [49.124.147.96]:60044: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  2 20:12:39 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@maximsholdings.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<Yk59uGhH5NBCdMzo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.164.177.6
country_id: 390903
description:
2026-01-02 20:13:06 dovecot_login authenticator failed for H=([95.164.177.6]) [95.164.177.6]:58268: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.142.45
country_id: 6252001
description:
Jan  2 20:13:48 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colourmarklabels.com>, method=PLAIN, rip=47.251.142.45, lip=66.85.158.91, session=<SGKVvGhH3r4v+44t>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.57.154.177
country_id: 3175395
description:
Jan  2 20:14:49 host2 sshd[269213]: Disconnected from invalid user ivan 151.57.154.177 port 64237 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.92.171.7
country_id: 6252001
description:
Jan  2 20:14:55 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=190.92.171.7, lip=66.85.158.91, session=<1lCGwGhHkpq+XKsH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.93.7.194
country_id: 1821275
description:
Jan  2 20:15:54 host2 sshd[270604]: Disconnected from invalid user ubuntu 182.93.7.194 port 43816 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.93.7.194
country_id: 1821275
description:
Jan  2 20:16:22 host2 sshd[271041]: Disconnected from invalid user brandon 182.93.7.194 port 33280 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.23.88.153
country_id: 798544
description:
Jan  2 20:16:23 host2 sshd[271058]: Disconnected from invalid user ftproot 94.23.88.153 port 55112 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.93.7.194
country_id: 1821275
description:
Jan  2 20:16:50 host2 sshd[271469]: Disconnected from invalid user pub 182.93.7.194 port 59016 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  2 20:16:16 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<Pk9hxWhHroOi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  2 20:17:26 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<7ViWyWhHRsOeRdvj>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 102.204.223.112
country_id: 2328926
description:
Jan  2 20:18:20 host2 pure-ftpd[273064]: (?@102.204.223.112) [INFO] New connection from 102.204.223.112


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.218.54.218
country_id: 6252001
description:
Jan  2 20:19:19 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=104.218.54.218, lip=66.85.158.91, session=<dq9V0GhHyNlo2jba>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  2 20:19:21 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<a85x0GhHBN5IpyJ4>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  2 20:19:30 host2 pure-ftpd[274125]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  2 20:19:51 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<n+E20mhHJLIUOAHJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.225.40.153
country_id: 6252001
description:
Jan  2 20:20:17 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=64.225.40.153, lip=66.85.158.91, session=<cpTD02hHaqNA4SiZ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.23.88.153
country_id: 798544
description:
Jan  2 20:21:20 host2 sshd[276766]: Disconnected from invalid user es 94.23.88.153 port 60218 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 94.23.88.153
country_id: 798544
description:
Jan  2 20:23:04 host2 sshd[278621]: Disconnected from invalid user mine 94.23.88.153 port 39434 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Jan  2 20:22:17 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@venee.lk>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<G9nn2mhHaqoI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  2 20:22:55 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<Xxcy3WhHlNYyBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan  2 20:23:05 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<yW/H3WhHhpQvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  2 20:24:22 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<b1Ni4mhHBpMv/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  2 20:25:21 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<6wzj5WhHmN9nmud6>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.219.237.111
country_id: 6252001
description:
Jan  2 20:26:05 host2 pure-ftpd[281645]: (?@104.219.237.111) [INFO] New connection from 104.219.237.111


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  2 20:26:19 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<0y1h6WhHnOEv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.153.103.233
country_id: 1210997
description:
2026-01-02 20:26:38 dovecot_plain authenticator failed for H=(R27PCKV70FQ2DWX) [59.153.103.233]:60368: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  2 20:27:00 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<HhzP62hHWMKuijvy>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  2 20:28:05 host2 sshd[283518]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  2 20:30:24 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<zPn492hHUOtnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.225.40.153
country_id: 6252001
description:
Jan  2 20:31:07 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=64.225.40.153, lip=66.85.158.91, session=<RYyA+mhH/NpA4SiZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  2 20:31:13 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<fzjn+mhHEItyB6Oa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.53.44.125
country_id: 1643084
description:
Jan  2 20:31:45 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@mathsmotorcysle.xyz>, method=PLAIN, rip=117.53.44.125, lip=66.85.158.91, session=<iGHN/GhH6q11NSx9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.2.98.122
country_id: 719819
description:
2026-01-02 20:32:11 dovecot_plain authenticator failed for H=5402627a.dsl.pool.telekom.hu (7J2Z8VH88YREWO) [84.2.98.122]:60007: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.214
country_id: 1269750
description:
2026-01-02 20:32:15 dovecot_login authenticator failed for H=([182.95.181.214]) [182.95.181.214]:43278: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.1.58.85
country_id: 6251999
description:
2026-01-02 20:32:32 dovecot_login authenticator failed for H=([96.1.58.85]) [96.1.58.85]:55746: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  2 20:32:34 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<+gWz/2hH3Lpn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.92.171.7
country_id: 6252001
description:
Jan  2 20:33:28 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=190.92.171.7, lip=66.85.158.91, session=<k7XxAmlHoIC+XKsH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan  2 20:35:10 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<zpgBCWlHUtEv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 20:34:31 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<zE2zBmlHWGEjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  2 20:34:33 host2 sshd[290229]: Disconnected from invalid user user 2.57.121.25 port 28893 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.130.171.210
country_id: 3469034
description:
Jan  2 20:35:33 host2 dovecot[165786]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=177.130.171.210, lip=66.85.158.91, TLS, session=<lk9VCWlH8dOxgqvS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 169.239.117.181
country_id: 2215636
description:
Jan  2 20:35:52 host2 dovecot[165786]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw>, method=PLAIN, rip=169.239.117.181, lip=66.85.158.91, TLS, session=<uQKPCmlH6oip73W1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  2 20:37:57 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<ocjzEmlHerRo7MS0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.112.196
country_id: 6252001
description:
Jan  2 20:38:34 host2 sshd[295277]: Disconnected from invalid user ubuntu 146.190.112.196 port 49196 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.89.28.139
country_id: 1643084
description:
Jan  2 20:39:42 host2 sshd[296425]: Disconnected from invalid user ivan 36.89.28.139 port 56654 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.112.196
country_id: 6252001
description:
Jan  2 20:39:48 host2 sshd[296578]: Disconnected from invalid user runner 146.190.112.196 port 47046 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 146.190.112.196
country_id: 6252001
description:
Jan  2 20:40:58 host2 sshd[298148]: Disconnected from invalid user ivan 146.190.112.196 port 53442 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.89.28.139
country_id: 1643084
description:
Jan  2 20:41:43 host2 sshd[298805]: Disconnected from invalid user runner 36.89.28.139 port 37052 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.112.196
country_id: 6252001
description:
Jan  2 20:42:05 host2 sshd[299327]: Disconnected from invalid user pt 146.190.112.196 port 51172 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  2 20:41:11 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<oup/HmlHHKJCdMcv>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.89.28.139
country_id: 1643084
description:
Jan  2 20:43:01 host2 sshd[300294]: Disconnected from invalid user jamshid 36.89.28.139 port 38594 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan  2 20:42:34 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<office@lezzarotech.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<rBdVI2lHDFgvTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.112.196
country_id: 6252001
description:
Jan  2 20:42:39 host2 sshd[299810]: Disconnected from invalid user devuser 146.190.112.196 port 42890 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.89.28.139
country_id: 1643084
description:
Jan  2 20:43:43 host2 sshd[301061]: Disconnected from invalid user pt 36.89.28.139 port 42100 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  2 20:43:23 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@kiriaswanu.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<nXtfJmlHOsCygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.226
country_id: 3469034
description:
Jan  2 20:45:02 host2 dovecot[165786]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=190.89.136.226, lip=66.85.158.91, TLS, session=<9Kk/K2lHBei+WYji>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Jan  2 20:44:19 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<tPu1KWlHqpwI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.190.79.74
country_id: 3469034
description:
Jan  2 20:44:40 host2 dovecot[165786]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=177.190.79.74, lip=66.85.158.91, TLS, session=<0f/gKWlHRa6xvk9K>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  2 20:45:26 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@dataesite.lk>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<is6xLWlH5oFCdMzo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.76.142
country_id: 1269750
description:
2026-01-02 20:46:04 dovecot_login authenticator failed for H=([128.185.213.82]) [182.78.76.142]:53370: 535 Incorrect authentication data (set_id=office@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.163.187
country_id: 3144096
description:
2026-01-02 20:47:06 dovecot_login authenticator failed for H=(187-163-97-62.cust.smartcall.no) [62.97.163.187]:59275: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.236.51.254
country_id: 290291
description:
2026-01-02 20:46:54 dovecot_login authenticator failed for H=([87.236.51.254]) [87.236.51.254]:48039: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.253.95
country_id: 6252001
description:
Jan  2 20:48:05 host2 sshd[305985]: Disconnected from invalid user pt 199.195.253.95 port 46994 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.53.44.125
country_id: 1643084
description:
Jan  2 20:49:17 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@lezzarotech.com>, method=PLAIN, rip=117.53.44.125, lip=66.85.158.91, session=<ogaEO2lHDst1NSx9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.92.171.7
country_id: 6252001
description:
Jan  2 20:49:48 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=190.92.171.7, lip=66.85.158.91, session=<HL1bPWlHgpC+XKsH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  2 20:51:28 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@maximsholdings.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<q79IQ2lHcuJCdMzo>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 66.116.204.232
country_id: 1269750
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[66.116.204.232] [Remote Port]=[57970] [Authentication Database]=[mail] [Username]=[test@maximsholdings.com] (10/10 failures) (blocked until [Sat Jan  3 15:21:26 2026 UTC/Sat Jan  3 20:51:26 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.142.45
country_id: 6252001
description:
Jan  2 20:52:02 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colourmarklabels.com>, method=PLAIN, rip=47.251.142.45, lip=66.85.158.91, session=<YHxVRWlH3p0v+44t>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.221.8.135
country_id: 6252001
description:
2026-01-02 20:53:07 dovecot_login authenticator failed for H=(216-221-8-135.ind-pa.salsgiver.com) [216.221.8.135]:58692: 535 Incorrect authentication data (set_id=office@kiriaswanu.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 199.195.253.95
country_id: 6252001
description:
Jan  2 20:52:42 host2 sshd[310846]: Disconnected from invalid user ivan 199.195.253.95 port 54574 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2026-01-02 20:53:17 dovecot_login authenticator failed for H=([24.105.248.218]) [24.105.248.218]:51342: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  2 20:54:35 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<pJ9wTmlHaoCi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  2 20:55:03 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<BVghUGlHXueeRdvj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.5.178.229
country_id: 3865483
description:
2026-01-02 20:56:33 dovecot_login authenticator failed for H=([186.5.178.229]) [186.5.178.229]:45778: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.85
country_id: 1210997
description:
2026-01-02 20:56:55 dovecot_login authenticator failed for H=([103.115.252.60]) [103.115.252.85]:44375: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  2 20:58:19 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<hMXMW2lHCIVIpyJ4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  2 20:58:30 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<xDJ5XGlHMKkUOAHJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.225.40.153
country_id: 6252001
description:
Jan  2 20:58:39 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=64.225.40.153, lip=66.85.158.91, session=<7079XGlH1LpA4SiZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  2 21:00:01 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<PCXkYWlHcIsyBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Jan  2 21:01:48 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@venee.lk>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<K5hHaGlHHtII04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  2 21:01:48 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<zss/aGlHErMv/VJZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.191.69.170
country_id: 6252001
description:
Jan  2 21:02:50 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=18.191.69.170, lip=66.85.158.92, session=<MPoObGlHlssSv0Wq>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 47.253.82.89
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[47.253.82.89] [Remote Port]=[52504] [Authentication Database]=[mail] [Username]=[admin@dataesite.lk] (10/10 failures) (blocked until [Sat Jan  3 15:32:04 2026 UTC/Sat Jan  3 21:02:04 2026 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.200
country_id: 1269750
description:
2026-01-02 21:02:15 dovecot_login authenticator failed for H=([103.146.233.200]) [103.146.233.200]:52360: 535 Incorrect authentication data (set_id=postmaster@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  2 21:04:05 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<QfRocGlH3Lpnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan  2 21:04:08 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@mathsmotorcysle.xyz>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<4AaacGlHxGAvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  2 21:04:46 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<zonicmlH4JYv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  2 21:05:05 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@lankaherbalsolutions.com>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<7OYFdGlHiqOuijvy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.218.54.218
country_id: 6252001
description:
Jan  2 21:05:08 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=104.218.54.218, lip=66.85.158.91, session=<xycwdGlHfr5o2jba>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.134.27.194
country_id: 1210997
description:
2026-01-02 21:04:17 dovecot_login authenticator failed for H=([103.134.27.194]) [103.134.27.194]:55138: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.119
country_id: 1819730
description:
2026-01-02 21:05:58 dovecot_login authenticator failed for H=(m121-202-206-119.smartone.com) [121.202.206.119]:50142: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.30.14.221
country_id: 6252001
description:
2026-01-02 21:06:13 dovecot_login authenticator failed for H=pool-108-30-14-221.nycmny.fios.verizon.net [108.30.14.221]:45236: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.92.171.7
country_id: 6252001
description:
Jan  2 21:08:33 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=190.92.171.7, lip=66.85.158.91, session=<S4dcgGlHqK6+XKsH>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 190.92.171.7
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[190.92.171.7] [Remote Port]=[44712] [Authentication Database]=[mail] [Username]=[contact@ayuzonelanka.com] (10/10 failures) (blocked until [Sat Jan  3 15:38:31 2026 UTC/Sat Jan  3 21:08:31 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  2 21:10:25 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<R8cOh2lHvOlnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.53.44.125
country_id: 1643084
description:
Jan  2 21:10:41 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=117.53.44.125, lip=66.85.158.91, session=<3jgAiGlHMMt1NSx9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 21:11:20 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<A1FVimlHdmQjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  2 21:11:46 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<Q4Hhi2lHfJhyB6Oa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.170.156.248
country_id: 6251999
description:
2026-01-02 21:13:23 dovecot_login authenticator failed for H=host-148-170-156-248.public.eastlink.ca [148.170.156.248]:57948: 535 Incorrect authentication data (set_id=contact@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.178.118
country_id: 1269750
description:
2026-01-02 21:13:39 dovecot_login authenticator failed for H=([125.19.178.118]) [125.19.178.118]:42730: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan  2 21:15:04 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<HpKnl2lH0Icv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.247.159.106
country_id: 1269750
description:
2026-01-02 21:15:39 dovecot_login authenticator failed for H=([115.247.159.106]) [115.247.159.106]:45536: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2026-01-02 21:16:10 dovecot_plain authenticator failed for H=(petums) [102.53.15.180]:52253: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  2 21:16:48 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<+SjnnWlHoIVo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.135.208.32
country_id: 1861060
description:
2026-01-02 21:18:50 dovecot_login authenticator failed for H=dsl-212-135-208-32.dsl.easynet.co.uk [212.135.208.32]:42877: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.78.124
country_id: 1819730
description:
2026-01-02 21:19:09 dovecot_login authenticator failed for H=(182.239.78.124.hk.chinamobile.com) [182.239.78.124]:35380: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.124.206
country_id: 1269750
description:
2026-01-02 21:21:01 dovecot_login authenticator failed for H=([182.95.87.3]) [182.95.124.206]:48792: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  2 21:23:41 host2 pure-ftpd[345237]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.107.6
country_id: 1269750
description:
2026-01-02 21:24:05 dovecot_login authenticator failed for H=([182.78.107.6]) [182.78.107.6]:39246: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  2 21:24:11 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<T5ZKuGlHqrNIpyJ4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  2 21:26:44 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<lHFlwWlHopxyB6Oa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.225.40.153
country_id: 6252001
description:
Jan  2 21:27:00 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=64.225.40.153, lip=66.85.158.91, session=<A9VgwmlHIJlA4SiZ>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 64.225.40.153
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[64.225.40.153] [Remote Port]=[39200] [Authentication Database]=[mail] [Username]=[hr@ayuzonelanka.com] (10/10 failures) (blocked until [Sat Jan  3 15:56:58 2026 UTC/Sat Jan  3 21:26:58 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  2 21:28:10 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<wKKSxmlHlusUOAHJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.92.171.7
country_id: 6252001
description:
Jan  2 21:28:35 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=190.92.171.7, lip=66.85.158.91, session=<OF8JyGlHwpe+XKsH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  2 21:29:11 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<roUzymlHCL5nmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.99.61.248
country_id: 1269750
description:
2026-01-02 21:30:48 dovecot_login authenticator failed for H=([14.99.61.248]) [14.99.61.248]:58918: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.247.189.189
country_id: 6252001
description:
2026-01-02 21:30:55 dovecot_login authenticator failed for H=([50.247.189.189]) [50.247.189.189]:28930: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  2 21:31:00 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@lankaherbalsolutions.com>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<V86z0GlHsNiuijvy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.70.126
country_id: 1269750
description:
2026-01-02 21:30:07 dovecot_login authenticator failed for H=([125.20.232.243]) [182.78.70.126]:45334: 535 Incorrect authentication data (set_id=office@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.199
country_id: 1733045
description:
2026-01-02 21:30:21 dovecot_login authenticator failed for H=([49.124.149.199]) [49.124.149.199]:60872: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  2 21:31:44 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<pT5Q02lHusEv/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  2 21:31:48 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<MP+H02lHZpwv+wDY>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  2 21:32:58 host2 sshd[354352]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  2 21:32:47 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<2gYR12lHtMgyBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.53.44.125
country_id: 1643084
description:
Jan  2 21:33:30 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=117.53.44.125, lip=66.85.158.91, session=<Xa6Z2WlHaOJ1NSx9>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 117.53.44.125
country_id: 1643084
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[117.53.44.125] [Remote Port]=[57960] [Authentication Database]=[mail] [Username]=[contact@mathsmotorcysle.xyz] (10/10 failures) (blocked until [Sat Jan  3 16:03:28 2026 UTC/Sat Jan  3 21:33:28 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  2 21:33:48 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<erOu2mlHaNNn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  2 21:34:46 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<Hjom3mlHjoFnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan  2 21:37:02 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<sbJB5mlHYosv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.203.205.37
country_id: 1168579
description:
2026-01-02 21:38:03 dovecot_login authenticator failed for H=([113.203.205.37]) [113.203.205.37]:47909: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.111
country_id: 2186224
description:
2026-01-02 21:38:12 dovecot_login authenticator failed for H=([121.73.169.111]) [121.73.169.111]:43362: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan  2 21:39:11 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@lezzarotech.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<++Ti7WlHlh8vTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  2 21:39:41 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<mDy172lHBNqygBt7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.241.177.151
country_id: 3469034
description:
Jan  2 21:40:25 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=188.241.177.151, lip=66.85.158.91, session=<vM9+8mlHtr+88bGX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2026-01-02 21:40:31 dovecot_plain authenticator failed for H=c-73-168-136-150.hsd1.il.comcast.net (epidable) [73.168.136.150]:47120: 535 Incorrect authentication data (set_id=sales@v-deploy.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 176.125.230.140
country_id: 2562770
description:
Jan  2 21:40:21 host2 pure-ftpd[362461]: (?@176.125.230.140) [INFO] New connection from 176.125.230.140


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.214.122.47
country_id: 357994
description:
Jan  2 21:40:24 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=188.214.122.47, lip=66.85.158.91, TLS, session=<rUNx8mlH6Iu81nov>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 43.250.207.103
country_id: 2186224
description:
Jan  2 21:40:26 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=43.250.207.103, lip=66.85.158.91, session=<P2+L8mlH7rIr+s9n>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  2 21:40:54 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<TroW9GlH0jho7MS0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 98.159.41.8
country_id: 1327865
description:
Jan  2 21:40:24 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=98.159.41.8, lip=66.85.158.91, TLS handshaking: Connection closed, session=<IDpy8mlH3ItinykI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.231.182.152
country_id: 453733
description:
Jan  2 21:40:26 host2 dovecot[360729]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=165.231.182.152, lip=66.85.158.91, session=<h2iG8mlH8rKl57aY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.234.143
country_id: 289688
description:
Jan  2 21:40:28 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=95.181.234.143, lip=66.85.158.91, TLS handshaking: Connection closed, session=<kDGh8mlHgIlfteqP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 86.106.74.250
country_id: 719819
description:
Jan  2 21:40:27 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=86.106.74.250, lip=66.85.158.91, session=<Huqa8mlHzoBWakr6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.70.10.8
country_id: 3624060
description:
Jan  2 21:40:27 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=146.70.10.8, lip=66.85.158.91, TLS handshaking: Connection closed, session=<wVOa8mlH2s2SRgoI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.193.244
country_id: 6252001
description:
Jan  2 21:41:18 host2 dovecot[360729]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.65.193.244, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<xoup9WlHuI8UQcH0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  2 21:41:50 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@askinternationalconsortium.com>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<qyFu92lHWLdCdMcv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.187.6.86
country_id: 2921044
description:
Jan  2 21:43:14 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=5.187.6.86, lip=66.85.158.91, session=<SU1o/GlHlqAFuwZW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 21:43:47 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<IPhj/mlH9okjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.230
country_id: 1149361
description:
2026-01-02 21:43:50 dovecot_login authenticator failed for H=([149.54.51.230]) [149.54.51.230]:58965: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.40.212
country_id: 290557
description:
2026-01-02 21:44:03 dovecot_login authenticator failed for H=([5.31.40.212]) [5.31.40.212]:50282: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2026-01-02 21:45:16 dovecot_login authenticator failed for H=([115.240.244.53]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=postmaster@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Jan  2 21:45:22 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<19QUBGpHNocI04Sw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.177.88.23
country_id: 3624060
description:
2026-01-02 21:45:26 dovecot_login authenticator failed for H=([186.177.88.23]) [186.177.88.23]:50381: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.165.219
country_id: 1605651
description:
2026-01-02 21:45:29 dovecot_login authenticator failed for H=([106.0.165.219]) [106.0.165.219]:43140: 535 Incorrect authentication data (set_id=office@kiriaswanu.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.105.243
country_id: 6252001
description:
Jan  2 21:45:51 host2 dovecot[360729]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.64.105.243, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<bMznBWpH4qYUQGnz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.62
country_id: 1269750
description:
2026-01-02 21:45:20 dovecot_login authenticator failed for H=([182.95.58.62]) [182.95.58.62]:47874: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.238.2.56
country_id: 3469034
description:
2026-01-02 21:45:45 dovecot_login authenticator failed for H=45-238-2-56.netmaisfibra.net.br [45.238.2.56]:42654: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  2 21:46:59 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@dataesite.lk>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<yvTUCWpHcrZCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.92.171.7
country_id: 6252001
description:
Jan  2 21:47:57 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ayuzonelanka.com>, method=PLAIN, rip=190.92.171.7, lip=66.85.158.91, session=<O+NODWpH1qm+XKsH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2026-01-02 21:48:07 dovecot_plain authenticator failed for H=c-98-40-101-10.hsd1.tn.comcast.net (acary) [98.40.101.10]:44612: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2026-01-02 21:50:48 dovecot_login authenticator failed for H=([115.240.244.52]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.53.44.125
country_id: 1643084
description:
Jan  2 21:50:55 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lezzarotech.com>, method=PLAIN, rip=117.53.44.125, lip=66.85.158.91, session=<uFLvF2pHOKB1NSx9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2026-01-02 21:51:00 dovecot_login authenticator failed for H=(c-50-188-204-213.unallocated.comcastbusiness.net) [50.188.204.213]:50233: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  2 21:52:55 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@maximsholdings.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<i7wNH2pHjJBCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan  2 21:55:39 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<I/vVKGpHCIcv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.11.79
country_id: 1733045
description:
2026-01-02 21:56:14 dovecot_login authenticator failed for H=([183.171.11.79]) [183.171.11.79]:58342: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  2 21:56:49 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<+qAELWpHLOui8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.142.45
country_id: 6252001
description:
Jan  2 21:56:57 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@colourmarklabels.com>, method=PLAIN, rip=47.251.142.45, lip=66.85.158.91, session=<8yV+LWpHxLov+44t>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan  2 22:00:00 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<mrFfOGpHaBMvTJuG>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 47.76.155.134
country_id: 1819730
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[47.76.155.134] [Remote Port]=[4968] [Authentication Database]=[mail] [Username]=[info@mathsmotorcysle.xyz] (10/10 failures) (blocked until [Sat Jan  3 16:29:58 2026 UTC/Sat Jan  3 21:59:58 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  2 21:59:25 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<0PRQNmpHJJ2eRdvj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.61
country_id: 2635167
description:
Jan  2 22:00:40 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.61, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<rC7fOmpHJaxX7LA9>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.73
country_id: 2635167
description:
Jan  2 22:00:04 host2 dovecot[360729]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.73, lip=66.85.158.92, TLS, session=<Z4HCOGpHQ8BX7LBJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.62
country_id: 2635167
description:
Jan  2 22:00:06 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.62, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<usDjOGpHqelX7LA+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.38
country_id: 2635167
description:
Jan  2 22:01:13 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.38, lip=66.85.158.92, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<YbzaPGpHl52594km>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.124
country_id: 6252001
description:
Jan  2 22:01:28 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=162.216.150.124, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<czi/PWpHIsei2JZ8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  2 22:01:44 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<XqiYPmpHlsRIpyJ4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.43
country_id: 2635167
description:
Jan  2 22:01:46 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.43, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<DOzbPmpHLe6594kr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.98.8
country_id: 3144096
description:
2026-01-02 22:01:58 dovecot_login authenticator failed for H=(cm-84.215.98.8.get.no) [84.215.98.8]:48788: 535 Incorrect authentication data (set_id=sales@kiriaswanu.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.39
country_id: 2635167
description:
Jan  2 22:02:53 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.39, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<mJ7QQmpH/YdX7LAn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.124
country_id: 6252001
description:
Jan  2 22:02:08 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 24 secs): user=<>, rip=162.216.150.124, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<sr8gQGpHLOOi2JZ8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.44
country_id: 2635167
description:
Jan  2 22:02:20 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.44, lip=66.85.158.92, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<XCfXQGpHteFX7LAs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.71
country_id: 2635167
description:
Jan  2 22:03:26 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.71, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<AtXNRGpHRbJX7LBH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.70
country_id: 2635167
description:
Jan  2 22:03:59 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.70, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<CgjJRmpHE+a594lG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Jan  2 22:03:18 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<X282RGpH6r4I04Sw>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 8.211.132.176
country_id: 1861060
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[8.211.132.176] [Remote Port]=[48874] [Authentication Database]=[mail] [Username]=[info@venee.lk] (10/10 failures) (blocked until [Sat Jan  3 16:33:16 2026 UTC/Sat Jan  3 22:03:16 2026 LOCAL])


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.173
country_id: 6252001
description:
Jan  2 22:04:15 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.173, lip=66.85.158.92, TLS handshaking: Connection closed, session=<ZXm4R2pHOaFAPsWt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.38
country_id: 2635167
description:
Jan  2 22:04:33 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.38, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<Hn/CSGpHCaO594km>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.167
country_id: 6252001
description:
Jan  2 22:04:33 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.167, lip=66.85.158.92, TLS handshaking: Connection closed, session=<D23JSGpHSnpAPsWn>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.64
country_id: 6252001
description:
Jan  2 22:04:37 host2 pure-ftpd[401827]: (?@147.185.132.64) [INFO] New connection from 147.185.132.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.199.59.18
country_id: 2750405
description:
2026-01-02 22:04:50 dovecot_plain authenticator failed for H=(slesughte) [128.199.59.18]:44764: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.92.171.7
country_id: 6252001
description:
Jan  2 22:04:07 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=190.92.171.7, lip=66.85.158.91, session=<DXEWR2pHRqm+XKsH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.67
country_id: 2635167
description:
Jan  2 22:05:06 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.67, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<i969SmpHebq594lD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  2 22:07:19 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<D02UUmpH3KlyB6Oa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  2 22:07:30 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<FqE4U2pHMsBnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  2 22:07:09 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=</RD6UWpHYpUUOAHJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2026-01-02 22:08:14 dovecot_plain authenticator failed for H=c-73-196-144-25.hsd1.nj.comcast.net (hookans) [73.196.144.25]:42430: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  2 22:08:38 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@lankaherbalsolutions.com>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<k4pHV2pHYFquijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  2 22:08:57 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<OKdfWGpHQsQv/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  2 22:09:15 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<Hc90WWpHWJYv/VJZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.124
country_id: 6252001
description:
Jan  2 22:09:19 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.124, lip=66.85.158.91, TLS, session=<xJTWWWpHGPKi2JZ8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  2 22:09:39 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<5/3mWmpHirwv+wDY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.124
country_id: 6252001
description:
Jan  2 22:10:19 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.124, lip=66.85.158.91, TLS, session=</XtnXWpHUuWi2JZ8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  2 22:10:07 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<poOVXGpHBOgyBvlc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 34.75.196.37
country_id: 6252001
description:
Jan  2 22:11:44 host2 dovecot[360729]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=34.75.196.37, lip=66.85.158.91, session=<g8Z/YmpH2KciS8Ql>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.53.44.125
country_id: 1643084
description:
Jan  2 22:12:24 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=117.53.44.125, lip=66.85.158.91, session=<od+7ZGpHfKd1NSx9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.130.118
country_id: 1819730
description:
Jan  2 22:12:48 host2 sshd[410097]: Disconnected from invalid user deploy 152.32.130.118 port 44270 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  2 22:14:01 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<UQKCampHsqhnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  2 22:13:28 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<jJ2QaGpH5Jpn9M4G>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.130.118
country_id: 1819730
description:
Jan  2 22:13:30 host2 sshd[410900]: Disconnected from invalid user alex 152.32.130.118 port 41184 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.130.118
country_id: 1819730
description:
Jan  2 22:14:39 host2 sshd[412133]: Disconnected from invalid user testu 152.32.130.118 port 45286 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan  2 22:16:34 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<voelc2pHoqgv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan  2 22:18:58 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@lezzarotech.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<c3EwfGpHnv8vTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  2 22:18:24 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<UXA2empHmp5o7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 22:20:00 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<3ifvf2pHoEwjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  2 22:20:42 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<J9ZfgmpHUruygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  2 22:20:50 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@askinternationalconsortium.com>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<MHvfgmpH6sVCdMcv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.92.171.7
country_id: 6252001
description:
Jan  2 22:22:36 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ayuzonelanka.com>, method=PLAIN, rip=190.92.171.7, lip=66.85.158.91, session=<BAo0iWpHFJm+XKsH>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  2 22:23:37 host2 sshd[421670]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.210.193.176
country_id: 6252001
description:
Jan  2 22:23:39 host2 sshd[421767]: Disconnected from invalid user bitrix 192.210.193.176 port 38546 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.75
country_id: 1733045
description:
2026-01-02 22:24:52 dovecot_login authenticator failed for H=([49.125.201.75]) [49.125.201.75]:51160: 535 Incorrect authentication data (set_id=v-deploy.com@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.211.31.222
country_id: 2510769
description:
2026-01-02 22:25:21 dovecot_login authenticator failed for H=([77.211.31.222]) [77.211.31.222]:57933: 535 Incorrect authentication data (set_id=v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  2 22:25:25 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<OjBFk2pHhKVCdMzo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.6.203.226
country_id: 6254930
description:
Jan  2 22:25:33 host2 sshd[423911]: Disconnected from invalid user myuser 213.6.203.226 port 56442 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 192.210.193.176
country_id: 6252001
description:
Jan  2 22:26:47 host2 sshd[424921]: Disconnected from invalid user nishant 192.210.193.176 port 38756 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.223.46
country_id: 1269750
description:
2026-01-02 22:26:49 dovecot_login authenticator failed for H=([182.95.223.46]) [182.95.223.46]:43352: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.114
country_id: 1269750
description:
2026-01-02 22:27:34 dovecot_login authenticator failed for H=([182.95.58.114]) [182.95.58.114]:45964: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.157.158
country_id: 1269750
description:
2026-01-02 22:27:18 dovecot_login authenticator failed for H=([128.185.217.150]) [125.19.157.158]:37488: 535 Incorrect authentication data (set_id=postmaster@kiriaswanu.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  2 22:27:19 host2 pure-ftpd[425356]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.6.203.226
country_id: 6254930
description:
Jan  2 22:27:24 host2 sshd[425382]: Disconnected from invalid user webmin 213.6.203.226 port 62886 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.211.55.20
country_id: 2328926
description:
Jan  2 22:28:37 host2 sshd[426499]: Disconnected from invalid user ubuntu 197.211.55.20 port 44066 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.72.22.61
country_id: 6251999
description:
2026-01-02 22:28:59 dovecot_login authenticator failed for H=static24-72-22-61.r.rev.accesscomm.ca [24.72.22.61]:34236: 535 Incorrect authentication data (set_id=test@epid.gov.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 213.6.203.226
country_id: 6254930
description:
Jan  2 22:28:32 host2 sshd[426446]: Disconnected from invalid user calvin 213.6.203.226 port 44449 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.53.44.125
country_id: 1643084
description:
Jan  2 22:29:33 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lezzarotech.com>, method=PLAIN, rip=117.53.44.125, lip=66.85.158.91, session=<cK0NompH9Ix1NSx9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.191.96.171
country_id: 2510769
description:
Jan  2 22:30:25 host2 sshd[428590]: Disconnected from invalid user jack 92.191.96.171 port 58662 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.56.205
country_id: 6252001
description:
Jan  2 22:30:11 host2 sshd[428246]: Disconnected from invalid user arjun 198.98.56.205 port 35344 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.211.55.20
country_id: 2328926
description:
Jan  2 22:31:18 host2 sshd[429669]: Disconnected from invalid user hl 197.211.55.20 port 36434 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  2 22:31:25 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@maximsholdings.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<jki8qGpHAuFCdMzo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.191.96.171
country_id: 2510769
description:
Jan  2 22:31:42 host2 sshd[430279]: Disconnected from invalid user deploy 92.191.96.171 port 43482 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.98.56.205
country_id: 6252001
description:
Jan  2 22:31:54 host2 sshd[430504]: Disconnected from invalid user dev 198.98.56.205 port 56818 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.56.205
country_id: 6252001
description:
Jan  2 22:32:59 host2 sshd[431329]: Disconnected from invalid user vpn 198.98.56.205 port 50628 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.118.138
country_id: 3144096
description:
2026-01-02 22:33:27 dovecot_login authenticator failed for H=(cm-46.212.118.138.get.no) [46.212.118.138]:36719: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.241.90
country_id: 3469034
description:
2026-01-02 22:33:41 dovecot_login authenticator failed for H=(ccabv.org9.static.gvt.net.br) [187.58.241.90]:52129: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.44.174.254
country_id: 357994
description:
2026-01-02 22:33:47 dovecot_plain authenticator failed for H=(distiolic) [102.44.174.254]:46524: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.211.55.20
country_id: 2328926
description:
Jan  2 22:33:55 host2 sshd[432261]: Disconnected from invalid user gustavo 197.211.55.20 port 59692 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.142.45
country_id: 6252001
description:
Jan  2 22:34:45 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colourmarklabels.com>, method=PLAIN, rip=47.251.142.45, lip=66.85.158.91, session=<+H6wtGpHRpMv+44t>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  2 22:34:47 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<EiTGtGpH/MWi8GQy>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.19.251.24
country_id: 6251999
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 71.19.251.24 - env_eng@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan  2 22:36:18 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<cAIwumpHhOwv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  2 22:36:36 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<b1lEu2pHGLGeRdvj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.92.171.7
country_id: 6252001
description:
Jan  2 22:38:50 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=190.92.171.7, lip=66.85.158.91, session=<qQtHw2pH1MO+XKsH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.233
country_id: 6252001
description:
Jan  2 22:38:09 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.230.168.233, lip=66.85.158.92, TLS handshaking: Connection closed, session=<JMjzwGpHn4tb5qjp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.238
country_id: 6252001
description:
Jan  2 22:38:19 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.230.168.238, lip=66.85.158.92, TLS: Connection closed, session=<dUaPwWpHXdNb5qju>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.130
country_id: 6252001
description:
Jan  2 22:38:33 host2 dovecot[360729]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.230.168.130, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<Oz1gwmpHUaBb5qiC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.134
country_id: 6252001
description:
Jan  2 22:38:36 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.230.168.134, lip=66.85.158.92, TLS: Connection closed, session=<yX+OwmpHd61b5qiG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  2 22:39:23 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<QUs3xWpHftVIpyJ4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan  2 22:40:01 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<yCWGx2pHKrMvTJuG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.13
country_id: 6252001
description:
Jan  2 22:42:57 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.13, lip=66.85.158.92, TLS handshaking: Connection closed, session=<10Qk0mpHD67DuEwN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.234
country_id: 6252001
description:
Jan  2 22:43:08 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=195.184.76.234, lip=66.85.158.92, TLS: Connection closed, session=<I1PA0mpHhafDuEzq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.9
country_id: 6252001
description:
Jan  2 22:43:20 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=195.184.76.9, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<8uGB02pH/5DDuEwJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.232
country_id: 6252001
description:
Jan  2 22:43:23 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.232, lip=66.85.158.92, TLS: Connection closed, session=<Oc2w02pH67PDuEzo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.118
country_id: 2635167
description:
Jan  2 22:44:23 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=35.203.211.118, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<22VD12pHXdcjy9N2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.12.86.90
country_id: 1269750
description:
2026-01-02 22:44:32 dovecot_login authenticator failed for H=(mail.tataidc.com) [61.12.86.90]:59550: 535 Incorrect authentication data (set_id=lezzarotech.com@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  2 22:46:03 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<bKAW3WpHTLAv/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  2 22:45:11 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<Rfv72WpHUJwUOAHJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.44.40
country_id: 1522867
description:
2026-01-02 22:45:22 dovecot_login authenticator failed for H=([5.76.44.40]) [5.76.44.40]:57927: 535 Incorrect authentication data (set_id=office@kiriaswanu.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.118
country_id: 2635167
description:
Jan  2 22:45:23 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 4 secs): user=<>, rip=35.203.211.118, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<61jY2mpHLuojy9N2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.34.139
country_id: 3144096
description:
2026-01-02 22:45:35 dovecot_login authenticator failed for H=(cm-178.232.34.139.get.no) [178.232.34.139]:37149: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2026-01-02 22:45:38 dovecot_plain authenticator failed for H=c-71-235-225-181.hsd1.ct.comcast.net (unionade) [71.235.225.181]:50744: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  2 22:46:10 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<Td993WpHoqauijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  2 22:46:13 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<qtao3WpHgpBnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  2 22:46:21 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@dataesite.lk>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<Z+cn3mpHYqMv/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  2 22:46:32 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<My7S3mpHELIyBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  2 22:47:22 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<1O7I4WpHdLdyB6Oa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  2 22:47:34 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<FMiC4mpHnNwv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.53.44.125
country_id: 1643084
description:
Jan  2 22:50:46 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=117.53.44.125, lip=66.85.158.91, session=<URzw7WpHHrh1NSx9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.154
country_id: 3144096
description:
2026-01-02 22:51:56 dovecot_login authenticator failed for H=(cm-84.213.189.154.get.no) [84.213.189.154]:40425: 535 Incorrect authentication data (set_id=v-deploy.com@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  2 22:52:55 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<K+Km9WpH6udn9M4G>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.118
country_id: 2635167
description:
Jan  2 22:53:01 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.118, lip=66.85.158.92, TLS, session=<kJcj9mpHfOMjy9N2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.112.109.248
country_id: 6252001
description:
2026-01-02 22:52:24 dovecot_login authenticator failed for H=(host-24-112-109-248.vyvebroadband.net) [24.112.109.248]:37081: 535 Incorrect authentication data (set_id=contact@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.50
country_id: 1269750
description:
2026-01-02 22:52:34 dovecot_login authenticator failed for H=([27.123.102.50]) [27.123.102.50]:43008: 535 Incorrect authentication data (set_id=v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.58.83.146
country_id: 3175395
description:
2026-01-02 22:52:38 dovecot_login authenticator failed for H=([101.58.83.146]) [101.58.83.146]:63593: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  2 22:52:52 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<CnNz9WpHgOdnpBQq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.89.230.59
country_id: 6251999
description:
Jan  2 22:54:24 host2 sshd[454118]: error: maximum authentication attempts exceeded for invalid user admin from 24.89.230.59 port 54996 ssh2 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 24.89.230.59
country_id: 6251999
description:
Jan  2 22:54:27 host2 sshd[454177]: Disconnecting invalid user admin 24.89.230.59 port 42166: Too many authentication failures [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 24.89.230.59
country_id: 6251999
description:
Jan  2 22:54:15 host2 sshd[453933]: Disconnecting authenticating user root 24.89.230.59 port 54974: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 24.89.230.59
country_id: 6251999
description:
Jan  2 22:54:15 host2 sshd[453933]: error: maximum authentication attempts exceeded for root from 24.89.230.59 port 54974 ssh2 [preauth]


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 47.254.85.115
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[47.254.85.115] [Remote Port]=[47446] [Authentication Database]=[mail] [Username]=[sales@melanifinefood.com] (10/10 failures) (blocked until [Sat Jan  3 17:25:56 2026 UTC/Sat Jan  3 22:55:56 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  2 22:56:03 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<ywnYAGtHOrBo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan  2 22:55:58 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<EP2KAGtHVrkv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 22:56:14 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<buaEAWtH6FYjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.92.171.7
country_id: 6252001
description:
Jan  2 22:57:24 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=190.92.171.7, lip=66.85.158.91, session=<+6uxBWtHLqi+XKsH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.218.54.218
country_id: 6252001
description:
Jan  2 22:58:55 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=104.218.54.218, lip=66.85.158.91, session=<QggVC2tHpoto2jba>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan  2 22:58:58 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lezzarotech.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<pytMC2tHRnQvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  2 22:59:32 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<pTRGDWtHRrlCdMcv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2026-01-02 23:01:50 dovecot_login authenticator failed for H=(189-108-129-173.customer.tdatabrasil.net.br) [187.8.64.94]:43813: 535 Incorrect authentication data (set_id=postmaster@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.64.8
country_id: 2264397
description:
2026-01-02 23:02:02 dovecot_login authenticator failed for H=bl23-64-8.dsl.telepac.pt [144.64.64.8]:3021: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  2 23:01:21 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<OCXKE2tHKt2ygBt7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.36.113.62
country_id: 1269750
description:
2026-01-02 23:01:42 dovecot_login authenticator failed for H=([103.68.19.170]) [49.36.113.62]:38762: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.13
country_id: 241170
description:
Jan  2 23:03:03 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.13, lip=66.85.158.91, session=<nXPdGWtHwtfE+2YN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  2 23:03:52 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<fVfKHGtHrNBCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  2 23:06:10 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<iYAHJWtH2Kai8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan  2 23:06:12 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lezzarotech.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<CxEjJWtHFPsvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.218.54.218
country_id: 6252001
description:
Jan  2 23:07:08 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=104.218.54.218, lip=66.85.158.91, session=<JWtiKGtHholo2jba>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.53.44.125
country_id: 1643084
description:
Jan  2 23:08:22 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lezzarotech.com>, method=PLAIN, rip=117.53.44.125, lip=66.85.158.91, session=<tHzfLGtHXuJ1NSx9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.128.180.14
country_id: 3437598
description:
2026-01-02 23:09:18 dovecot_login authenticator failed for H=(static-14-180-128-190.telecel.com.py) [190.128.180.14]:34519: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  2 23:09:30 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<iLj2MGtHSs9CdMzo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2026-01-02 23:09:37 dovecot_login authenticator failed for H=(1522312565.colombiatel.co) [152.231.25.64]:47219: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.92.171.7
country_id: 6252001
description:
Jan  2 23:10:59 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=190.92.171.7, lip=66.85.158.91, session=<Up07NmtHGpi+XKsH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2026-01-02 23:11:33 dovecot_plain authenticator failed for H=c-174-166-153-20.hsd1.nj.comcast.net (montous) [174.166.153.20]:33612: 535 Incorrect authentication data (set_id=sales@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  2 23:16:39 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<GwmGSmtHKtmygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  2 23:18:07 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@maximsholdings.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<zqnGT2tHFudCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan  2 23:17:09 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<dDhMTGtHWKQv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-02 23:17:17 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:62936: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.23
country_id: 6252001
description:
Jan  2 23:19:07 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.23, lip=66.85.158.91, TLS handshaking: Connection closed, session=<WGx4U2tHlbVAPsUX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.17
country_id: 6252001
description:
Jan  2 23:19:24 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.17, lip=66.85.158.91, TLS handshaking: Connection closed, session=<a+V5VGtHlpZAPsUR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.53.44.125
country_id: 1643084
description:
Jan  2 23:19:49 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=117.53.44.125, lip=66.85.158.91, session=<oAnaVWtHisp1NSx9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.92.171.7
country_id: 6252001
description:
Jan  2 23:20:53 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=190.92.171.7, lip=66.85.158.91, session=<XEalWWtHsui+XKsH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  2 23:20:49 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<SWRiWWtH1LYyBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan  2 23:21:13 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<T+XVWmtH3IYv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  2 23:23:07 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<l8qeYWtH3sNyB6Oa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.88
country_id: 99237
description:
2026-01-02 23:23:19 dovecot_login authenticator failed for H=([65.20.204.88]) [65.20.204.88]:39091: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.177.81.194
country_id: 3624060
description:
2026-01-02 23:23:41 dovecot_login authenticator failed for H=([186.177.81.194]) [186.177.81.194]:33656: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  2 23:25:01 host2 sshd[487075]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  2 23:24:13 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=</IKZZWtHvtQUOAHJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  2 23:24:16 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<1Li5ZWtHStZnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  2 23:25:59 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<jCDka2tHVONIpyJ4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  2 23:26:25 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<PzRobWtH1qJn9M4G>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 103.244.206.6
country_id: 1643084
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[103.244.206.6] [Remote Port]=[41686] [Authentication Database]=[mail] [Username]=[support@bostonlanka.com] (10/10 failures) (blocked until [Sat Jan  3 17:56:23 2026 UTC/Sat Jan  3 23:26:23 2026 LOCAL])


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.130
country_id: 6252001
description:
Jan  2 23:26:58 host2 dovecot[360729]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=71.6.146.130, lip=66.85.158.91, session=<YlmIb2tHrrJHBpKC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  2 23:27:55 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<Oz3McmtHVNgv/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  2 23:28:12 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=</0bMc2tHWkto7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  2 23:28:23 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<B8V3dGtHzrUv/VJZ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  2 23:30:07 host2 sshd[492750]: Disconnected from invalid user user 2.57.121.25 port 9632 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  2 23:30:42 host2 pure-ftpd[493366]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.123
country_id: 2186224
description:
2026-01-02 23:30:49 dovecot_login authenticator failed for H=([121.73.163.123]) [121.73.163.123]:50288: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.102.148.242
country_id: 6252001
description:
2026-01-02 23:31:17 dovecot_login authenticator failed for H=syn-098-102-148-242.biz.spectrum.com [98.102.148.242]:55554: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.68.34
country_id: 1269750
description:
Jan  2 23:33:45 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<env_eng>, method=PLAIN, rip=43.225.68.34, lip=66.85.158.91, TLS, session=<L154hmtHSY8r4UQi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.58.115.154
country_id: 1269750
description:
Jan  2 23:33:19 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=103.58.115.154, lip=66.85.158.91, TLS, session=<6LIEhWtHXrVnOnOa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  2 23:34:24 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<jXkBimtH+LOeRdvj>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 102.204.223.27
country_id: 2328926
description:
Jan  2 23:34:39 host2 pure-ftpd[497163]: (?@102.204.223.27) [INFO] New connection from 102.204.223.27


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan  2 23:34:46 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<6w1Hi2tH/EUvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  2 23:35:19 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<Q75GjWtH3Owv+wDY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.120
country_id: 6252001
description:
Jan  2 23:35:26 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=66.132.153.120, lip=66.85.158.92, TLS: Connection closed, session=<XQrOjWtHcKlChJl4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.187.240
country_id: 3144096
description:
2026-01-02 23:36:03 dovecot_login authenticator failed for H=(cm-84.213.187.240.get.no) [84.213.187.240]:41308: 535 Incorrect authentication data (set_id=postmaster@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan  2 23:36:06 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<tXwPkGtH+N8v/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.8.12
country_id: 614540
description:
2026-01-02 23:36:16 dovecot_login authenticator failed for H=([194.31.8.12]) [194.31.8.12]:53568: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.70.122.245
country_id: 1269750
description:
2026-01-02 23:36:59 dovecot_login authenticator failed for H=(abts-mum-static-245.122.70.182.airtelbroadband.in) [182.70.122.245]:59161: 535 Incorrect authentication data (set_id=sales@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.114.143.79
country_id: 3865483
description:
2026-01-02 23:37:17 dovecot_login authenticator failed for H=host-cotesma-114-143-79.smandes.com.ar [181.114.143.79]:43258: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  2 23:37:52 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<0hFklmtHatFnpBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.255.189.56
country_id: 298795
description:
2026-01-02 23:42:19 dovecot_login authenticator failed for H=(88.255.189.56.static.ttnet.com.tr) [88.255.189.56]:50618: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.200.10
country_id: 1269750
description:
2026-01-02 23:42:29 dovecot_login authenticator failed for H=([125.19.175.85]) [122.186.200.10]:56254: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  2 23:43:57 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<tiEqrGtHPuSi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan  2 23:44:57 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lezzarotech.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<85jAr2tHBikvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.53.44.125
country_id: 1643084
description:
Jan  2 23:46:05 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lezzarotech.com>, method=PLAIN, rip=117.53.44.125, lip=66.85.158.91, session=<3JDGs2tH3Ml1NSx9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.241.90
country_id: 3469034
description:
2026-01-02 23:45:37 dovecot_login authenticator failed for H=(ccabv.org.cta.gvt.net.br) [187.58.241.90]:51667: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.226.163
country_id: 3144096
description:
2026-01-02 23:45:48 dovecot_login authenticator failed for H=(cm-178.232.226.163.get.no) [178.232.226.163]:41740: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.217.204.91
country_id: 2658434
description:
2026-01-02 23:47:03 dovecot_login authenticator failed for H=adsl-89-217-204-91.adslplus.ch [89.217.204.91]:54018: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.33.112
country_id: 3144096
description:
2026-01-02 23:47:12 dovecot_login authenticator failed for H=(cm-178.232.33.112.get.no) [178.232.33.112]:40622: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 23:48:27 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<TE9EvGtHgN8jupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.71
country_id: 6252001
description:
Jan  2 23:50:26 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.71, lip=66.85.158.92, TLS, session=<NnVxw2tHrOjG6xhH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  2 23:50:49 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<yeewxGtHirdCdMcv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.0.142.131
country_id: 1819730
description:
2026-01-02 23:53:05 dovecot_login authenticator failed for H=14-0-142-131.static.pccw-hkt.com [14.0.142.131]:45306: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.133.161.162
country_id: 130758
description:
2026-01-02 23:52:45 dovecot_login authenticator failed for H=([85.133.161.162]) [85.133.161.162]:43772: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.170.173.26
country_id: 1210997
description:
Jan  2 23:56:50 host2 sshd[522303]: Disconnected from invalid user william 103.170.173.26 port 41409 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.53.44.125
country_id: 1643084
description:
Jan  2 23:57:39 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=117.53.44.125, lip=66.85.158.91, session=<rhoa3WtHMMB1NSx9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  2 23:57:58 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<+RRG3mtHdNqygBt7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.170.173.26
country_id: 1210997
description:
Jan  2 23:59:07 host2 sshd[524881]: Disconnected from invalid user kapsch 103.170.173.26 port 55159 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.210.61.208
country_id: 2802361
description:
Jan  2 23:58:12 host2 sshd[523728]: Disconnected from invalid user ll 35.210.61.208 port 48408 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.43.161
country_id: 3017382
description:
Jan  2 23:58:42 host2 sshd[524235]: Disconnected from invalid user test 51.178.43.161 port 51558 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.210.61.208
country_id: 2802361
description:
Jan  2 23:59:26 host2 sshd[525207]: Disconnected from invalid user alireza 35.210.61.208 port 49232 [preauth]


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 50.6.249.92
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[50.6.249.92] [Remote Port]=[37674] [Authentication Database]=[mail] [Username]=[support@lakwelholdings.com] (10/10 failures) (blocked until [Sat Jan  3 18:29:27 2026 UTC/Sat Jan  3 23:59:27 2026 LOCAL])


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.43.161
country_id: 3017382
description:
Jan  2 23:59:47 host2 sshd[525559]: Disconnected from invalid user ftpuser 51.178.43.161 port 48648 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  2 23:59:29 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<yeaw42tHKpMyBvlc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.170.173.26
country_id: 1210997
description:
Jan  2 23:59:46 host2 sshd[525534]: Disconnected from invalid user ll 103.170.173.26 port 60989 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.9.22
country_id: 1733045
description:
2026-01-02 23:59:58 dovecot_login authenticator failed for H=([183.171.9.22]) [183.171.9.22]:48038: 535 Incorrect authentication data (set_id=office@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.144.113
country_id: 1643084
description:
Jan  3 00:01:04 host2 sshd[527250]: Disconnected from invalid user alireza 103.217.144.113 port 51496 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.100.104
country_id: 294640
description:
2026-01-03 00:00:14 dovecot_login authenticator failed for H=(2-55-100-104.orange.net.il) [2.55.100.104]:55568: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.210.61.208
country_id: 2802361
description:
Jan  3 00:00:29 host2 sshd[526673]: Disconnected from invalid user postgre 35.210.61.208 port 48596 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.210.61.208
country_id: 2802361
description:
Jan  3 00:01:02 host2 sshd[527232]: Disconnected from invalid user kapsch 35.210.61.208 port 34162 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.43.161
country_id: 3017382
description:
Jan  3 00:01:18 host2 sshd[527470]: Disconnected from invalid user minecraft 51.178.43.161 port 58398 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.210.61.208
country_id: 2802361
description:
Jan  3 00:01:32 host2 sshd[527705]: Disconnected from invalid user proradis 35.210.61.208 port 47962 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.170.173.26
country_id: 1210997
description:
Jan  3 00:01:39 host2 sshd[527808]: Disconnected from invalid user user53 103.170.173.26 port 50238 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  3 00:01:51 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<pBIn7GtHgt4UOAHJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  3 00:02:06 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<8O4I7WtHdIxnmud6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.210.61.208
country_id: 2802361
description:
Jan  3 00:02:35 host2 sshd[528928]: Disconnected from invalid user jy 35.210.61.208 port 47326 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.43.161
country_id: 3017382
description:
Jan  3 00:02:48 host2 sshd[529201]: Disconnected from invalid user admin 51.178.43.161 port 39932 [preauth]


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 103.154.231.122
country_id: 1643084
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[103.154.231.122] [Remote Port]=[35956] [Authentication Database]=[mail] [Username]=[info@askinternationalconsortium.com] (10/10 failures) (blocked until [Sat Jan  3 18:32:04 2026 UTC/Sun Jan  4 00:02:04 2026 LOCAL])


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.144.113
country_id: 1643084
description:
Jan  3 00:03:21 host2 sshd[530007]: Disconnected from invalid user tempuser 103.217.144.113 port 37846 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.140.250
country_id: 3469034
description:
2026-01-03 00:03:24 dovecot_login authenticator failed for H=([181.233.140.250]) [181.233.140.250]:57686: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.43.161
country_id: 3017382
description:
Jan  3 00:03:49 host2 sshd[530551]: Disconnected from invalid user devops 51.178.43.161 port 37018 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.220.126
country_id: 1269750
description:
2026-01-03 00:03:12 dovecot_login authenticator failed for H=([152.52.220.126]) [152.52.220.126]:35412: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 51.178.43.161
country_id: 3017382
description:
Jan  3 00:03:17 host2 sshd[529947]: Received disconnect from 51.178.43.161 port 52588:11: Bye Bye [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  3 00:03:28 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<Wc7t8WtHEIZIpyJ4>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 72.167.34.120
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[72.167.34.120] [Remote Port]=[34320] [Authentication Database]=[mail] [Username]=[admin@monarchdss.com] (10/10 failures) (blocked until [Sat Jan  3 18:33:26 2026 UTC/Sun Jan  4 00:03:26 2026 LOCAL])


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.170.173.26
country_id: 1210997
description:
Jan  3 00:04:08 host2 sshd[530985]: Disconnected from invalid user postgre 103.170.173.26 port 45321 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 00:03:23 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<tWek8WtHTNFyB6Oa>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.217.144.113
country_id: 1643084
description:
Jan  3 00:04:51 host2 sshd[531851]: Disconnected from invalid user saiful 103.217.144.113 port 39988 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 00:04:54 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<snET92tHmrIv/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 00:05:22 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@dataesite.lk>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<HEi/+GtH8N8v/VJZ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.144.113
country_id: 1643084
description:
Jan  3 00:05:36 host2 sshd[532996]: Disconnected from invalid user william 103.217.144.113 port 43440 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 00:06:01 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<pEQT+2tHkIVn9M4G>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 104.236.196.180
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[104.236.196.180] [Remote Port]=[38686] [Authentication Database]=[mail] [Username]=[admin@monarchdss.com] (10/10 failures) (blocked until [Sat Jan  3 18:36:24 2026 UTC/Sun Jan  4 00:06:24 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  3 00:06:26 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<vN1+/GtHHpdo7MS0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.216.119.134
country_id: 1819730
description:
Jan  3 00:09:12 host2 sshd[536955]: Disconnected from invalid user jira 185.216.119.134 port 46998 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  3 00:11:28 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<2mqMDmxH/IyeRdvj>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.216.119.134
country_id: 1819730
description:
Jan  3 00:11:48 host2 sshd[539832]: Disconnected from invalid user redmine 185.216.119.134 port 54576 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.216.119.134
country_id: 1819730
description:
Jan  3 00:12:26 host2 sshd[540584]: Disconnected from invalid user emma 185.216.119.134 port 38056 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  3 00:12:58 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<hJTlE2xHap8v+wDY>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 47.251.0.216
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[47.251.0.216] [Remote Port]=[40810] [Authentication Database]=[mail] [Username]=[support@rehanseo.online] (10/10 failures) (blocked until [Sat Jan  3 18:42:56 2026 UTC/Sun Jan  4 00:12:56 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan  3 00:13:30 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<V7jXFWxHNuIvTJuG>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 00:15:14 host2 sshd[544229]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.251.13.59
country_id: 6252001
description:
Jan  3 00:15:29 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=47.251.13.59, lip=66.85.158.91, session=<YSwEHWxH4Ngv+w07>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.37
country_id: 1269750
description:
2026-01-03 00:15:38 dovecot_login authenticator failed for H=([203.193.147.41]) [203.193.147.37]:50183: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.73.205
country_id: 6252001
description:
2026-01-03 00:15:51 dovecot_login authenticator failed for H=([209.23.73.205]) [209.23.73.205]:36642: 535 Incorrect authentication data (set_id=info)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 103.164.20.42
country_id: 1643084
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[103.164.20.42] [Remote Port]=[39372] [Authentication Database]=[mail] [Username]=[contact@melanifinefood.com] (10/10 failures) (blocked until [Sat Jan  3 18:46:48 2026 UTC/Sun Jan  4 00:16:48 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  3 00:16:50 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<jUK3IWxHzJlnpBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.227
country_id: 1819730
description:
2026-01-03 00:19:29 dovecot_login authenticator failed for H=227.42.246.220.static.netvigator.com [220.246.42.227]:51336: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-01-03 00:19:46 dovecot_login authenticator failed for H=(ip-103-29-185-162.pascalwave.com) [103.29.185.162]:37602: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.170.50.2
country_id: 3932488
description:
2026-01-03 00:19:59 dovecot_login authenticator failed for H=([45.170.50.2]) [45.170.50.2]:45171: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.251.249.79
country_id: 2300660
description:
2026-01-03 00:20:12 dovecot_login authenticator failed for H=([197.251.249.79]) [197.251.249.79]:35738: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  3 00:21:52 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<BMS9M2xHVLyi8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.192.166
country_id: 1269750
description:
2026-01-03 00:22:52 dovecot_login authenticator failed for H=([27.123.105.234]) [128.185.192.166]:39362: 535 Incorrect authentication data (set_id=bostonlanka@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.46
country_id: 3865483
description:
2026-01-03 00:23:14 dovecot_login authenticator failed for H=([131.161.184.46]) [131.161.184.46]:47132: 535 Incorrect authentication data (set_id=bostonlanka)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan  3 00:23:48 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lezzarotech.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<PtGuOmxH6m8vTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.53.44.125
country_id: 1643084
description:
Jan  3 00:23:56 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@lezzarotech.com>, method=PLAIN, rip=117.53.44.125, lip=66.85.158.91, session=<hwIcO2xHENp1NSx9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.218.49
country_id: 3469034
description:
2026-01-03 00:24:58 dovecot_login authenticator failed for H=([179.184.218.49]) [179.184.218.49]:56309: 535 Incorrect authentication data (set_id=office@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  3 00:24:37 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<uGOPPWxHnOUjupN+>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 35.186.147.126
country_id: 1880251
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[35.186.147.126] [Remote Port]=[58780] [Authentication Database]=[mail] [Username]=[contact@colperlab.com] (10/10 failures) (blocked until [Sat Jan  3 18:54:35 2026 UTC/Sun Jan  4 00:24:35 2026 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2026-01-03 00:25:14 dovecot_login authenticator failed for H=(nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:35113: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.190.246
country_id: 3017382
description:
Jan  3 00:26:15 host2 sshd[555952]: Disconnected from invalid user louwg 54.38.190.246 port 37148 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.109.56.72
country_id: 6252001
description:
2026-01-03 00:27:06 dovecot_login authenticator failed for H=(dfw-206-109-56-72.ip4.99.network) [206.109.56.72]:37668: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.81
country_id: 2077456
description:
2026-01-03 00:27:21 dovecot_login authenticator failed for H=210.0.90.81.static.nexnet.net.au [210.0.90.81]:38024: 535 Incorrect authentication data (set_id=contacto)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 66.116.199.47
country_id: 1269750
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[66.116.199.47] [Remote Port]=[39842] [Authentication Database]=[mail] [Username]=[contact@askinternationalconsortium.com] (10/10 failures) (blocked until [Sat Jan  3 18:59:12 2026 UTC/Sun Jan  4 00:29:12 2026 LOCAL])


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.190.246
country_id: 3017382
description:
Jan  3 00:29:37 host2 sshd[559087]: Disconnected from invalid user cristian 54.38.190.246 port 37596 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  3 00:29:14 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<a9MZTmxHoptCdMcv>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 54.38.190.246
country_id: 3017382
description:
Jan  3 00:30:11 host2 sshd[559747]: Disconnected from invalid user move 54.38.190.246 port 55734 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.192
country_id: 6252001
description:
Jan  3 00:30:25 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.192, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<tuxsUmxHYdjN0h/A>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.223
country_id: 6252001
description:
Jan  3 00:31:09 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.223, lip=66.85.158.92, session=<0mQNVWxH1VJAPpzf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.190.246
country_id: 3017382
description:
Jan  3 00:31:12 host2 sshd[560883]: Disconnected from invalid user ehsan 54.38.190.246 port 57484 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.222
country_id: 6252001
description:
Jan  3 00:31:20 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.222, lip=66.85.158.92, TLS: Connection closed, session=<E5OzVWxHEI9APpze>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.134
country_id: 6252001
description:
Jan  3 00:33:14 host2 dovecot[360729]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 1 secs): user=<>, rip=66.132.153.134, lip=66.85.158.92, session=<Gpt9XGxHeLlChJmG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2026-01-03 00:33:39 dovecot_login authenticator failed for H=([185.255.212.178]) [185.255.212.178]:1406: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.57
country_id: 6252001
description:
Jan  3 00:33:53 host2 dovecot[360729]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=167.94.146.57, lip=66.85.158.92, session=<zIHRXmxHDMmnXpI5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.170.251.33
country_id: 2017370
description:
2026-01-03 00:33:53 dovecot_login authenticator failed for H=(178.170.251.33.leadertelecom.ru) [178.170.251.33]:58176: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.82.194
country_id: 1269750
description:
2026-01-03 00:33:53 dovecot_login authenticator failed for H=([59.145.171.168]) [182.78.82.194]:39834: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  3 00:33:13 host2 pure-ftpd[562583]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.166.78
country_id: 1819730
description:
2026-01-03 00:34:12 dovecot_login authenticator failed for H=(223-197-166-78.static.imsbiz.com) [223.197.166.78]:60699: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.224.242.137
country_id: 2635167
description:
2026-01-03 00:35:19 dovecot_login authenticator failed for H=([109.224.242.136]) [109.224.242.137]:51386: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2026-01-03 00:35:48 dovecot_login authenticator failed for H=(237-166.adsl.static.espeed.com.bn) [119.160.166.237]:37738: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.76.55.177
country_id: 3175395
description:
2026-01-03 00:35:09 dovecot_login authenticator failed for H=([151.76.55.177]) [151.76.55.177]:41068: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 00:37:05 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<VRApamxHTLYyBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  3 00:38:47 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<TXpBcGxHktOygBt7>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 178.128.27.123
country_id: 1880251
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[178.128.27.123] [Remote Port]=[54162] [Authentication Database]=[mail] [Username]=[contact@kiriaswanu.com] (10/10 failures) (blocked until [Sat Jan  3 19:08:45 2026 UTC/Sun Jan  4 00:38:45 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  3 00:39:58 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<nieCdGxHcJdnmud6>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 20.56.1.201
country_id: 2750405
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[20.56.1.201] [Remote Port]=[59442] [Authentication Database]=[mail] [Username]=[admin@monarchdss.com] (10/10 failures) (blocked until [Sat Jan  3 19:09:52 2026 UTC/Sun Jan  4 00:39:52 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  3 00:39:54 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<JrE2dGxHMugUOAHJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  3 00:41:12 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<ShPqeGxHDpdIpyJ4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 00:42:06 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<oq0efGxHcoYv/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 00:42:34 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<i6bKfWxHxMQv/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 00:43:34 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<IG9egWxH7N5yB6Oa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  3 00:44:38 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<O0EwhWxHyIto7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.191.100
country_id: 3144096
description:
2026-01-03 00:45:07 dovecot_login authenticator failed for H=(cm-84.213.191.100.get.no) [84.213.191.100]:52339: 535 Incorrect authentication data (set_id=postmaster@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.98.41.27
country_id: 1269750
description:
2026-01-03 00:45:16 dovecot_login authenticator failed for H=([59.98.41.27]) [59.98.41.27]:46498: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 00:45:49 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<HBpjiWxHkrFn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  3 00:48:55 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<gLJ5lGxHiNeeRdvj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.38.0.39
country_id: 6252001
description:
2026-01-03 00:49:03 dovecot_login authenticator failed for H=([45.38.0.39]) [45.38.0.39]:3717: 535 Incorrect authentication data (set_id=contact@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
country_id: 2510769
description:
2026-01-03 00:50:08 dovecot_login authenticator failed for H=(90.pool90-173-78.static.orange.es) [90.173.78.90]:34563: 535 Incorrect authentication data (set_id=office@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.61.215.87
country_id: 3469034
description:
2026-01-03 00:49:13 dovecot_login authenticator failed for H=201-61-215-87.bbone.telesp.net.br [201.61.215.87]:43577: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.30.170
country_id: 3144096
description:
2026-01-03 00:50:01 dovecot_login authenticator failed for H=(cm-178.232.30.170.get.no) [178.232.30.170]:44967: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.157.158
country_id: 1269750
description:
2026-01-03 00:50:12 dovecot_login authenticator failed for H=([128.185.217.150]) [125.19.157.158]:38820: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.85.43.162
country_id: 3686110
description:
2026-01-03 00:50:22 dovecot_login authenticator failed for H=([190.85.43.162]) [190.85.43.162]:57605: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  3 00:50:53 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<LB6Hm2xHRsUv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.248.111.238
country_id: 6252001
description:
2026-01-03 00:51:50 dovecot_plain authenticator failed for H=(seyncosed) [38.248.111.238]:40143: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-03 00:51:54 dovecot_plain authenticator failed for H=(preed) [64.72.74.162]:36800: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.144.65
country_id: 1643084
description:
Jan  3 00:52:14 host2 sshd[583125]: Disconnected from invalid user practice 103.217.144.65 port 34326 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan  3 00:52:33 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<DBx6oWxHUBIvTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.198.76.173
country_id: 6252001
description:
Jan  3 00:52:13 host2 sshd[583129]: Disconnected from invalid user bb 143.198.76.173 port 45464 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.100.107.238
country_id: 1831722
description:
Jan  3 00:53:49 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=175.100.107.238, lip=66.85.158.91, session=<5zbjpWxHeO2vZGvu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.174
country_id: 1269750
description:
2026-01-03 00:54:04 dovecot_login authenticator failed for H=(nsg-corporate-217.166.185.122.airtel.in) [27.123.98.174]:43244: 535 Incorrect authentication data (set_id=postmaster@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.187.226.240
country_id: 1269750
description:
Jan  3 00:54:15 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<hr>, method=PLAIN, rip=122.187.226.240, lip=66.85.158.91, TLS, session=<Wqw+pmxHE5Z6u+Lw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.109
country_id: 1814991
description:
Jan  3 00:56:06 host2 dovecot[360729]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=94.231.206.109, lip=66.85.158.92, session=<TE5NrmxH0eZe585t>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.37
country_id: 1814991
description:
Jan  3 00:55:40 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=94.231.206.37, lip=66.85.158.92, session=<L8i9rGxH/91e584l>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.34
country_id: 1814991
description:
Jan  3 00:55:50 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=94.231.206.34, lip=66.85.158.92, session=<vtVcrWxH981e584i>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  3 00:56:04 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<LFoVrmxHXKtnpBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.54
country_id: 1269750
description:
2026-01-03 00:56:46 dovecot_login authenticator failed for H=(nsg-corporate-54.202.186.122.airtel.in) [122.186.202.54]:45306: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.198.76.173
country_id: 6252001
description:
Jan  3 00:56:58 host2 sshd[588609]: Disconnected from invalid user thomas 143.198.76.173 port 53566 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.33
country_id: 1814991
description:
Jan  3 00:56:10 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=94.231.206.33, lip=66.85.158.92, session=<Je2BrmxH14Ne584h>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.69.0.72
country_id: 6252001
description:
Jan  3 00:57:10 host2 sshd[588847]: Disconnected from invalid user backupuser 34.69.0.72 port 57320 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.194
country_id: 1269750
description:
2026-01-03 00:57:21 dovecot_login authenticator failed for H=([182.95.115.194]) [182.95.115.194]:59622: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.144.65
country_id: 1643084
description:
Jan  3 00:57:43 host2 sshd[589353]: Disconnected from invalid user thomas 103.217.144.65 port 38010 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.69.0.72
country_id: 6252001
description:
Jan  3 00:57:43 host2 sshd[589384]: Disconnected from invalid user duser 34.69.0.72 port 36660 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.69.0.72
country_id: 6252001
description:
Jan  3 00:58:16 host2 sshd[589923]: Disconnected from invalid user wyf 34.69.0.72 port 50904 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.144.65
country_id: 1643084
description:
Jan  3 00:58:32 host2 sshd[590176]: Disconnected from invalid user stack 103.217.144.65 port 38124 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.198.76.173
country_id: 6252001
description:
Jan  3 00:58:56 host2 sshd[590590]: Disconnected from invalid user itadmin 143.198.76.173 port 48066 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  3 01:00:04 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<ChJevGxHmKqi8GQy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.144.65
country_id: 1643084
description:
Jan  3 00:59:15 host2 sshd[590923]: Disconnected from invalid user admin1 103.217.144.65 port 42760 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.18.99.126
country_id: 1269750
description:
2026-01-03 00:59:43 dovecot_login authenticator failed for H=([125.18.99.126]) [125.18.99.126]:52390: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.217.144.65
country_id: 1643084
description:
Jan  3 01:00:00 host2 sshd[591637]: Disconnected from invalid user backupuser 103.217.144.65 port 56014 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  3 01:01:00 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<LSG4v2xHwN0jupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.117.148
country_id: 1819730
description:
Jan  3 01:01:22 host2 sshd[593581]: Disconnected from invalid user test 101.36.117.148 port 52188 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2026-01-03 01:01:25 dovecot_login authenticator failed for H=([185.134.179.106]) [185.101.16.250]:60057: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.71.52.51
country_id: 6252001
description:
Jan  3 01:01:27 host2 sshd[593727]: Disconnected from invalid user admin 34.71.52.51 port 33908 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.102
country_id: 1269750
description:
2026-01-03 01:01:41 dovecot_login authenticator failed for H=([27.123.119.99]) [182.95.224.102]:44090: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.198.76.173
country_id: 6252001
description:
Jan  3 01:01:41 host2 sshd[593977]: Disconnected from invalid user mongod 143.198.76.173 port 41448 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.196.50.91
country_id: 3469034
description:
Jan  3 01:02:46 host2 sshd[594978]: Disconnected from invalid user admin 200.196.50.91 port 36026 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan  3 01:02:55 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lezzarotech.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<nhGMxmxHlgYvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.70.19.11
country_id: 3469034
description:
2026-01-03 01:03:20 dovecot_login authenticator failed for H=(45-70-19-11.static.damsolutionsturbo.com.br) [45.70.19.11]:41470: 535 Incorrect authentication data (set_id=bostonlanka@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.16.194.197
country_id: 3865483
description:
Jan  3 01:03:36 host2 sshd[595840]: Disconnected from invalid user git 190.16.194.197 port 51606 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.198.76.173
country_id: 6252001
description:
Jan  3 01:03:42 host2 sshd[595942]: Disconnected from invalid user forum 143.198.76.173 port 52808 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.112.109.248
country_id: 6252001
description:
2026-01-03 01:03:48 dovecot_login authenticator failed for H=(host-24-112-109-248.vyvebroadband.net) [24.112.109.248]:41077: 535 Incorrect authentication data (set_id=bostonlanka)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.117.148
country_id: 1819730
description:
Jan  3 01:05:32 host2 sshd[598062]: Disconnected from invalid user test 101.36.117.148 port 46336 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.196.50.91
country_id: 3469034
description:
Jan  3 01:06:06 host2 sshd[598693]: Disconnected from invalid user test 200.196.50.91 port 40962 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 34.71.52.51
country_id: 6252001
description:
Jan  3 01:05:12 host2 sshd[597694]: Received disconnect from 34.71.52.51 port 47412:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.70.82.95
country_id: 1282988
description:
Jan  3 01:06:14 host2 sshd[598784]: Disconnected from invalid user ubuntu 202.70.82.95 port 11146 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.71.52.51
country_id: 6252001
description:
Jan  3 01:06:43 host2 sshd[599418]: Disconnected from invalid user admin 34.71.52.51 port 59736 [preauth]


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 199.229.220.185
country_id: 6251999
description:
2026-01-03 01:07:29 H=([199.229.220.185]) [199.229.220.185]:47084 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<contact@bostonlanka.com> A=dovecot_login:contact@bostonlanka.com rejected RCPT <mail22@winpukpik777.com>: Sender verify failed


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.117.148
country_id: 1819730
description:
Jan  3 01:07:46 host2 sshd[600343]: Disconnected from invalid user admin 101.36.117.148 port 49658 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  3 01:08:13 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@askinternationalconsortium.com>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<TvmC2WxH+M9CdMcv>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.70.82.95
country_id: 1282988
description:
Jan  3 01:09:19 host2 sshd[602105]: Disconnected from invalid user admin 202.70.82.95 port 9748 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 34.71.52.51
country_id: 6252001
description:
Jan  3 01:10:24 host2 sshd[603506]: Received disconnect from 34.71.52.51 port 42704:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.117.148
country_id: 1819730
description:
Jan  3 01:10:42 host2 sshd[603749]: Disconnected from invalid user admin 101.36.117.148 port 53656 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.71.52.51
country_id: 6252001
description:
Jan  3 01:10:57 host2 sshd[603955]: Disconnected from invalid user test 34.71.52.51 port 40286 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.182.130
country_id: 1269750
description:
2026-01-03 01:12:03 dovecot_login authenticator failed for H=([182.95.182.130]) [182.95.182.130]:40300: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.160.100
country_id: 6252001
description:
2026-01-03 01:11:50 dovecot_login authenticator failed for H=syn-024-105-160-100.biz.spectrum.com [24.105.160.100]:45326: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.16.194.197
country_id: 3865483
description:
Jan  3 01:13:49 host2 sshd[607078]: Disconnected from invalid user admin 190.16.194.197 port 33048 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.71.52.51
country_id: 6252001
description:
Jan  3 01:14:10 host2 sshd[607422]: Disconnected from invalid user ubuntu 34.71.52.51 port 59342 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.117.148
country_id: 1819730
description:
Jan  3 01:14:18 host2 sshd[607592]: Disconnected from invalid user git 101.36.117.148 port 45810 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 01:14:34 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<ajI78GxH9t0yBvlc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.210.118
country_id: 1269750
description:
2026-01-03 01:15:25 dovecot_login authenticator failed for H=([152.52.210.118]) [152.52.210.118]:34250: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 01:16:31 host2 sshd[610050]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.21
country_id: 1269750
description:
2026-01-03 01:16:08 dovecot_login authenticator failed for H=(nsg-corporate-21.226.187.122.airtel.in) [122.187.226.21]:35050: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.202.110.183
country_id: 798544
description:
Jan  3 01:16:47 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=85.202.110.183, lip=66.85.158.91, TLS, session=<HJtJ92xHzLNVym63>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.135.48
country_id: 3144096
description:
2026-01-03 01:17:10 dovecot_login authenticator failed for H=([188.124.135.48]) [188.124.135.48]:56150: 535 Incorrect authentication data (set_id=sales@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.253.154
country_id: 1269750
description:
2026-01-03 01:17:21 dovecot_login authenticator failed for H=([125.21.56.137]) [125.19.253.154]:56646: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.190.205.193
country_id: 3469034
description:
Jan  3 01:17:22 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info>, method=PLAIN, rip=45.190.205.193, lip=66.85.158.91, TLS, session=<uvsF+WxHdMktvs3B>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  3 01:18:00 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<zsF4/GxHbt1nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  3 01:19:25 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<kxqXAW1HJsuygBt7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.149.196
country_id: 1733045
description:
2026-01-03 01:19:34 dovecot_login authenticator failed for H=([183.171.149.196]) [183.171.149.196]:60978: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.158.216
country_id: 2510769
description:
2026-01-03 01:19:33 dovecot_login authenticator failed for H=([207.188.158.216]) [207.188.158.216]:21054: 535 Incorrect authentication data (set_id=bostonlanka@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.59.26
country_id: 1269750
description:
2026-01-03 01:19:48 dovecot_login authenticator failed for H=([125.23.125.209]) [122.187.59.26]:45192: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  3 01:19:52 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<x70wA21HvqEUOAHJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.174
country_id: 2186224
description:
2026-01-03 01:19:54 dovecot_login authenticator failed for H=([121.73.162.174]) [121.73.162.174]:56732: 535 Incorrect authentication data (set_id=bostonlanka)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 01:19:25 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<f7SSAW1HiKEv/VJZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.248
country_id: 2186224
description:
2026-01-03 01:21:04 dovecot_login authenticator failed for H=([121.73.162.248]) [121.73.162.248]:33642: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  3 01:21:10 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<BB3ZB21Haq1IpyJ4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.170
country_id: 1269750
description:
2026-01-03 01:21:23 dovecot_login authenticator failed for H=([122.184.128.193]) [182.95.185.170]:46060: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  3 01:23:22 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<Pru1D21HXJ9o7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 01:23:39 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<q0+0EG1HVOxyB6Oa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 01:25:53 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<5OytGG1HlK9n9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.113.241
country_id: 1819730
description:
Jan  3 01:26:39 host2 sshd[619840]: Disconnected from invalid user fivem 101.36.113.241 port 59372 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  3 01:26:51 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<LhMcHG1HDN+eRdvj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.183.186.200
country_id: 2510769
description:
Jan  3 01:28:03 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=5.183.186.200, lip=66.85.158.91, TLS, session=<yxiMH21HxOwFt7rI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  3 01:29:04 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<DWIVJG1Hjocv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 168.0.224.112
country_id: 3469034
description:
Jan  3 01:28:24 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<charanaw>, method=PLAIN, rip=168.0.224.112, lip=66.85.158.91, TLS, session=<UDuyIG1HDuqoAOBw>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.113.241
country_id: 1819730
description:
Jan  3 01:29:22 host2 sshd[622882]: Disconnected from invalid user postgres 101.36.113.241 port 42396 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.158
country_id: 1269750
description:
2026-01-03 01:29:33 dovecot_login authenticator failed for H=([125.19.175.68]) [152.52.236.158]:48646: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.0.238.190
country_id: 3469034
description:
2026-01-03 01:29:44 dovecot_login authenticator failed for H=(177-0-238-161.bnut3703.dsl.brasiltelecom.net.br) [177.0.238.190]:45155: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.113.241
country_id: 1819730
description:
Jan  3 01:31:06 host2 sshd[624918]: Disconnected from invalid user runner 101.36.113.241 port 49558 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.178.26.161
country_id: 3996063
description:
Jan  3 01:31:40 host2 sshd[625496]: Disconnected from invalid user newuser 189.178.26.161 port 57244 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.113.241
country_id: 1819730
description:
Jan  3 01:31:42 host2 sshd[625537]: Disconnected from invalid user es 101.36.113.241 port 33124 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.54.78
country_id: 798544
description:
Jan  3 01:32:36 host2 sshd[626500]: Disconnected from invalid user daniele 54.38.54.78 port 55008 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.178.26.161
country_id: 3996063
description:
Jan  3 01:33:17 host2 sshd[627194]: Disconnected from invalid user satya 189.178.26.161 port 36928 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 88.147.30.59
country_id: 3175395
description:
Jan  3 01:33:46 host2 sshd[627740]: Disconnected from invalid user jeff 88.147.30.59 port 45917 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.178.26.161
country_id: 3996063
description:
Jan  3 01:33:52 host2 sshd[627842]: Disconnected from invalid user mata 189.178.26.161 port 48982 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  3 01:35:43 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<mK/WO21HgtlnpBQq>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  3 01:35:49 host2 pure-ftpd[629958]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 54.38.54.78
country_id: 798544
description:
Jan  3 01:35:09 host2 sshd[629120]: Disconnected from invalid user newuser 54.38.54.78 port 50380 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.2
country_id: 1733045
description:
2026-01-03 01:36:55 dovecot_login authenticator failed for H=([49.124.148.2]) [49.124.148.2]:50238: 535 Incorrect authentication data (set_id=test@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.194.128.158
country_id: 1269750
description:
2026-01-03 01:37:12 dovecot_login authenticator failed for H=(static-158.128.194.14-tataidc.co.in) [14.194.128.158]:54378: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.142
country_id: 6252001
description:
Jan  3 01:37:19 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.142, lip=66.85.158.92, TLS: Connection closed, session=<u0mwQW1HxPFChJmO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.110.96
country_id: 3144096
description:
2026-01-03 01:37:41 dovecot_login authenticator failed for H=(cm-84.215.110.96.get.no) [84.215.110.96]:49283: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  3 01:37:57 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<hp7RQ21HgtMjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  3 01:38:42 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<OseDRm1HeIGi8GQy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.27
country_id: 798549
description:
Jan  3 01:38:51 host2 dovecot[360729]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=85.217.149.27, lip=66.85.158.92, TLS, session=<wVEpR21HzJJV2ZUb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.12.244
country_id: 3144096
description:
2026-01-03 01:40:23 dovecot_login authenticator failed for H=(cm-84.211.12.244.get.no) [84.211.12.244]:53276: 535 Incorrect authentication data (set_id=office@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.16.55
country_id: 3469034
description:
2026-01-03 01:40:41 dovecot_login authenticator failed for H=(177-174-16-55.user.vivozap.com.br) [177.174.16.55]:57680: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.218.54.218
country_id: 6252001
description:
Jan  3 01:41:09 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=104.218.54.218, lip=66.85.158.91, session=<+ppIT21HPpJo2jba>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.150
country_id: 1269750
description:
2026-01-03 01:43:30 dovecot_login authenticator failed for H=([125.23.229.42]) [182.78.64.150]:59596: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 88.147.30.59
country_id: 3175395
description:
Jan  3 01:43:49 host2 sshd[637234]: Disconnected from invalid user alina 88.147.30.59 port 57638 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.165.30.226
country_id: 1269750
description:
2026-01-03 01:43:14 dovecot_login authenticator failed for H=([103.165.30.206]) [103.165.30.226]:38896: 535 Incorrect authentication data (set_id=postmaster@kiriaswanu.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.91.246.101
country_id: 1269750
description:
Jan  3 01:44:27 host2 sshd[637726]: Disconnected from invalid user testuser 103.91.246.101 port 48346 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 88.147.30.59
country_id: 3175395
description:
Jan  3 01:46:03 host2 sshd[639877]: Disconnected from invalid user runner 88.147.30.59 port 37634 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.91.246.101
country_id: 1269750
description:
Jan  3 01:46:20 host2 sshd[640099]: Disconnected from invalid user ubuntu 103.91.246.101 port 47838 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.112.235
country_id: 1819730
description:
Jan  3 01:47:21 host2 sshd[641169]: Disconnected from invalid user sshuser 101.36.112.235 port 42706 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  3 01:47:39 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<LTGDZm1H0JNCdMcv>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.112.235
country_id: 1819730
description:
Jan  3 01:48:32 host2 sshd[642698]: Disconnected from invalid user runner 101.36.112.235 port 57446 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.112.235
country_id: 1819730
description:
Jan  3 01:49:39 host2 sshd[644021]: Disconnected from invalid user dmdba 101.36.112.235 port 45360 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.112.235
country_id: 1819730
description:
Jan  3 01:50:12 host2 sshd[644765]: Disconnected from invalid user mostafa 101.36.112.235 port 34618 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.132.97.76
country_id: 2264397
description:
2026-01-03 01:50:23 dovecot_login authenticator failed for H=a94-132-97-76.cpe.netcabo.pt [94.132.97.76]:51676: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.21.104
country_id: 1269750
description:
2026-01-03 01:50:37 dovecot_login authenticator failed for H=(abts-north-static-104.21.176.122.airtelbroadband.in) [122.176.21.104]:55166: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 88.147.30.59
country_id: 3175395
description:
Jan  3 01:50:39 host2 sshd[645288]: Disconnected from invalid user hari 88.147.30.59 port 47057 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 01:51:41 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<ssj1dG1HHsUyBvlc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.174
country_id: 1269750
description:
2026-01-03 01:52:15 dovecot_login authenticator failed for H=([182.95.178.174]) [182.95.178.174]:56380: 535 Incorrect authentication data (set_id=contact@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.121.43
country_id: 3144096
description:
2026-01-03 01:52:25 dovecot_login authenticator failed for H=(cm-178.232.121.43.get.no) [178.232.121.43]:33778: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 130.250.191.201
country_id: 1269750
description:
Jan  3 01:52:44 host2 sshd[647005]: Disconnected from invalid user test 130.250.191.201 port 56046 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.152.57.60
country_id: 2510769
description:
2026-01-03 01:55:12 dovecot_login authenticator failed for H=(cm-staticip-85-152-57-60.telecable.es) [85.152.57.60]:50954: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.94.39.65
country_id: 1269750
description:
2026-01-03 01:56:00 dovecot_login authenticator failed for H=([59.94.39.65]) [59.94.39.65]:53414: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  3 01:56:24 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<T+jMhW1HRsZnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 01:57:02 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<jWARiG1HKNIv/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 01:57:30 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<CErAiW1H9Ksv/VJZ>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.180.141.15
country_id: 2264397
description:
Jan  3 01:57:59 host2 dovecot[360729]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=185.180.141.15, lip=66.85.158.91, TLS, session=<tuKfi21HmZ65tI0P>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 130.250.191.201
country_id: 1269750
description:
Jan  3 01:58:00 host2 sshd[650594]: Disconnected from invalid user hadoop 130.250.191.201 port 38272 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.180.141.13
country_id: 2264397
description:
Jan  3 01:58:02 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.180.141.13, lip=66.85.158.91, TLS, session=<pnTDi21H7725tI0N>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.180.141.15
country_id: 2264397
description:
Jan  3 01:58:02 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low (no auth attempts in 0 secs): user=<>, rip=185.180.141.15, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<WFjQi21HW+O5tI0P>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.180.141.12
country_id: 2264397
description:
Jan  3 01:58:01 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.180.141.12, lip=66.85.158.91, TLS, session=<nmG7i21HprG5tI0M>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.180.141.14
country_id: 2264397
description:
Jan  3 01:58:03 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.180.141.14, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Ylrei21HbeW5tI0O>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.180.141.12
country_id: 2264397
description:
Jan  3 01:58:07 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.180.141.12, lip=66.85.158.91, TLS, session=<xLUQjG1HrYW5tI0M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.215.132
country_id: 3144096
description:
2026-01-03 01:58:11 dovecot_login authenticator failed for H=(cm-84.210.215.132.get.no) [84.210.215.132]:55959: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2026-01-03 01:58:19 dovecot_login authenticator failed for H=([115.240.244.52]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  3 01:58:42 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<cTAUjm1H2uwUOAHJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 130.250.191.201
country_id: 1269750
description:
Jan  3 01:58:50 host2 sshd[651161]: Disconnected from invalid user ubuntu 130.250.191.201 port 53434 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.180.141.15
country_id: 2264397
description:
Jan  3 01:58:07 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.180.141.15, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher, session=<6tIOjG1HI8O5tI0P>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.218.54.218
country_id: 6252001
description:
Jan  3 01:59:16 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=104.218.54.218, lip=66.85.158.91, session=<+9AQkG1HtKZo2jba>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  3 02:00:21 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<myL6k21HFLeygBt7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.56
country_id: 6252001
description:
Jan  3 02:01:19 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.56, lip=66.85.158.91, TLS: Connection closed, session=<LtKGl21HON+nXpI4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 130.250.191.201
country_id: 1269750
description:
Jan  3 02:01:36 host2 sshd[653118]: Disconnected from invalid user ubuntu 130.250.191.201 port 35480 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.143.17.18
country_id: 6252001
description:
2026-01-03 02:01:42 dovecot_login authenticator failed for H=47-143-17-18.fdr02.elsn.ca.frontiernet.net [47.143.17.18]:41158: 535 Incorrect authentication data (set_id=contact@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.31.197.108
country_id: 6252001
description:
2026-01-03 02:01:51 dovecot_login authenticator failed for H=(173-31-197-108.client.mchsi.com) [173.31.197.108]:55232: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2026-01-03 02:02:13 dovecot_login authenticator failed for H=(1522312565.colombiatel.co) [152.231.25.64]:38907: 535 Incorrect authentication data (set_id=test@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.123.118
country_id: 1269750
description:
2026-01-03 02:03:30 dovecot_login authenticator failed for H=([122.184.123.118]) [122.184.123.118]:43940: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 02:03:41 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<+WTcn21HhotyB6Oa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.70.126
country_id: 1269750
description:
2026-01-03 02:03:42 dovecot_login authenticator failed for H=([125.20.232.243]) [182.78.70.126]:46374: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  3 02:03:43 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<kD0AoG1HTMFIpyJ4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  3 02:03:08 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<59TpnW1HyrBo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  3 02:04:54 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<gP8+pG1HZN6eRdvj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.248.47.114
country_id: 6252001
description:
2026-01-03 02:05:49 dovecot_login authenticator failed for H=(syn-172-248-047-114.res.spectrum.com) [172.248.47.114]:57624: 535 Incorrect authentication data (set_id=sales@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.142.157
country_id: 3017382
description:
2026-01-03 02:05:57 dovecot_login authenticator failed for H=157.ip-51-75-142.eu [51.75.142.157]:51498: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 02:06:01 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<dtozqG1HZMhn9M4G>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 02:06:57 host2 sshd[657455]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.212.31
country_id: 732800
description:
Jan  3 02:06:14 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=185.255.212.31, lip=66.85.158.91, TLS, session=<P7kNqG1H69G5/9Qf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.96.198.107
country_id: 3865483
description:
Jan  3 02:06:35 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=186.96.198.107, lip=66.85.158.91, TLS, session=<7yw6qW1H1Ki6YMZr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.44.174.254
country_id: 357994
description:
2026-01-03 02:07:33 dovecot_login authenticator failed for H=([41.65.118.172]) [102.44.174.254]:39748: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  3 02:07:33 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<QXC0rW1HsNIv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.143.166
country_id: 1819730
description:
2026-01-03 02:07:45 dovecot_login authenticator failed for H=166.143.48.116.static.netvigator.com [116.48.143.166]:37468: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  3 02:14:40 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<DuUhx21H0DsjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  3 02:15:18 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<X+5xyW1HCsVnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  3 02:17:17 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<sf+A0G1HiLGi8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.231.243.28
country_id: 6252001
description:
2026-01-03 02:20:44 dovecot_login authenticator failed for H=([50.231.243.28]) [50.231.243.28]:60064: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.72.202.86
country_id: 192950
description:
2026-01-03 02:20:59 dovecot_login authenticator failed for H=([41.72.201.170]) [41.72.202.86]:58142: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-03 02:24:01 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (nosenycate) [87.103.126.54]:50626: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.88.196.91
country_id: 6252001
description:
2026-01-03 02:24:05 dovecot_plain authenticator failed for H=c-73-88-196-91.hsd1.ky.comcast.net (untied) [73.88.196.91]:58448: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  3 02:24:56 host2 sshd[677422]: Disconnected from invalid user user 2.57.121.25 port 12810 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  3 02:26:54 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@askinternationalconsortium.com>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<BDvi8m1HxuhCdMcv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.19.12.103
country_id: 2635167
description:
2026-01-03 02:26:17 dovecot_login authenticator failed for H=cpc122100-bmly10-2-0-cust102.2-3.cable.virginm.net [82.19.12.103]:33722: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.194.26.149
country_id: 1168579
description:
2026-01-03 02:26:29 dovecot_login authenticator failed for H=([45.194.26.149]) [45.194.26.149]:51940: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.68
country_id: 6252001
description:
Jan  3 02:27:16 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.20.68, lip=66.85.158.91, session=<eVVa9G1HuglBMRRE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2026-01-03 02:28:06 dovecot_plain authenticator failed for H=c-71-224-169-28.hsd1.pa.comcast.net (micaltate) [71.224.169.28]:51214: 535 Incorrect authentication data (set_id=sales@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 02:28:32 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<Y7S9+G1H1rcyBvlc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.140.54
country_id: 1269750
description:
2026-01-03 02:34:48 dovecot_login authenticator failed for H=(dsl-mp-dynamic-054.140.23.125.airtelbroadband.in) [125.23.140.54]:50026: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.245.178
country_id: 1269750
description:
2026-01-03 02:35:00 dovecot_login authenticator failed for H=(dhcp-192-245-178.in2cable.com) [203.192.245.178]:37346: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 154.127.34.194
country_id: 2395170
description:
Jan  3 02:34:11 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=154.127.34.194, lip=66.85.158.91, TLS, session=<DroEDG5Hpt+afyLC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 02:34:17 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=</MlQDW5H3pQv/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  3 02:34:18 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<I+9XDW5H4tBnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.48
country_id: 3469034
description:
Jan  3 02:34:41 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw>, method=PLAIN, rip=177.44.71.48, lip=66.85.158.91, TLS, session=<OITJDW5H2M+xLEcw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.123.109.93
country_id: 732800
description:
2026-01-03 02:36:03 dovecot_login authenticator failed for H=(test) [93.123.109.93]:51604: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.188.102.28
country_id: 298795
description:
2026-01-03 02:36:22 dovecot_login authenticator failed for H=([78.188.102.28]) [78.188.102.28]:54924: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.123.109.93
country_id: 732800
description:
2026-01-03 02:36:34 dovecot_login authenticator failed for H=(test) [93.123.109.93]:58229: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  3 02:37:53 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<Z8owGm5H6IwUOAHJ>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  3 02:38:19 host2 pure-ftpd[692499]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.128.18
country_id: 3144096
description:
2026-01-03 02:39:35 dovecot_login authenticator failed for H=(cm-178.232.128.18.get.no) [178.232.128.18]:43864: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.25.59.5
country_id: 3469034
description:
2026-01-03 02:39:46 dovecot_login authenticator failed for H=(ip-177-25-59-5.user.vivozap.com.br) [177.25.59.5]:36781: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  3 02:40:34 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<k6XCI25HmoiygBt7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.65.30
country_id: 2264397
description:
2026-01-03 02:42:03 dovecot_login authenticator failed for H=bl23-65-30.dsl.telepac.pt [144.64.65.30]:4357: 535 Incorrect authentication data (set_id=sales@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.94.69.183
country_id: 2661886
description:
2026-01-03 02:42:11 dovecot_login authenticator failed for H=183-69.soderhamn.com [81.94.69.183]:40030: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  3 02:42:31 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<y3fEKm5Huo9o7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  3 02:42:56 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<0T1ELG5HYoCeRdvj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  3 02:43:03 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<4UakLG5HVORIpyJ4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 02:43:25 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<B2nzLW5H5phyB6Oa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.46
country_id: 1036973
description:
2026-01-03 02:44:55 dovecot_login authenticator failed for H=(dynamic-adsl.movitel.co.mz) [197.219.210.46]:44556: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 02:45:55 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<InrjNm5HyLpn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  3 02:45:56 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<ajL+Nm5HANQv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.175.75
country_id: 99237
description:
2026-01-03 02:47:47 dovecot_login authenticator failed for H=([65.20.175.75]) [65.20.175.75]:40365: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.83.15
country_id: 3144096
description:
2026-01-03 02:47:55 dovecot_login authenticator failed for H=(cm-178.232.83.15.get.no) [178.232.83.15]:42800: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.24
country_id: 6252001
description:
Jan  3 02:51:56 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.24, lip=66.85.158.92, session=<iYuPTG5HMA5BMQEY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  3 02:51:32 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<95kES25HXl8jupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.24
country_id: 6252001
description:
Jan  3 02:52:09 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.24, lip=66.85.158.92, TLS: Connection closed, session=<jStPTW5H9ihBMQEY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.116
country_id: 6252001
description:
Jan  3 02:54:00 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.116, lip=66.85.158.91, TLS: Connection closed, session=<DJn0U25HRr5ChJl0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.13.139.61
country_id: 2510769
description:
2026-01-03 02:53:22 dovecot_login authenticator failed for H=61.red-88-13-139.dynamicip.rima-tde.net [88.13.139.61]:54150: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.158
country_id: 1269750
description:
2026-01-03 02:53:33 dovecot_login authenticator failed for H=([125.19.175.68]) [152.52.236.158]:55840: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  3 02:54:57 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<DfQ3V25HVtlnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  3 02:55:57 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<u+WdWm5HhMKi8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-03 02:56:53 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:62286: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
country_id: 1880251
description:
2026-01-03 02:58:18 dovecot_login authenticator failed for H=(bb128-106-196-150.singnet.com.sg) [128.106.196.150]:22631: 535 Incorrect authentication data (set_id=office@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.233.246
country_id: 1269750
description:
2026-01-03 02:58:25 dovecot_login authenticator failed for H=([125.17.233.246]) [125.17.233.246]:52384: 535 Incorrect authentication data (set_id=test@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.112.102
country_id: 1269750
description:
2026-01-03 02:58:37 dovecot_login authenticator failed for H=([182.95.112.102]) [182.95.112.102]:60342: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Jan  3 03:00:35 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.92, TLS: Connection closed, session=<DQ56a25HKJSLonQW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 03:05:50 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<2X8jfm5HEsIyBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  3 03:06:12 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@askinternationalconsortium.com>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<OWlxf25HYIpCdMcv>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 03:08:02 host2 sshd[726241]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.108.174.168
country_id: 1269750
description:
Jan  3 03:08:06 host2 pure-ftpd[726321]: (?@103.108.174.168) [INFO] New connection from 103.108.174.168


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.253.162.162
country_id: 146669
description:
Jan  3 03:08:09 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=185.253.162.162, lip=66.85.158.91, TLS handshaking: Connection closed, session=<I8uGhm5HEOW5/aKi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2026-01-03 03:08:28 dovecot_login authenticator failed for H=([196.189.59.227]) [196.189.59.226]:50782: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.177.9.119
country_id: 3865483
description:
2026-01-03 03:08:41 dovecot_login authenticator failed for H=(181-177-9-119.fiberway.com.ar) [181.177.9.119]:36162: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.90.124.154
country_id: 3042225
description:
Jan  3 03:08:09 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.90.124.154, lip=66.85.158.91, TLS handshaking: Connection closed, session=<e3KGhm5HSsZbWnya>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 37.46.113.253
country_id: 2960313
description:
Jan  3 03:08:09 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=37.46.113.253, lip=66.85.158.91, TLS, session=<vkuGhm5HJuIlLnH9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2026-01-03 03:10:24 dovecot_login authenticator failed for H=([189.108.156.41]) [187.8.64.94]:36758: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.253.154
country_id: 1269750
description:
2026-01-03 03:10:10 dovecot_login authenticator failed for H=([182.78.122.253]) [125.19.253.154]:37914: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.46.186
country_id: 1269750
description:
2026-01-03 03:11:13 dovecot_login authenticator failed for H=([125.21.153.217]) [182.95.46.186]:52550: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 03:11:33 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<0DCVkm5HEIkv/VJZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.17
country_id: 6252001
description:
Jan  3 03:13:55 host2 dovecot[360729]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.17, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Qt8km25HcNHN0h8R>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.169.53.154
country_id: 6252001
description:
Jan  3 03:14:40 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.169.53.154, lip=66.85.158.91, session=<KF3gnW5H2tYUqTWa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2026-01-03 03:14:51 dovecot_login authenticator failed for H=([178.250.191.189]) [178.250.191.189]:47846: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2026-01-03 03:16:58 dovecot_plain authenticator failed for H=c-73-137-7-97.hsd1.ga.comcast.net (nednes) [73.137.7.97]:34898: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  3 03:17:27 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<kC60p25HqrAUOAHJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
country_id: 1880251
description:
2026-01-03 03:18:30 dovecot_login authenticator failed for H=(bb128-106-196-150.singnet.com.sg) [128.106.196.150]:46371: 535 Incorrect authentication data (set_id=postmaster@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.161
country_id: 2186224
description:
2026-01-03 03:18:47 dovecot_login authenticator failed for H=([121.73.169.161]) [121.73.169.161]:37860: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.247.222.118
country_id: 6252001
description:
[2026-01-03 03:20:04 +0530] info [webmaild] 170.247.222.118 - contact@bostonlanka.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.137.164.242
country_id: 6252001
description:
[2026-01-03 03:20:04 +0530] info [webmaild] 143.137.164.242 - bostonlanka@bostonlanka.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.137.230
country_id: 1269750
description:
2026-01-03 03:21:01 dovecot_login authenticator failed for H=(abts-north-static-230.137.160.122.airtelbroadband.in) [122.160.137.230]:34435: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.65.99
country_id: 3144096
description:
2026-01-03 03:20:28 dovecot_login authenticator failed for H=(cm-178.232.65.99.get.no) [178.232.65.99]:36992: 535 Incorrect authentication data (set_id=postmaster@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  3 03:20:52 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<RTPgs25HYpSygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  3 03:21:25 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<pTXFtW5HmNaeRdvj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  3 03:22:12 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<okuuuG5HgF9o7MS0>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 114.7.163.154
country_id: 1643084
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[114.7.163.154] [Remote Port]=[42708] [Authentication Database]=[mail] [Username]=[test@essenceceylontea.com] (10/10 failures) (blocked until [Sat Jan  3 21:52:19 2026 UTC/Sun Jan  4 03:22:19 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  3 03:22:25 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<w6xvuW5HDJlIpyJ4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 03:22:21 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<438yuW5H1KZyB6Oa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.163.16.165
country_id: 6252001
description:
Jan  3 03:23:17 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.163.16.165, lip=66.85.158.92, session=<VPqtvG5HZMwUoxCl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  3 03:24:43 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<5QGpwW5HWNYv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 03:26:01 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<tdBOxm5HIINn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  3 03:28:40 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<bAnIz25H9EMjupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.38.33.1
country_id: 6252001
description:
Jan  3 03:32:04 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.38.33.1, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<Q0Ma3G5HKLAUJiEB>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.129.10
country_id: 1819730
description:
Jan  3 03:33:03 host2 sshd[753805]: Disconnected from invalid user nemo 150.5.129.10 port 60722 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.129.10
country_id: 1819730
description:
Jan  3 03:33:40 host2 sshd[754535]: Disconnected from invalid user flink 150.5.129.10 port 44062 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  3 03:35:05 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<q2O25m5Hzt5npBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.74.211.27
country_id: 6252001
description:
2026-01-03 03:35:03 dovecot_plain authenticator failed for H=c-75-74-211-27.hsd1.fl.comcast.net (rhuncitan) [75.74.211.27]:60784: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.170.52
country_id: 241170
description:
Jan  3 03:34:26 host2 sshd[755497]: Disconnected from invalid user ubuntu 154.91.170.52 port 60090 [preauth]


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 162.240.100.50
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[162.240.100.50] [Remote Port]=[58464] [Authentication Database]=[mail] [Username]=[hr@bostonlanka.com] (10/10 failures) (blocked until [Sat Jan  3 22:04:39 2026 UTC/Sun Jan  4 03:34:39 2026 LOCAL])


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 150.5.129.10
country_id: 1819730
description:
Jan  3 03:34:16 host2 sshd[755281]: Disconnected from invalid user tao 150.5.129.10 port 55628 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  3 03:34:41 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<bl9N5W5HYOSi8GQy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.89.63.39
country_id: 2635167
description:
Jan  3 03:34:46 host2 sshd[755829]: Disconnected from invalid user logstash 45.89.63.39 port 35044 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.129.10
country_id: 1819730
description:
Jan  3 03:35:26 host2 sshd[756792]: Disconnected from invalid user ry 150.5.129.10 port 50494 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.134.29.251
country_id: 1880251
description:
Jan  3 03:36:00 host2 sshd[757413]: Disconnected from invalid user hernan 43.134.29.251 port 59212 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 207.154.254.44
country_id: 2921044
description:
Jan  3 03:36:54 host2 sshd[758438]: Disconnected from invalid user runner 207.154.254.44 port 45836 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.91.236.125
country_id: 3686110
description:
Jan  3 03:37:00 host2 sshd[758519]: Disconnected from invalid user thiago 200.91.236.125 port 60569 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.89.63.39
country_id: 2635167
description:
Jan  3 03:37:12 host2 sshd[758843]: Disconnected from invalid user unifi 45.89.63.39 port 54984 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.134.29.251
country_id: 1880251
description:
Jan  3 03:37:17 host2 sshd[758993]: Disconnected from invalid user admin 43.134.29.251 port 55424 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.197.123.123
country_id: 6252001
description:
Jan  3 03:37:38 host2 sshd[759314]: Disconnected from invalid user vncuser 138.197.123.123 port 36434 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 207.154.254.44
country_id: 2921044
description:
Jan  3 03:38:29 host2 sshd[760227]: Disconnected from invalid user ftpuser 207.154.254.44 port 41634 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.119.125
country_id: 3144096
description:
2026-01-03 03:38:31 dovecot_login authenticator failed for H=([46.212.119.125]) [46.212.119.125]:49372: 535 Incorrect authentication data (set_id=postmaster@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.170.52
country_id: 241170
description:
Jan  3 03:38:44 host2 sshd[760500]: Disconnected from invalid user deploy 154.91.170.52 port 37500 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.47.2
country_id: 1269750
description:
2026-01-03 03:38:47 dovecot_login authenticator failed for H=([27.123.105.140]) [182.95.47.2]:45986: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.91.170.52
country_id: 241170
description:
Jan  3 03:39:13 host2 sshd[761035]: Disconnected from invalid user frank 154.91.170.52 port 44880 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 119.153.100.234
country_id: 1168579
description:
Jan  3 03:39:27 host2 sshd[761186]: Disconnected from invalid user myuser 119.153.100.234 port 42468 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.170.52
country_id: 241170
description:
Jan  3 03:39:39 host2 sshd[761428]: Disconnected from invalid user nirmal 154.91.170.52 port 52154 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.197.123.123
country_id: 6252001
description:
Jan  3 03:40:04 host2 sshd[762009]: Disconnected from invalid user ubuntu 138.197.123.123 port 48372 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 207.154.254.44
country_id: 2921044
description:
Jan  3 03:39:24 host2 sshd[761178]: Disconnected from invalid user deploy 207.154.254.44 port 33714 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.237.126.195
country_id: 6252001
description:
Jan  3 03:40:26 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=135.237.126.195, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<ynT5+W5HerWH7X7D>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  3 03:40:37 host2 pure-ftpd[762684]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.134.29.251
country_id: 1880251
description:
Jan  3 03:40:19 host2 sshd[762245]: Disconnected from invalid user unifi 43.134.29.251 port 60028 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.89.63.39
country_id: 2635167
description:
Jan  3 03:41:33 host2 sshd[764005]: Disconnected from invalid user vncuser 45.89.63.39 port 52752 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.91.236.125
country_id: 3686110
description:
Jan  3 03:41:41 host2 sshd[764147]: Disconnected from invalid user castle 200.91.236.125 port 33500 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.91.236.125
country_id: 3686110
description:
Jan  3 03:42:21 host2 sshd[764835]: Disconnected from invalid user admin 200.91.236.125 port 41659 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.134.29.251
country_id: 1880251
description:
Jan  3 03:42:41 host2 sshd[765119]: Disconnected from invalid user ubuntu 43.134.29.251 port 52430 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 03:43:20 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<25tABG9HDqkyBvlc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 119.153.100.234
country_id: 1168579
description:
Jan  3 03:43:32 host2 sshd[766025]: Disconnected from invalid user logstash 119.153.100.234 port 39016 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.89.63.39
country_id: 2635167
description:
Jan  3 03:44:09 host2 sshd[766963]: Disconnected from invalid user myuser 45.89.63.39 port 59734 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 119.153.100.234
country_id: 1168579
description:
Jan  3 03:45:59 host2 sshd[769928]: Disconnected from invalid user admin 119.153.100.234 port 57508 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  3 03:46:45 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@askinternationalconsortium.com>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<HYtxEG9HmMhCdMcv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 03:48:54 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<Gg4hGG9HzIIv/VJZ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 119.153.100.234
country_id: 1168579
description:
Jan  3 03:49:19 host2 sshd[774801]: Disconnected from invalid user vncuser 119.153.100.234 port 49410 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 03:49:22 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<4WjQGW9Hmo8v/VJZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.210.118
country_id: 1269750
description:
2026-01-03 03:49:30 dovecot_login authenticator failed for H=([152.52.210.118]) [152.52.210.118]:54824: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  3 03:50:06 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<MzNuHG9HYsVnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2026-01-03 03:49:16 dovecot_login authenticator failed for H=([196.191.212.235]) [213.55.85.202]:4082: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.89.63.39
country_id: 2635167
description:
Jan  3 03:53:56 host2 sshd[780488]: Disconnected from invalid user bitrix 45.89.63.39 port 48578 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 102.204.223.49
country_id: 2328926
description:
Jan  3 03:54:21 host2 pure-ftpd[781222]: (?@102.204.223.49) [INFO] New connection from 102.204.223.49


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  3 03:57:08 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<UyecNW9HitYUOAHJ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 03:57:33 host2 sshd[785380]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  3 03:59:49 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<zdMwP29H1JWeRdvj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 04:01:19 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<ERqORG9HerRyB6Oa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  3 04:01:33 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<zZVnRW9HHOKygBt7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.128.112.204
country_id: 3017382
description:
2026-01-03 04:01:38 dovecot_login authenticator failed for H=217-128-112-204.ftth.fr.orangecustomers.net [217.128.112.204]:55915: 535 Incorrect authentication data (set_id=office@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  3 04:01:45 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<R8EYRm9HTr9IpyJ4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  3 04:02:39 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<vQxTSW9H/EBo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  3 04:03:39 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<+DLoTG9HSNkv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.85
country_id: 1210997
description:
2026-01-03 04:04:43 dovecot_login authenticator failed for H=([103.115.252.60]) [103.115.252.85]:38137: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.166
country_id: 1269750
description:
2026-01-03 04:06:13 dovecot_login authenticator failed for H=([128.185.227.166]) [128.185.227.166]:52548: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  3 04:05:52 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<cYjbVG9HGMsjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 04:06:04 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<JMOLVW9H9qNn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.70.126
country_id: 1269750
description:
2026-01-03 04:06:29 dovecot_login authenticator failed for H=(nsg-corporate-137.222.185.122.airtel.in) [182.78.70.126]:42972: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  3 04:13:26 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<1iLfb29H3o+i8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  3 04:15:09 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<eS/8dW9HnK1npBQq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.105.128.11
country_id: 6252001
description:
Jan  3 04:16:13 host2 dovecot[360729]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.105.128.11, lip=66.85.158.91, session=<do3+eW9H9IWsaYAL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.35.240
country_id: 2077456
description:
2026-01-03 04:20:45 dovecot_login authenticator failed for H=([101.168.35.240]) [101.168.35.240]:39008: 535 Incorrect authentication data (set_id=postmaster@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 04:21:08 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<j1Rui29HbpIyBvlc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.85
country_id: 1210997
description:
2026-01-03 04:23:47 dovecot_login authenticator failed for H=([103.115.252.60]) [103.115.252.85]:35975: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.30
country_id: 6252001
description:
Jan  3 04:24:18 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.30, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<fcTZlm9H09OTuYQe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 04:25:59 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<MFXNnG9H1Jwv/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  3 04:26:13 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<wK2jnW9H1J5CdMcv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 04:26:27 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<TQNwnm9HzJIv/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  3 04:28:09 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<I+SGpG9H2L9nmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2026-01-03 04:32:28 dovecot_plain authenticator failed for H=c-24-15-216-41.hsd1.il.comcast.net (clion) [24.15.216.41]:33946: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  3 04:37:53 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<gkZRx29HvoeeRdvj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  3 04:38:33 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<pfW7yW9HIJQUOAHJ>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.17.41.25
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 84.17.41.25 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2026-01-03 04:40:00 dovecot_plain authenticator failed for H=c-68-40-189-43.hsd1.mi.comcast.net (homatia) [68.40.189.43]:46972: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 04:40:28 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<Z+qN0G9HPMJyB6Oa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  3 04:41:38 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<nfO91G9HPuJIpyJ4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  3 04:42:28 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<rmm0129HKNwv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  3 04:42:29 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<txPG129HtpqygBt7>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  3 04:42:54 host2 pure-ftpd[845371]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  3 04:43:00 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<Vlan2W9HznIjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  3 04:43:05 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<F3Ls2W9Hil1o7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.122
country_id: 1269750
description:
2026-01-03 04:45:48 dovecot_login authenticator failed for H=([152.52.236.122]) [152.52.236.122]:36942: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.124.111.122
country_id: 2077456
description:
2026-01-03 04:46:00 dovecot_login authenticator failed for H=27-124-111-122.static.as58511.net [27.124.111.122]:59652: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 04:46:14 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<DrM15W9HSN1n9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.7.229.227
country_id: 6252001
description:
2026-01-03 04:51:45 dovecot_login authenticator failed for H=ip68-7-229-227.sd.sd.cox.net ([127.0.0.1]) [68.7.229.227]:37028: 535 Incorrect authentication data (set_id=info@monarchdss.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.242.142
country_id: 1269750
description:
2026-01-03 04:52:29 dovecot_login authenticator failed for H=([125.19.172.137]) [182.78.242.142]:33076: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  3 04:52:32 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<maK4+29HjMSi8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2026-01-03 04:52:40 dovecot_login authenticator failed for H=([189.57.81.137]) [186.201.54.90]:38308: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  3 04:55:21 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<tT7HBXBH0r5npBQq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.2
country_id: 798549
description:
Jan  3 04:55:47 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=85.217.149.2, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<ex5/B3BHWqBV2ZUC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2026-01-03 04:56:35 dovecot_login authenticator failed for H=(syn-065-191-211-033.res.spectrum.com) [65.191.211.33]:49536: 535 Incorrect authentication data (set_id=office@kiriaswanu.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.1
country_id: 798549
description:
Jan  3 04:56:51 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.1, lip=66.85.158.92, TLS: Connection closed, session=<fHRJC3BHAKRV2ZUB>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 04:58:06 host2 sshd[867300]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 04:58:09 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<5CfUD3BH4tYyBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Jan  3 04:57:52 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<2SbLDnBHousFhH+s>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.214.84.80
country_id: 690791
description:
2026-01-03 04:58:32 dovecot_login authenticator failed for H=(91.214.84.80.sky-net.com.ua) [91.214.84.80]:60924: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.186.18.251
country_id: 798544
description:
Jan  3 05:01:03 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=185.186.18.251, lip=66.85.158.91, TLS, session=<23lDGXBHiKy5uhL7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.41.235.115
country_id: 3865483
description:
Jan  3 05:01:25 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<charanaw>, method=PLAIN, rip=181.41.235.115, lip=66.85.158.91, TLS, session=<no5yGnBH67C1Ketz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.1
country_id: 798549
description:
Jan  3 05:02:02 host2 dovecot[360729]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=85.217.149.1, lip=66.85.158.92, session=<OFDNHXBHwNlV2ZUB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
country_id: 6252001
description:
2026-01-03 05:02:28 dovecot_login authenticator failed for H=48.211.41.34.bc.googleusercontent.com [34.41.211.48]:41644: 535 Incorrect authentication data (set_id=contact@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 05:03:20 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<TuhZInBHsp4v/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 05:03:48 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@dataesite.lk>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<sfoFJHBHEJMv/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  3 05:05:44 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<ApTrKnBHFNlCdMcv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  3 05:06:21 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<JLIpLXBH2tlnmud6>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 102.204.223.73
country_id: 2328926
description:
Jan  3 05:08:25 host2 pure-ftpd[878681]: (?@102.204.223.73) [INFO] New connection from 102.204.223.73


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.165
country_id: 6252001
description:
Jan  3 05:13:33 host2 dovecot[360729]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.165, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<syX7RnBHr9jN0h+l>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.192.179.175
country_id: 798544
description:
Jan  3 05:14:30 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=193.192.179.175, lip=66.85.158.91, TLS, session=<98BxSXBHK6jBwLOv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.40.130
country_id: 226074
description:
Jan  3 05:14:52 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=196.0.40.130, lip=66.85.158.91, TLS, session=<50mOSnBHsajEACiC>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 158.69.219.227
country_id: 6251999
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[158.69.219.227] [Remote Port]=[46372] [Authentication Database]=[mail] [Username]=[admin@anandaobauae.org] (10/10 failures) (blocked until [Sat Jan  3 23:45:54 2026 UTC/Sun Jan  4 05:15:54 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  3 05:15:56 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<2qZrT3BHJLWeRdvj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.19.12.103
country_id: 2635167
description:
2026-01-03 05:18:34 dovecot_login authenticator failed for H=cpc122100-bmly10-2-0-cust102.2-3.cable.virginm.net [82.19.12.103]:47547: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
country_id: 99237
description:
2026-01-03 05:18:35 dovecot_login authenticator failed for H=([65.20.191.12]) [65.20.191.12]:54375: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.6.119
country_id: 3144096
description:
2026-01-03 05:18:57 dovecot_login authenticator failed for H=(cm-84.211.6.119.get.no) [84.211.6.119]:38257: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  3 05:18:59 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<VZNTWnBHitcUOAHJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 05:19:50 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<EDJgXXBHetByB6Oa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  3 05:20:12 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<P9muXnBH6NQjupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.162
country_id: 2993457
description:
Jan  3 05:22:12 host2 dovecot[360729]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.162, lip=66.85.158.91, session=<9eHvZXBH0v7CpRCi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  3 05:21:29 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<vLdDY3BH8o9IpyJ4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  3 05:21:31 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<nBpgY3BHPOAv+wDY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.94.237.134
country_id: 3017382
description:
Jan  3 05:21:37 host2 sshd[891900]: Disconnected from invalid user admin123 141.94.237.134 port 35568 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  3 05:23:20 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<YOzgaXBHBLWygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  3 05:23:47 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<cJZ5a3BHGA1o7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 05:26:24 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<pIfPdHBH1r9n9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.56.11.17
country_id: 3865483
description:
Jan  3 05:26:57 host2 sshd[897990]: Disconnected from invalid user oracle 186.56.11.17 port 52138 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.8.241.121
country_id: 2077456
description:
2026-01-03 05:27:59 dovecot_login authenticator failed for H=([161.8.241.121]) [161.8.241.121]:33250: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.202.250.46
country_id: 3469034
description:
2026-01-03 05:28:13 dovecot_login authenticator failed for H=([200.202.250.46]) [200.202.250.46]:60581: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.127.101.225
country_id: 1880251
description:
2026-01-03 05:27:43 dovecot_login authenticator failed for H=([101.127.101.225]) [101.127.101.225]:34290: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.122
country_id: 1269750
description:
2026-01-03 05:27:45 dovecot_login authenticator failed for H=([128.185.253.122]) [128.185.253.122]:56718: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.56.11.17
country_id: 3865483
description:
Jan  3 05:28:39 host2 sshd[900226]: Disconnected from invalid user testadmin 186.56.11.17 port 48934 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.56.11.17
country_id: 3865483
description:
Jan  3 05:29:29 host2 sshd[901269]: Disconnected from invalid user hadoop 186.56.11.17 port 33196 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 141.94.237.134
country_id: 3017382
description:
Jan  3 05:30:46 host2 sshd[902918]: Received disconnect from 141.94.237.134 port 42232:11: Bye Bye [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  3 05:31:22 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<T3GbhnBHZuGi8GQy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.94.237.134
country_id: 3017382
description:
Jan  3 05:32:26 host2 sshd[905114]: Disconnected from invalid user git 141.94.237.134 port 58436 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 141.94.237.134
country_id: 3017382
description:
Jan  3 05:34:10 host2 sshd[907095]: Disconnected from invalid user user 141.94.237.134 port 55998 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 05:34:51 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<FGAPk3BHSpMyBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  3 05:36:07 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<0P2el3BHGu1npBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.181.19.144
country_id: 1527747
description:
2026-01-03 05:36:51 dovecot_login authenticator failed for H=(158.181.19.144.mega.kg) [158.181.19.144]:49869: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.26.53.164
country_id: 1269750
description:
2026-01-03 05:36:54 dovecot_login authenticator failed for H=(abts-mh-dynamic-221.40.169.122.airtelbroadband.in) [103.26.53.164]:46618: 535 Incorrect authentication data (set_id=test@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-01-03 05:37:07 dovecot_login authenticator failed for H=([103.168.241.32]) [103.168.241.32]:45151: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.109.38.143
country_id: 6252001
description:
2026-01-03 05:37:12 dovecot_login authenticator failed for H=143.38.109.208.host.secureserver.net [208.109.38.143]:60146: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 05:40:58 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<9RzyqHBHoNkv/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 05:41:26 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<CG6hqnBHPOQv/VJZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.118
country_id: 6252001
description:
Jan  3 05:43:36 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.118, lip=66.85.158.91, TLS, session=<azWAsnBHYvOTuYR2>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  3 05:45:15 host2 pure-ftpd[919970]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  3 05:44:34 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<GmHJtXBHVNVnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  3 05:45:03 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@askinternationalconsortium.com>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<GfiFt3BHmLVCdMcv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.139.168.236
country_id: 2510769
description:
2026-01-03 05:45:40 dovecot_login authenticator failed for H=236.red-2-139-168.staticip.rima-tde.net [2.139.168.236]:48545: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-01-03 05:45:28 dovecot_login authenticator failed for H=([197.219.208.58]) [197.219.208.58]:34384: 535 Incorrect authentication data (set_id=contact@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.222.166.212
country_id: 2077456
description:
2026-01-03 05:45:38 dovecot_login authenticator failed for H=(180-222-166-212.static.dsl.net.au) [180.222.166.212]:40177: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.173.254.125
country_id: 1605651
description:
Jan  3 05:46:42 host2 sshd[922038]: Disconnected from invalid user postgres 43.173.254.125 port 36566 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.173.254.125
country_id: 1605651
description:
Jan  3 05:50:51 host2 sshd[926761]: Disconnected from invalid user testftp 43.173.254.125 port 49556 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.138.142
country_id: 3144096
description:
2026-01-03 05:54:09 dovecot_login authenticator failed for H=(cm-178.232.138.142.get.no) [178.232.138.142]:59852: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  3 05:54:20 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<rDnA2HBHVoeeRdvj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.248.47.114
country_id: 6252001
description:
2026-01-03 05:53:53 dovecot_login authenticator failed for H=(syn-172-248-047-114.res.spectrum.com) [172.248.47.114]:47481: 535 Incorrect authentication data (set_id=office@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.91.50
country_id: 1269750
description:
2026-01-03 05:54:10 dovecot_login authenticator failed for H=(nsg-corporate-50.91.186.122.airtel.in) [122.186.91.50]:33098: 535 Incorrect authentication data (set_id=office@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  3 05:57:52 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<5/pg5XBHJFcjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  3 05:59:53 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<DZmc7HBHENQUOAHJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 05:59:27 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<SuMG63BHft5yB6Oa>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.173.254.125
country_id: 1605651
description:
Jan  3 05:59:38 host2 sshd[937249]: Disconnected from invalid user ubuntu 43.173.254.125 port 45194 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  3 06:01:19 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<vdC08XBHUKVIpyJ4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.173.254.125
country_id: 1605651
description:
Jan  3 06:01:22 host2 sshd[939451]: Disconnected from invalid user deployer 43.173.254.125 port 49720 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  3 06:00:54 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<HQ4z8HBHmuUv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.2
country_id: 1269750
description:
2026-01-03 06:02:27 dovecot_login authenticator failed for H=([128.185.217.149]) [125.19.156.2]:54222: 535 Incorrect authentication data (set_id=sales@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.56
country_id: 99237
description:
2026-01-03 06:02:29 dovecot_login authenticator failed for H=([65.20.133.56]) [65.20.133.56]:50310: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.173.254.125
country_id: 1605651
description:
Jan  3 06:02:33 host2 sshd[940937]: Disconnected from invalid user user 43.173.254.125 port 50300 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.77.137.236
country_id: 1605651
description:
2026-01-03 06:02:42 dovecot_login authenticator failed for H=([110.77.137.236]) [110.77.137.236]:56862: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  3 06:05:19 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<rIQMAHFHmh1o7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  3 06:05:33 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<lz3UAHFHJsKygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 06:06:31 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<EHpXBHFHEoJn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  3 06:10:25 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<UwlAEnFHhJ+i8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.255.189.56
country_id: 298795
description:
2026-01-03 06:10:50 dovecot_login authenticator failed for H=(88.255.189.56.static.ttnet.com.tr) [88.255.189.56]:49275: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.154
country_id: 3144096
description:
2026-01-03 06:11:01 dovecot_login authenticator failed for H=(cm-84.213.189.154.get.no) [84.213.189.154]:45325: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 06:11:59 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<p0fbF3FHqOMyBvlc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-03 06:15:58 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:61640: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  3 06:17:15 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<mCu3KnFHvsdnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 06:18:40 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<3729L3FH+LIv/VJZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.169
country_id: 1819730
description:
2026-01-03 06:19:22 dovecot_login authenticator failed for H=169.47.246.220.static.netvigator.com [220.246.47.169]:57221: 535 Incorrect authentication data (set_id=postmaster@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.50.221
country_id: 3144096
description:
2026-01-03 06:19:35 dovecot_login authenticator failed for H=(cm-178.232.50.221.get.no) [178.232.50.221]:47665: 535 Incorrect authentication data (set_id=postmaster@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.173.10.75
country_id: 6252001
description:
2026-01-03 06:19:41 dovecot_login authenticator failed for H=([209.173.10.75]) [209.173.10.75]:50016: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  3 06:22:14 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<nkaGPHFHXqJnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  3 06:24:23 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<vpUxRHFHlN5CdMcv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.25
country_id: 2186224
description:
2026-01-03 06:28:26 dovecot_login authenticator failed for H=([121.73.162.25]) [121.73.162.25]:50818: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.110.189.45
country_id: 2750405
description:
2026-01-03 06:28:32 dovecot_login authenticator failed for H=([193.110.189.45]) [193.110.189.45]:50822: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.184.153.250
country_id: 1733045
description:
Jan  3 06:29:44 host2 sshd[969529]: Disconnected from invalid user rsync 202.184.153.250 port 39120 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.184.153.250
country_id: 1733045
description:
Jan  3 06:31:14 host2 sshd[971352]: Disconnected from invalid user virtual 202.184.153.250 port 58340 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  3 06:32:42 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<hpj2YXFH4rieRdvj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.212.178
country_id: 1269750
description:
2026-01-03 06:32:57 dovecot_login authenticator failed for H=([152.52.144.161]) [128.185.212.178]:38080: 535 Incorrect authentication data (set_id=postmaster@kiriaswanu.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.126
country_id: 6252001
description:
Jan  3 06:35:01 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.126, lip=66.85.158.92, TLS: Connection closed, session=<6cRhanFHTj9ChJl+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  3 06:35:30 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<szL0a3FHJl0jupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.131.63
country_id: 99237
description:
2026-01-03 06:36:54 dovecot_login authenticator failed for H=([65.20.131.63]) [65.20.131.63]:50693: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.228.134
country_id: 1269750
description:
2026-01-03 06:37:15 dovecot_login authenticator failed for H=(nsg-static-209.69.76.182-airtel.com) [128.185.228.134]:43420: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 06:38:48 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<nh7Ed3FHVOxyB6Oa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  3 06:40:33 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<rIgCfnFHQu0v+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  3 06:40:57 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<Mbl2f3FHhLIUOAHJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  3 06:41:20 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<vsfQgHFH7rlIpyJ4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 06:46:50 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<vzd4lHFHYKxn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  3 06:47:02 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<kTg2lXFHnkVo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  3 06:47:32 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@kiriaswanu.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<r7f7lnFH9KiygBt7>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  3 06:47:36 host2 pure-ftpd[988598]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 06:49:10 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<1JHZnHFHUN0yBvlc>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 102.204.223.75
country_id: 2328926
description:
Jan  3 06:48:45 host2 pure-ftpd[989677]: (?@102.204.223.75) [INFO] New connection from 102.204.223.75


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  3 06:49:50 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<SrU6n3FHNpWi8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.174.182.38
country_id: 2077456
description:
2026-01-03 06:51:02 dovecot_login authenticator failed for H=203-174-182-38.ade.static-ipl.aapt.com.au [203.174.182.38]:52256: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.192.123.12
country_id: 6252001
description:
2026-01-03 06:51:13 dovecot_plain authenticator failed for H=(vacomulla) [199.192.123.12]:40024: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.2
country_id: 1269750
description:
2026-01-03 06:53:17 dovecot_login authenticator failed for H=([125.20.223.161]) [152.52.236.2]:42586: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 06:56:30 host2 sshd[997666]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 06:56:28 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<3pXxtnFHQLcv/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 06:56:56 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<R4KguHFH6pEv/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  3 06:58:35 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<rzGBvnFHkplnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  3 07:00:23 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<a0/7xHFH/r9nmud6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.165.14.197
country_id: 3469034
description:
Jan  3 07:00:59 host2 sshd[1002787]: Disconnected from invalid user hadoop 45.165.14.197 port 22111 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.139.180.139
country_id: 3175395
description:
Jan  3 07:02:12 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<charanaw>, method=PLAIN, rip=185.139.180.139, lip=66.85.158.91, TLS, session=<lQmYynFH3gq5i7SL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.60.219.89
country_id: 6252001
description:
2026-01-03 07:02:25 dovecot_login authenticator failed for H=(136-60-219-89.googlefiber.net) [136.60.219.89]:53306: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.205
country_id: 6252001
description:
Jan  3 07:01:55 host2 dovecot[360729]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.205, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ck2NynFHecXG6xjN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.211.4.53
country_id: 2300660
description:
Jan  3 07:01:54 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=41.211.4.53, lip=66.85.158.91, TLS, session=<F5JayXFHhtQp0wQ1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.52
country_id: 798544
description:
2026-01-03 07:02:37 dovecot_login authenticator failed for H=89-67-37-52.dynamic.play.pl [89.67.37.52]:34254: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.218.54.218
country_id: 6252001
description:
Jan  3 07:02:43 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=104.218.54.218, lip=66.85.158.91, session=<cWhPzXFHWoJo2jba>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.169.85.177
country_id: 6252001
description:
Jan  3 07:03:54 host2 pure-ftpd[1006291]: (?@20.169.85.177) [INFO] New connection from 20.169.85.177


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-01-03 07:04:15 dovecot_login authenticator failed for H=(ip-103-29-185-162.pascalwave.com) [103.29.185.162]:60826: 535 Incorrect authentication data (set_id=office@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  3 07:04:15 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@askinternationalconsortium.com>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<18DM0nFHbuBCdMcv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.205
country_id: 337996
description:
2026-01-03 07:04:26 dovecot_login authenticator failed for H=([196.188.187.205]) [196.188.187.205]:56326: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.254.166.35
country_id: 1269750
description:
Jan  3 07:05:04 host2 sshd[1007702]: Disconnected from invalid user readonly 205.254.166.35 port 30115 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.254.166.35
country_id: 1269750
description:
Jan  3 07:05:51 host2 sshd[1008655]: Disconnected from invalid user adminuser 205.254.166.35 port 8783 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.172
country_id: 6252001
description:
Jan  3 07:07:00 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.172, lip=66.85.158.92, TLS, session=<q+W63HFHCPrG6xis>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.165.14.197
country_id: 3469034
description:
Jan  3 07:07:49 host2 sshd[1011199]: Disconnected from invalid user admin 45.165.14.197 port 55923 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.111.235
country_id: 1880251
description:
Jan  3 07:08:31 host2 sshd[1011967]: Disconnected from invalid user mustafa 146.190.111.235 port 58098 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 146.190.111.235
country_id: 1880251
description:
Jan  3 07:09:11 host2 sshd[1012746]: Disconnected from invalid user user2 146.190.111.235 port 37632 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.111.235
country_id: 1880251
description:
Jan  3 07:09:48 host2 sshd[1013447]: Disconnected from invalid user bitrix 146.190.111.235 port 50390 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.247.248.154
country_id: 3469034
description:
2026-01-03 07:11:05 dovecot_login authenticator failed for H=([170.247.248.154]) [170.247.248.154]:37033: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  3 07:11:15 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<rl/W63FH4KieRdvj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2026-01-03 07:10:51 dovecot_login authenticator failed for H=([185.134.179.106]) [185.101.16.250]:60409: 535 Incorrect authentication data (set_id=test@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.254.166.35
country_id: 1269750
description:
Jan  3 07:13:13 host2 sshd[1017999]: Disconnected from invalid user abc 205.254.166.35 port 26042 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  3 07:13:25 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<SFqS83FHfmsjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.120.182
country_id: 3144096
description:
2026-01-03 07:14:11 dovecot_login authenticator failed for H=(cm-178.232.120.182.get.no) [178.232.120.182]:40838: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.135.48
country_id: 3144096
description:
2026-01-03 07:13:56 dovecot_login authenticator failed for H=([188.124.135.48]) [188.124.135.48]:40189: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.176.4.105
country_id: 1168579
description:
2026-01-03 07:15:08 dovecot_login authenticator failed for H=([182.176.4.105]) [182.176.4.105]:58102: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.36.202.100
country_id: 3469034
description:
Jan  3 07:15:17 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=138.36.202.100, lip=66.85.158.91, TLS, session=<KD9Q+XFHBLeKJMpk>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.254.166.35
country_id: 1269750
description:
Jan  3 07:16:09 host2 sshd[1021897]: Disconnected from invalid user guest 205.254.166.35 port 47679 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.203.211.207
country_id: 1269750
description:
Jan  3 07:15:48 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=103.203.211.207, lip=66.85.158.91, TLS, session=<YaPx+nFHDJNny9PP>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 205.254.166.35
country_id: 1269750
description:
Jan  3 07:17:41 host2 sshd[1023435]: Disconnected from invalid user user2 205.254.166.35 port 34231 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 07:18:04 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<sjMiBHJHyIpyB6Oa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  3 07:20:09 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<JrKpC3JHvoQv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  3 07:21:20 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<eCnnD3JHPs5IpyJ4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  3 07:21:54 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<ZCLkEXJHutwUOAHJ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 07:23:44 host2 sshd[1031166]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 07:27:13 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<4jrsJHJHpoMyBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 07:27:22 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<iWF6JXJHoJ9n9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  3 07:27:29 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<IJLgJXJHaDVo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  3 07:29:12 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<Ic78K3JH9KWygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  3 07:29:29 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<2uUBLXJH6oai8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.40.238
country_id: 1210997
description:
2026-01-03 07:31:01 dovecot_login authenticator failed for H=([49.0.40.238]) [49.0.40.238]:49968: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-01-03 07:32:50 dovecot_plain authenticator failed for H=(undarcur) [24.187.213.29]:42314: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Jan  3 07:34:13 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<WuwPPnJH0t2LonQW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 07:34:36 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<TTJWP3JHdM4v/VJZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.35.240
country_id: 2077456
description:
2026-01-03 07:36:46 dovecot_login authenticator failed for H=([101.168.35.240]) [101.168.35.240]:55246: 535 Incorrect authentication data (set_id=contact@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.24
country_id: 2186224
description:
2026-01-03 07:37:07 dovecot_login authenticator failed for H=([121.73.169.24]) [121.73.169.24]:51542: 535 Incorrect authentication data (set_id=contact@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  3 07:38:30 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<LCxDTXJHpqlnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  3 07:39:45 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=</VC3UXJHNopnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  3 07:43:18 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@askinternationalconsortium.com>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<7jtvXnJHIs5CdMcv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.251.240
country_id: 290557
description:
2026-01-03 07:49:00 dovecot_login authenticator failed for H=([94.207.251.240]) [94.207.251.240]:42886: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.210.118
country_id: 1269750
description:
2026-01-03 07:49:10 dovecot_login authenticator failed for H=([125.17.48.129]) [152.52.210.118]:60336: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  3 07:49:54 host2 pure-ftpd[1057267]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  3 07:50:03 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<KeOJdnJHitGeRdvj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.123.45.2
country_id: 1269750
description:
2026-01-03 07:50:42 dovecot_login authenticator failed for H=([103.123.45.2]) [103.123.45.2]:38144: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  3 07:51:08 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<8Ah6enJHwIMjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 07:58:02 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<J3cak3JH3phyB6Oa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.171.86.81
country_id: 2017370
description:
2026-01-03 07:59:36 dovecot_login authenticator failed for H=([93.171.86.81]) [93.171.86.81]:43350: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.1.105.105
country_id: 1269750
description:
2026-01-03 07:59:36 dovecot_login authenticator failed for H=([61.1.105.105]) [61.1.105.105]:42209: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.130
country_id: 6252001
description:
Jan  3 07:58:34 host2 dovecot[360729]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=71.6.146.130, lip=66.85.158.92, session=<AQIrlXJH7s5HBpKC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  3 07:59:14 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<Zitql3JH0okv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  3 08:00:46 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<QqfmnHJHHOJIpyJ4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  3 08:03:51 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<VW3sp3JHgKIUOAHJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 08:05:45 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<n++3rnJHQMsyBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 08:08:02 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<OVDltnJHvuFn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.10
country_id: 1269750
description:
2026-01-03 08:08:11 dovecot_login authenticator failed for H=(abts-north-dynamic-121.212.66.182.airtelbroadband.in) [27.123.113.10]:59782: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  3 08:07:50 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<KAYutnJHzJxo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.146.144
country_id: 1819730
description:
2026-01-03 08:07:54 dovecot_login authenticator failed for H=(m121-202-146-144.smartone.com) [121.202.146.144]:48215: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  3 08:09:09 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<3yXbunJHrICi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  3 08:11:31 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<W9hWw3JHQNOygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 08:12:59 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<EbeLyHJHfpEv/VJZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
country_id: 6252001
description:
2026-01-03 08:16:09 dovecot_login authenticator failed for H=48.211.41.34.bc.googleusercontent.com [34.41.211.48]:50870: 535 Incorrect authentication data (set_id=test@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  3 08:16:10 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<ppT003JHnMZnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2026-01-03 08:16:23 dovecot_login authenticator failed for H=([115.240.244.52]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.142.132
country_id: 1733045
description:
2026-01-03 08:16:29 dovecot_login authenticator failed for H=([49.124.142.132]) [49.124.142.132]:53856: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.130
country_id: 1269750
description:
2026-01-03 08:16:33 dovecot_login authenticator failed for H=([152.52.238.88]) [182.95.184.130]:52000: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.33.59.116
country_id: 3469034
description:
Jan  3 08:17:27 host2 sshd[1087718]: Disconnected from invalid user update 187.33.59.116 port 48921 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.33.59.116
country_id: 3469034
description:
Jan  3 08:19:05 host2 sshd[1089514]: Disconnected from invalid user luser 187.33.59.116 port 34564 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.140.19.22
country_id: 1269750
description:
Jan  3 08:20:36 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=103.140.19.22, lip=66.85.158.91, session=<+/PT43JHXINnjBMW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  3 08:20:42 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<kTgx5HJH9I1npBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  3 08:22:10 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<N3Jo6XJHlOhCdMcv>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 129.213.226.156
country_id: 6252001
description:
Jan  3 08:22:39 host2 sshd[1094148]: Disconnected from invalid user prog 129.213.226.156 port 56996 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 154.81.15.190
country_id: 241170
description:
Jan  3 08:24:44 host2 dovecot[360729]: imap-login: Disconnected: Connection closed: read(size=1013) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=154.81.15.190, lip=66.85.158.92, session=<jnK78nJH9LmaUQ++>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.249
country_id: 1168579
description:
2026-01-03 08:24:45 dovecot_login authenticator failed for H=(249.92.zcomnetworks.com.pk) [103.148.92.249]:2577: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2026-01-03 08:24:58 dovecot_login authenticator failed for H=([128.185.23.89]) [125.19.160.206]:49346: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.83
country_id: 1733045
description:
2026-01-03 08:25:07 dovecot_login authenticator failed for H=([49.125.201.83]) [49.125.201.83]:58708: 535 Incorrect authentication data (set_id=contact@kiriaswanu.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.213.226.156
country_id: 6252001
description:
Jan  3 08:24:24 host2 sshd[1096368]: Disconnected from invalid user vlc 129.213.226.156 port 57480 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.43
country_id: 1819730
description:
Jan  3 08:27:46 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=45.142.154.43, lip=66.85.158.91, TLS handshaking: Connection closed, session=<JiKW/XJHnMstjpor>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  3 08:28:48 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<iTcmAXNHptyeRdvj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  3 08:29:14 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<NZ+3AnNHWN8jupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.121
country_id: 6252001
description:
Jan  3 08:30:10 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.121, lip=66.85.158.92, session=<nz0wBnNHDOrG6xh5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.22
country_id: 798549
description:
Jan  3 08:31:55 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.22, lip=66.85.158.92, session=<qMVqDHNH9shV2ZUW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.161.232.9
country_id: 6252001
description:
2026-01-03 08:33:57 dovecot_login authenticator failed for H=ip98-161-232-9.ph.ph.cox.net [98.161.232.9]:35330: 535 Incorrect authentication data (set_id=office@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.183.66
country_id: 1269750
description:
2026-01-03 08:33:58 dovecot_login authenticator failed for H=([125.19.183.66]) [125.19.183.66]:52584: 535 Incorrect authentication data (set_id=office@kiriaswanu.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.226
country_id: 6252001
description:
Jan  3 08:36:11 host2 pure-ftpd[1109496]: (?@198.235.24.226) [INFO] New connection from 198.235.24.226


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 08:37:36 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<dx+fIHNHSKdyB6Oa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  3 08:38:23 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<Cx1uI3NHqI4v+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  3 08:40:15 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<GxkYKnNHDodIpyJ4>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 213.225.7.103
country_id: 2782113
description:
Jan  3 08:42:18 host2 sshd[1116743]: Disconnected from invalid user secretaria 213.225.7.103 port 30084 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.225.7.103
country_id: 2782113
description:
Jan  3 08:41:40 host2 sshd[1116121]: Disconnected from invalid user sftp 213.225.7.103 port 30083 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.136.164.157
country_id: 6252001
description:
2026-01-03 08:42:30 dovecot_login authenticator failed for H=c-76-136-164-157.hsd1.il.comcast.net [76.136.164.157]:45939: 535 Incorrect authentication data (set_id=sales@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.214.49.194
country_id: 6252001
description:
2026-01-03 08:42:43 dovecot_login authenticator failed for H=wsip-72-214-49-194.hr.hr.cox.net [72.214.49.194]:58534: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.225.7.103
country_id: 2782113
description:
Jan  3 08:42:58 host2 sshd[1117708]: Disconnected from invalid user bull 213.225.7.103 port 30085 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 08:43:01 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<SdcCNHNHLuoyBvlc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.125.120.7
country_id: 2245662
description:
Jan  3 08:44:03 host2 sshd[1118792]: Disconnected from invalid user deluge 154.125.120.7 port 36825 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.225.7.103
country_id: 2782113
description:
Jan  3 08:43:37 host2 sshd[1118422]: Disconnected from invalid user lia 213.225.7.103 port 30086 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  3 08:44:24 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<kg31OHNHatcUOAHJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.125.120.7
country_id: 2245662
description:
Jan  3 08:45:18 host2 sshd[1120013]: Disconnected from invalid user spread 154.125.120.7 port 58872 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 08:47:05 host2 sshd[1121728]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.125.120.7
country_id: 2245662
description:
Jan  3 08:46:37 host2 sshd[1121238]: Disconnected from invalid user postgres 154.125.120.7 port 52178 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.14
country_id: 3017382
description:
Jan  3 08:47:10 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=91.196.152.14, lip=66.85.158.91, session=<fVbwQnNHS+hbxJgO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.99
country_id: 3017382
description:
Jan  3 08:47:20 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.196.152.99, lip=66.85.158.91, session=<SVeNQ3NHa79bxJhj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.10
country_id: 3017382
description:
Jan  3 08:47:34 host2 dovecot[360729]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=91.196.152.10, lip=66.85.158.91, session=<IDZeRHNHMbhbxJgK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.102
country_id: 3017382
description:
Jan  3 08:47:37 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.102, lip=66.85.158.91, session=<+4mQRHNH149bxJhm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  3 08:47:46 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<WC/5RHNH3KNo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 08:48:58 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<ucg1SXNHIotn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  3 08:49:00 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<7c5nSXNHuoui8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.201.237.208
country_id: 1269750
description:
2026-01-03 08:51:20 dovecot_login authenticator failed for H=(abts-west-static-208.237.201.106.airtelbroadband.in) [106.201.237.208]:42196: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.212.178
country_id: 1269750
description:
2026-01-03 08:51:22 dovecot_login authenticator failed for H=([152.52.144.161]) [128.185.212.178]:53276: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Jan  3 08:51:24 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<AnAAUnNHoNsFhH+s>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.157.95.30
country_id: 6251999
description:
2026-01-03 08:51:30 dovecot_login authenticator failed for H=d157-95-30.home4.cgocable.net [24.157.95.30]:40874: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.200.42.112
country_id: 1880251
description:
2026-01-03 08:51:40 dovecot_login authenticator failed for H=([118.200.42.112]) [118.200.42.112]:51250: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 08:51:44 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<xwYpU3NHPqgv/VJZ>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  3 08:52:38 host2 pure-ftpd[1127572]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  3 08:54:15 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<NEEdXHNHmoBnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  3 08:53:41 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<nCgoWnNHVt6ygBt7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 209.38.237.34
country_id: 2921044
description:
Jan  3 08:56:05 host2 dovecot[360729]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=209.38.237.34, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<GvLYYnNHvUPRJu0i>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.68.71.16
country_id: 2921044
description:
Jan  3 08:56:40 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=138.68.71.16, lip=66.85.158.91, TLS handshaking: Connection closed, session=<PFDxZHNHuo2KREcQ>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 152.32.190.153
country_id: 1819730
description:
Jan  3 08:58:22 host2 pure-ftpd[1135443]: (?@152.32.190.153) [INFO] New connection from 152.32.190.153


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 152.32.190.153
country_id: 1819730
description:
Jan  3 08:58:23 host2 pure-ftpd[1135461]: (?@152.32.190.153) [INFO] New connection from 152.32.190.153


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.162.191
country_id: 3144096
description:
2026-01-03 08:59:51 dovecot_login authenticator failed for H=(cm-178.232.162.191.get.no) [178.232.162.191]:40719: 535 Incorrect authentication data (set_id=postmaster@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.165.78.31
country_id: 1819730
description:
2026-01-03 08:59:51 dovecot_login authenticator failed for H=([69.165.78.31]) [69.165.78.31]:58466: 535 Incorrect authentication data (set_id=postmaster@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.130.206
country_id: 3144096
description:
2026-01-03 09:00:00 dovecot_login authenticator failed for H=(cm-178.232.130.206.get.no) [178.232.130.206]:57161: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.157.95.30
country_id: 6251999
description:
2026-01-03 09:00:06 dovecot_login authenticator failed for H=d157-95-30.home4.cgocable.net [24.157.95.30]:35118: 535 Incorrect authentication data (set_id=postmaster@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.77.179.130
country_id: 3469034
description:
Jan  3 09:01:06 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<charanaw>, method=PLAIN, rip=200.77.179.130, lip=66.85.158.91, TLS, session=<NnXBc3NHQ7TITbOC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  3 09:01:07 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<gmW2dHNHXKNCdMcv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.182
country_id: 3469034
description:
Jan  3 09:00:46 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=190.89.136.182, lip=66.85.158.91, TLS, session=<LRd3cnNHw6O+WYi2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  3 09:02:06 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<PPw/eHNHDLlnpBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2026-01-03 09:02:57 dovecot_plain authenticator failed for H=c-73-13-220-220.hsd1.de.comcast.net (beriniss) [73.13.220.220]:34640: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.62.25.91
country_id: 2635167
description:
Jan  3 09:05:46 host2 sshd[1143477]: Disconnected from invalid user soporte 178.62.25.91 port 48734 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.57.141
country_id: 6252001
description:
Jan  3 09:06:20 host2 sshd[1144028]: Disconnected from invalid user mcserver 198.98.57.141 port 33094 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  3 09:07:09 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<o7FLinNH5m4jupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  3 09:07:48 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<4GipjHNHnJCeRdvj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.57.141
country_id: 6252001
description:
Jan  3 09:07:59 host2 sshd[1145625]: Disconnected from invalid user teamspeak3 198.98.57.141 port 55878 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.135.208.32
country_id: 1861060
description:
2026-01-03 09:08:23 dovecot_login authenticator failed for H=dsl-212-135-208-32.dsl.easynet.co.uk [212.135.208.32]:50734: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.110
country_id: 1149361
description:
2026-01-03 09:08:26 dovecot_login authenticator failed for H=([180.94.75.110]) [180.94.75.110]:52253: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.218.47
country_id: 3144096
description:
2026-01-03 09:08:32 dovecot_login authenticator failed for H=(cm-178.232.218.47.get.no) [178.232.218.47]:41086: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.238.213.180
country_id: 2661886
description:
2026-01-03 09:08:37 dovecot_login authenticator failed for H=h85-238-213-180.cust.bredband2.com [85.238.213.180]:35016: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.98.57.141
country_id: 6252001
description:
Jan  3 09:08:41 host2 sshd[1146338]: Disconnected from invalid user lc 198.98.57.141 port 39386 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.176.79.137
country_id: 1643084
description:
Jan  3 09:09:35 host2 sshd[1147001]: Disconnected from invalid user user 103.176.79.137 port 44018 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.57.141
country_id: 6252001
description:
Jan  3 09:09:58 host2 sshd[1147363]: Disconnected from invalid user diego 198.98.57.141 port 34634 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.176.79.137
country_id: 1643084
description:
Jan  3 09:11:35 host2 sshd[1149347]: Disconnected from invalid user bitrix 103.176.79.137 port 54866 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.199.212.141
country_id: 719819
description:
Jan  3 09:11:55 host2 sshd[1149661]: Disconnected from invalid user kingbase 195.199.212.141 port 49452 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.218.54.218
country_id: 6252001
description:
Jan  3 09:12:14 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=104.218.54.218, lip=66.85.158.91, session=<KT1vnHNHiOJo2jba>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.62.25.91
country_id: 2635167
description:
Jan  3 09:12:19 host2 sshd[1150061]: Disconnected from invalid user mcserver 178.62.25.91 port 56144 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.2.19
country_id: 690791
description:
Jan  3 09:13:51 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=176.103.2.19, lip=66.85.158.91, TLS, session=<AlhPoXNHaJawZwIT>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 178.62.25.91
country_id: 2635167
description:
Jan  3 09:13:50 host2 sshd[1151535]: Disconnected from invalid user pavan 178.62.25.91 port 48668 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.121
country_id: 6252001
description:
Jan  3 09:13:52 host2 pure-ftpd[1151569]: (?@66.132.153.121) [INFO] New connection from 66.132.153.121


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.53.165.210
country_id: 3469034
description:
Jan  3 09:14:14 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=177.53.165.210, lip=66.85.158.91, TLS, session=<JIeRonNHguuxNaXS>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 09:14:25 host2 sshd[1152130]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  3 09:17:28 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<DLA1r3NHNpIv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  3 09:20:16 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<u9YzuXNHBptIpyJ4>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 69.74.29.21
country_id: 6252001
description:
Jan  3 09:21:45 host2 sshd[1159914]: Disconnected from invalid user sdc 69.74.29.21 port 25976 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 09:17:29 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<dlFJr3NHjrVyB6Oa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 09:21:07 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<KQxBvHNH4MEyBvlc>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 207.90.244.28
country_id: 6252001
description:
Jan  3 09:21:32 host2 pure-ftpd[1159724]: (?@207.90.244.28) [INFO] New connection from 207.90.244.28


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.132.181.70
country_id: 1522867
description:
2026-01-03 09:17:01 dovecot_login authenticator failed for H=2.132.181.70.dynamic.telecom.kz [2.132.181.70]:45035: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.233
country_id: 2635167
description:
Jan  3 09:18:27 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 14 secs): user=<>, rip=35.203.210.233, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<bBfWsnNHnsUjy9Lp>


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 207.90.244.28
country_id: 6252001
description:
Jan  3 09:21:33 host2 pure-ftpd[1159744]: (?@207.90.244.28) [INFO] New connection from 207.90.244.28


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.76.188.180
country_id: 1819730
description:
2026-01-03 09:17:07 dovecot_login authenticator failed for H=180.188.76.219.static.netvigator.com [219.76.188.180]:49308: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.178.224.92
country_id: 1880251
description:
Jan  3 09:23:45 host2 pure-ftpd[1162010]: (?@158.178.224.92) [INFO] New connection from 158.178.224.92


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 158.178.224.92
country_id: 1880251
description:
Jan  3 09:24:00 host2 pure-ftpd[1162253]: (?@158.178.224.92) [INFO] New connection from 158.178.224.92


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.176.79.137
country_id: 1643084
description:
Jan  3 09:23:23 host2 sshd[1161570]: Disconnected from invalid user server 103.176.79.137 port 56230 [preauth]


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 158.178.224.92
country_id: 1880251
description:
Jan  3 09:24:25 host2 pure-ftpd[1162827]: (?@158.178.224.92) [INFO] New connection from 158.178.224.92


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.178.224.92
country_id: 1880251
description:
Jan  3 09:24:23 host2 pure-ftpd[1162791]: (?@158.178.224.92) [INFO] New connection from 158.178.224.92


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  3 09:25:01 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<oT81ynNHOocUOAHJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.215.132
country_id: 3144096
description:
2026-01-03 09:25:30 dovecot_login authenticator failed for H=(cm-84.210.215.132.get.no) [84.210.215.132]:43216: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.110.96
country_id: 3144096
description:
2026-01-03 09:25:33 dovecot_login authenticator failed for H=(cm-84.215.110.96.get.no) [84.215.110.96]:46030: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.173.117.246
country_id: 6252001
description:
Jan  3 09:25:22 host2 sshd[1163937]: Disconnected from invalid user composeruser 172.173.117.246 port 44802 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.226.182
country_id: 3469034
description:
2026-01-03 09:25:22 dovecot_login authenticator failed for H=(189-108-192-66.customer.tdatabrasil.net.br) [187.50.226.182]:48529: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.233
country_id: 2635167
description:
Jan  3 09:26:24 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.233, lip=66.85.158.92, TLS, session=<Cr1Fz3NHmO8jy9Lp>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.173.117.246
country_id: 6252001
description:
Jan  3 09:26:38 host2 sshd[1165358]: Disconnected from invalid user test 172.173.117.246 port 42102 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.18.229.251
country_id: 1694008
description:
Jan  3 09:26:41 host2 sshd[1165372]: Disconnected from invalid user user 103.18.229.251 port 44704 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.18.229.251
country_id: 1694008
description:
Jan  3 09:27:30 host2 sshd[1166269]: Disconnected from invalid user sdadmin 103.18.229.251 port 50950 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  3 09:28:17 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<18vT1XNHyHlo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  3 09:28:59 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<G7Bj2HNHIKSi8GQy>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.140
country_id: 6252001
description:
Jan  3 09:39:41 host2 pure-ftpd[1168487]: (?@66.132.153.140) [INFO] New connection from 66.132.153.140


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 66.132.153.140
country_id: 6252001
description:
Jan  3 09:39:41 host2 pure-ftpd[1168504]: (?@66.132.153.140) [INFO] New connection from 66.132.153.140


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 09:39:41 host2 dovecot[360729]: pop3-login: Disconnected: Inactivity (no auth attempts in 548 secs): user=<>, rip=103.244.206.6, lip=66.85.158.91, session=<q7Gf/nNH2qhn9M4G>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 09:39:41 host2 dovecot[360729]: pop3-login: Disconnected: Inactivity (no auth attempts in 555 secs): user=<>, rip=47.253.82.89, lip=66.85.158.91, session=<AGqp/nNHAqUv/VJZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 196.251.102.24
country_id: 241170
description:
Jan  3 09:40:42 host2 dovecot[360729]: pop3-login: Disconnected: Shutting down (disconnected while authenticating, waited 51 secs): user=<>, method=PLAIN, rip=196.251.102.24, lip=66.85.158.91, session=<yb9i/3NHVOTE+2YY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  3 09:40:42 host2 dovecot[360729]: pop3-login: Disconnected: Shutting down (disconnected while authenticating, waited 28 secs): user=<>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<b2i5AHRHuodCdMcv>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 207.90.244.28
country_id: 6252001
description:
Jan  3 09:41:11 host2 pure-ftpd[1169845]: (?@207.90.244.28) [INFO] New connection from 207.90.244.28


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 207.90.244.28
country_id: 6252001
description:
Jan  3 09:41:12 host2 pure-ftpd[1169869]: (?@207.90.244.28) [INFO] New connection from 207.90.244.28


plugin: ossec
rule: 9703
name: Dovecot is Starting Up.
description:
Jan  3 09:42:36 host2 dovecot[1170103]: master: Dovecot v2.3.21.1 (d492236fa0) starting up for lmtp, imap, pop3 (core dumps disabled)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.188.10
country_id: 3144096
description:
2026-01-03 09:43:12 dovecot_login authenticator failed for H=(cm-178.232.188.10.get.no) [178.232.188.10]:49886: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.190.94
country_id: 2542007
description:
2026-01-03 09:43:14 dovecot_login authenticator failed for H=([105.73.190.94]) [105.73.190.94]:38589: 535 Incorrect authentication data (set_id=contact@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  3 09:43:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<d9nUC3RHnJdnpBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.49.166
country_id: 1269750
description:
2026-01-03 09:43:36 dovecot_login authenticator failed for H=([182.95.49.166]) [182.95.49.166]:57454: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  3 09:44:29 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 6 secs): user=<hr@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<gEqVD3RH+D8jupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  3 09:46:58 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<FY+xGHRHRqKeRdvj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  3 09:49:17 host2 sshd[1174337]: Disconnected from invalid user admin 2.57.121.112 port 22699 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  3 09:51:36 host2 pure-ftpd[1176422]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.70.122.245
country_id: 1269750
description:
2026-01-03 09:52:02 dovecot_login authenticator failed for H=(abts-mum-static-245.122.70.182.airtelbroadband.in) [182.70.122.245]:42309: 535 Incorrect authentication data (set_id=office@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.126
country_id: 1269750
description:
2026-01-03 09:52:06 dovecot_login authenticator failed for H=([27.123.114.126]) [27.123.114.126]:40400: 535 Incorrect authentication data (set_id=office@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.222.51.149
country_id: 2510769
description:
2026-01-03 09:52:11 dovecot_login authenticator failed for H=149.51.222.87.dynamic.jazztel.es [87.222.51.149]:51004: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.38.0.41
country_id: 6252001
description:
2026-01-03 09:52:24 dovecot_login authenticator failed for H=([45.38.0.41]) [45.38.0.41]:4345: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  3 09:56:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<JfjKOnRHzpUv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 09:57:37 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<xBzQPnRHusNyB6Oa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 09:58:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<pNk/Q3RHgK4yBvlc>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.136
country_id: 6252001
description:
Jan  3 10:00:11 host2 pure-ftpd[1185533]: (?@66.132.153.136) [INFO] New connection from 66.132.153.136


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  3 10:00:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<VXoHSHRHVLFIpyJ4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2026-01-03 10:00:37 dovecot_login authenticator failed for H=syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:51694: 535 Incorrect authentication data (set_id=sales@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.165.30.226
country_id: 1269750
description:
2026-01-03 10:00:53 dovecot_login authenticator failed for H=([103.165.30.206]) [103.165.30.226]:54223: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-01-03 10:00:41 dovecot_login authenticator failed for H=([197.219.228.242]) [197.219.228.242]:42458: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.181.196.96
country_id: 3469034
description:
2026-01-03 10:00:59 dovecot_login authenticator failed for H=(96.196.181.45.datasysteminfor.com.br) [45.181.196.96]:60546: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2026-01-03 10:01:28 dovecot_plain authenticator failed for H=c-73-13-220-220.hsd1.de.comcast.net (dizedolia) [73.13.220.220]:38006: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  3 10:05:48 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<FhAIXHRHaIkUOAHJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.171.99
country_id: 1819730
description:
Jan  3 10:06:48 host2 sshd[1192287]: Disconnected from invalid user ts3server 152.32.171.99 port 46776 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2026-01-03 10:07:43 dovecot_plain authenticator failed for H=(bandrols) [94.201.22.158]:46939: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.213.238.91
country_id: 1210997
description:
Jan  3 10:07:45 host2 sshd[1193255]: Disconnected from invalid user ts3server 103.213.238.91 port 52708 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.231.222.161
country_id: 3190538
description:
Jan  3 10:08:35 host2 pure-ftpd[1194186]: (?@91.231.222.161) [INFO] New connection from 91.231.222.161


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  3 10:08:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<rVs0Z3RH2rWi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 10:09:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<zYuDZ3RHwNsv/VJZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.83.15
country_id: 3144096
description:
2026-01-03 10:09:21 dovecot_login authenticator failed for H=(cm-178.232.83.15.get.no) [178.232.83.15]:47081: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.38.27
country_id: 798544
description:
2026-01-03 10:09:21 dovecot_login authenticator failed for H=89-67-38-27.dynamic.play.pl [89.67.38.27]:45070: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  3 10:09:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<eL1baXRHRP9o7MS0>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.213.238.91
country_id: 1210997
description:
Jan  3 10:09:57 host2 sshd[1195543]: Disconnected from invalid user server 103.213.238.91 port 37218 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  3 10:10:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<WPEFbXRHdrhnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 10:11:08 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<MYsab3RHPLpn9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.213.238.91
country_id: 1210997
description:
Jan  3 10:11:24 host2 sshd[1197310]: Disconnected from invalid user x 103.213.238.91 port 36300 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2026-01-03 10:13:35 dovecot_plain authenticator failed for H=(denes) [24.104.225.201]:41779: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.171.99
country_id: 1819730
description:
Jan  3 10:14:28 host2 sshd[1200936]: Disconnected from invalid user server 152.32.171.99 port 44956 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.196.64.198
country_id: 1835841
description:
Jan  3 10:14:34 host2 sshd[1201010]: Disconnected from invalid user nandan 20.196.64.198 port 40400 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.91.81.224
country_id: 1880251
description:
Jan  3 10:15:12 host2 sshd[1201809]: Disconnected from invalid user service 154.91.81.224 port 37212 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.196.64.198
country_id: 1835841
description:
Jan  3 10:17:07 host2 sshd[1204066]: Disconnected from invalid user postgres 20.196.64.198 port 59422 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.240
country_id: 6252001
description:
Jan  3 10:16:15 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.240, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<p3WKgXRH+9jN0h/w>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.171.99
country_id: 1819730
description:
Jan  3 10:16:38 host2 sshd[1203563]: Disconnected from invalid user postgres 152.32.171.99 port 56572 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.81.224
country_id: 1880251
description:
Jan  3 10:17:21 host2 sshd[1204293]: Disconnected from invalid user user7 154.91.81.224 port 46336 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.142.184.55
country_id: 1210997
description:
2026-01-03 10:17:43 dovecot_login authenticator failed for H=([103.133.175.82]) [103.142.184.55]:38829: 535 Incorrect authentication data (set_id=postmaster@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.222.166.212
country_id: 2077456
description:
2026-01-03 10:17:47 dovecot_login authenticator failed for H=(180-222-166-212.static.dsl.net.au) [180.222.166.212]:56659: 535 Incorrect authentication data (set_id=postmaster@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.199.94.128
country_id: 6252001
description:
Jan  3 10:17:54 host2 sshd[1205063]: Disconnected from invalid user debian 24.199.94.128 port 37744 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.89.161.111
country_id: 1269750
description:
Jan  3 10:18:25 host2 sshd[1205629]: Disconnected from invalid user paula 159.89.161.111 port 54970 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.196.64.198
country_id: 1835841
description:
Jan  3 10:18:29 host2 sshd[1205698]: Disconnected from invalid user max 20.196.64.198 port 39988 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.199.94.128
country_id: 6252001
description:
Jan  3 10:19:28 host2 sshd[1206969]: Disconnected from invalid user user7 24.199.94.128 port 51624 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  3 10:19:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<T+82jnRHLrVCdMcv>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.89.161.111
country_id: 1269750
description:
Jan  3 10:20:13 host2 sshd[1208084]: Disconnected from invalid user forest 159.89.161.111 port 47256 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.89.154.59
country_id: 285570
description:
Jan  3 10:20:26 host2 sshd[1208402]: Disconnected from invalid user service 78.89.154.59 port 34090 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 78.89.154.59
country_id: 285570
description:
Jan  3 10:21:13 host2 sshd[1209464]: Disconnected from invalid user vpn 78.89.154.59 port 38582 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  3 10:22:06 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<hYFglnRHfmAjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.89.161.111
country_id: 1269750
description:
Jan  3 10:22:37 host2 sshd[1210842]: Disconnected from invalid user borg 159.89.161.111 port 33620 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 159.89.161.111
country_id: 1269750
description:
Jan  3 10:23:12 host2 sshd[1211677]: Disconnected from invalid user super 159.89.161.111 port 55226 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.248.243.181
country_id: 2542007
description:
2026-01-03 10:24:22 dovecot_plain authenticator failed for H=(proks) [41.248.243.181]:53514: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.199.126
country_id: 1269750
description:
2026-01-03 10:26:07 dovecot_login authenticator failed for H=([182.79.31.107]) [152.52.199.126]:45992: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  3 10:25:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<zANfoXRHAuJnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  3 10:26:01 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<MERWpHRHrpyeRdvj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.149
country_id: 3996063
description:
2026-01-03 10:26:05 dovecot_login authenticator failed for H=([177.236.146.149]) [177.236.146.149]:33768: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.162.191
country_id: 3144096
description:
2026-01-03 10:26:13 dovecot_login authenticator failed for H=(cm-178.232.162.191.get.no) [178.232.162.191]:37402: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.16.55
country_id: 3469034
description:
2026-01-03 10:27:33 dovecot_login authenticator failed for H=(177-174-16-55.user.vivozap.com.br) [177.174.16.55]:41627: 535 Incorrect authentication data (set_id=office@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.83.135.122
country_id: 6251999
description:
2026-01-03 10:29:14 dovecot_login authenticator failed for H=([24.83.135.122]) [24.83.135.122]:57176: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.179.128
country_id: 3996063
description:
2026-01-03 10:29:24 dovecot_login authenticator failed for H=([140.84.179.128]) [140.84.179.128]:34634: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.251.120
country_id: 2921044
description:
Jan  3 10:29:52 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=164.92.251.120, lip=66.85.158.91, TLS handshaking: Connection closed, session=<piw8snRHTs+kXPt4>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.178.229.240
country_id: 1880251
description:
Jan  3 10:32:30 host2 pure-ftpd[1220948]: (?@158.178.229.240) [INFO] New connection from 158.178.229.240


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 158.178.229.240
country_id: 1880251
description:
Jan  3 10:32:34 host2 pure-ftpd[1221038]: (?@158.178.229.240) [INFO] New connection from 158.178.229.240


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.178.229.240
country_id: 1880251
description:
Jan  3 10:33:09 host2 pure-ftpd[1221749]: (?@158.178.229.240) [INFO] New connection from 158.178.229.240


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 158.178.229.240
country_id: 1880251
description:
Jan  3 10:33:10 host2 pure-ftpd[1221778]: (?@158.178.229.240) [INFO] New connection from 158.178.229.240


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.85
country_id: 1210997
description:
2026-01-03 10:33:57 dovecot_login authenticator failed for H=([103.115.252.60]) [103.115.252.85]:50765: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.106.190
country_id: 2077456
description:
2026-01-03 10:34:13 dovecot_login authenticator failed for H=([123.209.106.190]) [123.209.106.190]:44730: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.242.142
country_id: 1269750
description:
2026-01-03 10:34:58 dovecot_login authenticator failed for H=([125.19.172.137]) [182.78.242.142]:60246: 535 Incorrect authentication data (set_id=office@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  3 10:35:57 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<Xofjx3RHAJ4v+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.138.90.195
country_id: 2661886
description:
2026-01-03 10:35:13 dovecot_login authenticator failed for H=h79-138-90-195.cust.bredband2.com [79.138.90.195]:44394: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 10:37:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<47zOy3RHgrsyBvlc>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 10:37:54 host2 sshd[1226328]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 10:37:40 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<w1L9zXRH2tFyB6Oa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-01-03 10:38:04 dovecot_login authenticator failed for H=([197.219.228.242]) [197.219.228.242]:54406: 535 Incorrect authentication data (set_id=postmaster@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.207.210.23
country_id: 2960313
description:
2026-01-03 10:38:18 dovecot_plain authenticator failed for H=(eriseum) [88.207.210.23]:63936: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.222
country_id: 2186224
description:
2026-01-03 10:38:19 dovecot_login authenticator failed for H=([121.73.169.222]) [121.73.169.222]:35418: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.15.108
country_id: 290557
description:
2026-01-03 10:42:44 dovecot_plain authenticator failed for H=(ciddly) [5.31.15.108]:55233: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.123
country_id: 6252001
description:
Jan  3 10:43:17 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.123, lip=66.85.158.91, TLS: Connection closed, session=<TIY44nRHWrZChJl7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.253.56.73
country_id: 6252001
description:
Jan  3 10:46:13 host2 sshd[1235661]: Disconnected from invalid user simon 47.253.56.73 port 38270 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.163.123.45
country_id: 1880251
description:
Jan  3 10:48:45 host2 sshd[1237916]: Disconnected from invalid user k8s 43.163.123.45 port 48096 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.163.123.45
country_id: 1880251
description:
Jan  3 10:49:32 host2 sshd[1238794]: Disconnected from invalid user front 43.163.123.45 port 33694 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.173.2.164
country_id: 1643084
description:
Jan  3 10:49:55 host2 sshd[1239228]: Disconnected from invalid user k8s 43.173.2.164 port 39550 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.25.232.7
country_id: 953987
description:
Jan  3 10:50:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<amila@euroentertainmentlk.com>, method=PLAIN, rip=41.25.232.7, lip=66.85.158.91, session=<knTR+3RHRdEpGegH>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.163.123.45
country_id: 1880251
description:
Jan  3 10:50:16 host2 sshd[1239803]: Disconnected from invalid user rain 43.163.123.45 port 47516 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.4.245.222
country_id: 2661886
description:
Jan  3 10:50:18 host2 sshd[1239832]: Disconnected from invalid user kim 155.4.245.222 port 54792 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.173.2.164
country_id: 1643084
description:
Jan  3 10:51:20 host2 sshd[1240783]: Disconnected from invalid user admin 43.173.2.164 port 40174 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 10:52:56 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<SzKXBHVHTIpn9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.163.123.45
country_id: 1880251
description:
Jan  3 10:53:08 host2 sshd[1242728]: Disconnected from invalid user default 43.163.123.45 port 46322 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.173.2.164
country_id: 1643084
description:
Jan  3 10:53:15 host2 sshd[1242892]: Disconnected from invalid user admin 43.173.2.164 port 37504 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.253.56.73
country_id: 6252001
description:
Jan  3 10:53:25 host2 sshd[1243064]: Disconnected from invalid user xiaoli 47.253.56.73 port 59334 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 155.4.245.222
country_id: 2661886
description:
Jan  3 10:53:29 host2 sshd[1243097]: Disconnected from invalid user julien 155.4.245.222 port 17647 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2026-01-03 10:54:19 dovecot_plain authenticator failed for H=c-73-195-211-98.hsd1.nj.comcast.net (coecul) [73.195.211.98]:49958: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.4.245.222
country_id: 2661886
description:
Jan  3 10:54:43 host2 sshd[1244824]: Disconnected from invalid user devops 155.4.245.222 port 33001 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.173.2.164
country_id: 1643084
description:
Jan  3 10:55:09 host2 sshd[1245525]: Disconnected from invalid user zhang 43.173.2.164 port 38092 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  3 10:55:33 host2 pure-ftpd[1246159]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.85
country_id: 1210997
description:
2026-01-03 10:56:22 dovecot_login authenticator failed for H=([103.115.252.60]) [103.115.252.85]:50978: 535 Incorrect authentication data (set_id=contact@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.229
country_id: 3865483
description:
Jan  3 10:58:03 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=179.0.252.229, lip=66.85.158.91, TLS, session=<HovuFXVHO9qzAPzl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.253.56.73
country_id: 6252001
description:
Jan  3 10:57:16 host2 sshd[1247856]: Disconnected from invalid user paulo 47.253.56.73 port 45058 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.130.168.24
country_id: 3469034
description:
Jan  3 10:58:23 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw>, method=PLAIN, rip=177.130.168.24, lip=66.85.158.91, TLS, session=<BRwqF3VHaZ2xgqgY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.62.239.4
country_id: 732800
description:
2026-01-03 10:59:34 dovecot_plain authenticator failed for H=(lerse) [149.62.239.4]:48622: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2026-01-03 11:00:09 dovecot_plain authenticator failed for H=(pyrry) [94.201.22.158]:46452: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  3 11:02:41 host2 sshd[1253138]: Disconnected from invalid user admin 2.57.121.112 port 54337 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.15.163.174
country_id: 6252001
description:
Jan  3 11:03:16 host2 pure-ftpd[1253900]: (?@20.15.163.174) [INFO] New connection from 20.15.163.174


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 11:05:15 host2 sshd[1256175]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.54
country_id: 1149361
description:
2026-01-03 11:06:31 dovecot_login authenticator failed for H=([149.54.62.54]) [149.54.62.54]:53475: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.219.54
country_id: 1269750
description:
2026-01-03 11:06:41 dovecot_login authenticator failed for H=([125.21.200.57]) [128.185.219.54]:44800: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.157
country_id: 6252001
description:
Jan  3 11:08:49 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 4 secs): user=<>, rip=147.185.132.157, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<ECCIPXVH2duTuYSd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.157
country_id: 6252001
description:
Jan  3 11:09:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=147.185.132.157, lip=66.85.158.91, TLS: read(size=429) failed: Connection reset by peer, session=<3a3tQHVHZPyTuYSd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  3 11:10:16 host2 sshd[1261612]: Disconnected from invalid user user 2.57.121.25 port 54535 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.152
country_id: 3469034
description:
Jan  3 11:11:06 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=190.89.137.152, lip=66.85.158.91, TLS, session=<TbSMRHVHHIa+WYmY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.15
country_id: 3865483
description:
Jan  3 11:11:27 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=179.0.250.15, lip=66.85.158.91, TLS, session=<PnzWRXVHWbezAPoP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan  3 11:13:17 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<gtKGTXVHFr4DiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.89.159.59
country_id: 3865483
description:
2026-01-03 11:15:02 dovecot_login authenticator failed for H=(59-159-89-200.fibertel.com.ar) [200.89.159.59]:41504: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.135.48
country_id: 3144096
description:
2026-01-03 11:15:20 dovecot_login authenticator failed for H=([188.124.135.48]) [188.124.135.48]:56556: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.157
country_id: 6252001
description:
Jan  3 11:15:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.157, lip=66.85.158.91, TLS, session=<H5pqVnVHJuaTuYSd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan  3 11:15:48 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<UIZ8VnVHsMEDiUnd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 11:16:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<m1DGV3VHTOMyBvlc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan  3 11:17:49 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<GbW3XXVHWsgDiUnd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 11:18:06 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<h32gXnVHdOByB6Oa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan  3 11:18:26 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<2XLnX3VHQJ8DiUnd>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.137.73.221
country_id: 6252001
description:
Jan  3 11:19:49 host2 dovecot[1170291]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<7O7iZHVHcL8DiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan  3 11:20:32 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<OiZvZ3VHKMgDiUnd>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 161.118.238.65
country_id: 1880251
description:
Jan  3 11:21:03 host2 pure-ftpd[1272283]: (?@161.118.238.65) [INFO] New connection from 161.118.238.65


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 161.118.238.65
country_id: 1880251
description:
Jan  3 11:21:07 host2 pure-ftpd[1272354]: (?@161.118.238.65) [INFO] New connection from 161.118.238.65


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 161.118.238.65
country_id: 1880251
description:
Jan  3 11:21:08 host2 pure-ftpd[1272363]: (?@161.118.238.65) [INFO] New connection from 161.118.238.65


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 161.118.238.65
country_id: 1880251
description:
Jan  3 11:21:13 host2 pure-ftpd[1272446]: (?@161.118.238.65) [INFO] New connection from 161.118.238.65


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 161.118.238.65
country_id: 1880251
description:
Jan  3 11:22:09 host2 pure-ftpd[1273446]: (?@161.118.238.65) [INFO] New connection from 161.118.238.65


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 161.118.238.65
country_id: 1880251
description:
Jan  3 11:22:13 host2 pure-ftpd[1273512]: (?@161.118.238.65) [INFO] New connection from 161.118.238.65


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.2
country_id: 1269750
description:
2026-01-03 11:22:37 dovecot_login authenticator failed for H=([125.19.173.202]) [152.52.236.2]:45786: 535 Incorrect authentication data (set_id=test@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.247.239.202
country_id: 1269750
description:
2026-01-03 11:24:52 dovecot_login authenticator failed for H=(abts-north-static-194.142.160.122.airtelbroadband.in) [117.247.239.202]:40346: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.234
country_id: 2186224
description:
2026-01-03 11:25:02 dovecot_login authenticator failed for H=([121.73.168.234]) [121.73.168.234]:33272: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.51.34.229
country_id: 2510769
description:
2026-01-03 11:30:26 dovecot_login authenticator failed for H=(229.34.51.212.dynamic.reverse-mundo-r.com) [212.51.34.229]:44270: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.225.42.158
country_id: 719819
description:
2026-01-03 11:30:39 dovecot_login authenticator failed for H=netacc-gpn-5-42-158.pool.yettel.hu [84.225.42.158]:50798: 535 Incorrect authentication data (set_id=postmaster@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 11:34:47 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<sM5NmnVHlLhn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.213.16
country_id: 732800
description:
2026-01-03 11:35:42 dovecot_login authenticator failed for H=95-87-213-16.ip.btc-net.bg [95.87.213.16]:41012: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.62
country_id: 6252001
description:
Jan  3 11:36:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=167.94.146.62, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<qaQxn3VHqOmnXpI+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 31.208.188.18
country_id: 2661886
description:
Jan  3 11:35:25 host2 pure-ftpd[1287773]: (?@31.208.188.18) [INFO] New connection from 31.208.188.18


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 31.208.188.18
country_id: 2661886
description:
Jan  3 11:35:26 host2 sshd[1287771]: Invalid user mohdehiovita@epid.gov.lk from 31.208.188.18 port 49184


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 31.208.188.18
country_id: 2661886
description:
Jan  3 11:35:32 host2 pure-ftpd[1287773]: (?@31.208.188.18) [WARNING] Authentication failed for user [mohdehiovita@epid.gov.lk]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.62
country_id: 6252001
description:
Jan  3 11:36:08 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=167.94.146.62, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<WEBDn3VHvumnXpI+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.40.122.250
country_id: 2629691
description:
2026-01-03 11:38:45 dovecot_login authenticator failed for H=nova-185-040-122-250.cpe.novanet.is [185.40.122.250]:40580: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  3 11:39:13 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<fCo8qnVHOpoDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  3 11:40:10 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<mxeqrXVHdLkDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
country_id: 1269750
description:
2026-01-03 11:41:34 dovecot_login authenticator failed for H=(nsg-static-82.71.76.182-airtel.com) [182.76.71.82]:44736: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  3 11:41:59 host2 sshd[1293882]: Disconnected from invalid user admin 2.57.121.112 port 55908 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  3 11:42:14 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<tYQOtXVH/LQDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  3 11:43:52 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<dgrounVHZI8DjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.41
country_id: 2750405
description:
2026-01-03 11:45:08 dovecot_login authenticator failed for H=(Copy-of-VM-2022) [45.94.31.41]:29215: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  3 11:44:37 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<0GeUvXVHrrkDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.41
country_id: 2750405
description:
2026-01-03 11:45:16 dovecot_login authenticator failed for H=(Copy-of-VM-2022) [45.94.31.41]:29605: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  3 11:45:23 host2 dovecot[1170291]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<YUxOwHVHZKMDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  3 11:45:45 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<MJygwXVHYLwDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.95
country_id: 6252001
description:
Jan  3 11:45:58 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.95, lip=66.85.158.91, TLS, session=</HdgwnVHmOzN0h9f>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  3 11:47:08 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<7dCUxnVHbpADjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.5.238.101
country_id: 3175395
description:
2026-01-03 11:46:25 dovecot_login authenticator failed for H=host-87-5-238-101.retail.telecomitalia.it [87.5.238.101]:45240: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2026-01-03 11:46:36 dovecot_login authenticator failed for H=([122.184.120.98]) [122.184.120.98]:41194: 535 Incorrect authentication data (set_id=admin)


