# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.138.142
country_id: 3144096
description:
2026-01-03 05:54:09 dovecot_login authenticator failed for H=(cm-178.232.138.142.get.no) [178.232.138.142]:59852: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  3 05:54:20 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<rDnA2HBHVoeeRdvj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.248.47.114
country_id: 6252001
description:
2026-01-03 05:53:53 dovecot_login authenticator failed for H=(syn-172-248-047-114.res.spectrum.com) [172.248.47.114]:47481: 535 Incorrect authentication data (set_id=office@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.91.50
country_id: 1269750
description:
2026-01-03 05:54:10 dovecot_login authenticator failed for H=(nsg-corporate-50.91.186.122.airtel.in) [122.186.91.50]:33098: 535 Incorrect authentication data (set_id=office@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  3 05:57:52 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<5/pg5XBHJFcjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  3 05:59:53 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<DZmc7HBHENQUOAHJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 05:59:27 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<SuMG63BHft5yB6Oa>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.173.254.125
country_id: 1605651
description:
Jan  3 05:59:38 host2 sshd[937249]: Disconnected from invalid user ubuntu 43.173.254.125 port 45194 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  3 06:01:19 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<vdC08XBHUKVIpyJ4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.173.254.125
country_id: 1605651
description:
Jan  3 06:01:22 host2 sshd[939451]: Disconnected from invalid user deployer 43.173.254.125 port 49720 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  3 06:00:54 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<HQ4z8HBHmuUv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.2
country_id: 1269750
description:
2026-01-03 06:02:27 dovecot_login authenticator failed for H=([128.185.217.149]) [125.19.156.2]:54222: 535 Incorrect authentication data (set_id=sales@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.56
country_id: 99237
description:
2026-01-03 06:02:29 dovecot_login authenticator failed for H=([65.20.133.56]) [65.20.133.56]:50310: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.173.254.125
country_id: 1605651
description:
Jan  3 06:02:33 host2 sshd[940937]: Disconnected from invalid user user 43.173.254.125 port 50300 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.77.137.236
country_id: 1605651
description:
2026-01-03 06:02:42 dovecot_login authenticator failed for H=([110.77.137.236]) [110.77.137.236]:56862: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  3 06:05:19 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<rIQMAHFHmh1o7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  3 06:05:33 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<lz3UAHFHJsKygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 06:06:31 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<EHpXBHFHEoJn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  3 06:10:25 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<UwlAEnFHhJ+i8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.255.189.56
country_id: 298795
description:
2026-01-03 06:10:50 dovecot_login authenticator failed for H=(88.255.189.56.static.ttnet.com.tr) [88.255.189.56]:49275: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.154
country_id: 3144096
description:
2026-01-03 06:11:01 dovecot_login authenticator failed for H=(cm-84.213.189.154.get.no) [84.213.189.154]:45325: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 06:11:59 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<p0fbF3FHqOMyBvlc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-03 06:15:58 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:61640: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  3 06:17:15 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<mCu3KnFHvsdnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 06:18:40 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<3729L3FH+LIv/VJZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.169
country_id: 1819730
description:
2026-01-03 06:19:22 dovecot_login authenticator failed for H=169.47.246.220.static.netvigator.com [220.246.47.169]:57221: 535 Incorrect authentication data (set_id=postmaster@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.50.221
country_id: 3144096
description:
2026-01-03 06:19:35 dovecot_login authenticator failed for H=(cm-178.232.50.221.get.no) [178.232.50.221]:47665: 535 Incorrect authentication data (set_id=postmaster@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.173.10.75
country_id: 6252001
description:
2026-01-03 06:19:41 dovecot_login authenticator failed for H=([209.173.10.75]) [209.173.10.75]:50016: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  3 06:22:14 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<nkaGPHFHXqJnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  3 06:24:23 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<vpUxRHFHlN5CdMcv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.25
country_id: 2186224
description:
2026-01-03 06:28:26 dovecot_login authenticator failed for H=([121.73.162.25]) [121.73.162.25]:50818: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.110.189.45
country_id: 2750405
description:
2026-01-03 06:28:32 dovecot_login authenticator failed for H=([193.110.189.45]) [193.110.189.45]:50822: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.184.153.250
country_id: 1733045
description:
Jan  3 06:29:44 host2 sshd[969529]: Disconnected from invalid user rsync 202.184.153.250 port 39120 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.184.153.250
country_id: 1733045
description:
Jan  3 06:31:14 host2 sshd[971352]: Disconnected from invalid user virtual 202.184.153.250 port 58340 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  3 06:32:42 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<hpj2YXFH4rieRdvj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.212.178
country_id: 1269750
description:
2026-01-03 06:32:57 dovecot_login authenticator failed for H=([152.52.144.161]) [128.185.212.178]:38080: 535 Incorrect authentication data (set_id=postmaster@kiriaswanu.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.126
country_id: 6252001
description:
Jan  3 06:35:01 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.126, lip=66.85.158.92, TLS: Connection closed, session=<6cRhanFHTj9ChJl+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  3 06:35:30 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<szL0a3FHJl0jupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.131.63
country_id: 99237
description:
2026-01-03 06:36:54 dovecot_login authenticator failed for H=([65.20.131.63]) [65.20.131.63]:50693: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.228.134
country_id: 1269750
description:
2026-01-03 06:37:15 dovecot_login authenticator failed for H=(nsg-static-209.69.76.182-airtel.com) [128.185.228.134]:43420: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 06:38:48 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<nh7Ed3FHVOxyB6Oa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  3 06:40:33 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<rIgCfnFHQu0v+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  3 06:40:57 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<Mbl2f3FHhLIUOAHJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  3 06:41:20 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<vsfQgHFH7rlIpyJ4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 06:46:50 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<vzd4lHFHYKxn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  3 06:47:02 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<kTg2lXFHnkVo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  3 06:47:32 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@kiriaswanu.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<r7f7lnFH9KiygBt7>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  3 06:47:36 host2 pure-ftpd[988598]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 06:49:10 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<1JHZnHFHUN0yBvlc>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 102.204.223.75
country_id: 2328926
description:
Jan  3 06:48:45 host2 pure-ftpd[989677]: (?@102.204.223.75) [INFO] New connection from 102.204.223.75


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  3 06:49:50 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<SrU6n3FHNpWi8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.174.182.38
country_id: 2077456
description:
2026-01-03 06:51:02 dovecot_login authenticator failed for H=203-174-182-38.ade.static-ipl.aapt.com.au [203.174.182.38]:52256: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.192.123.12
country_id: 6252001
description:
2026-01-03 06:51:13 dovecot_plain authenticator failed for H=(vacomulla) [199.192.123.12]:40024: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.2
country_id: 1269750
description:
2026-01-03 06:53:17 dovecot_login authenticator failed for H=([125.20.223.161]) [152.52.236.2]:42586: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 06:56:30 host2 sshd[997666]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 06:56:28 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<3pXxtnFHQLcv/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 06:56:56 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<R4KguHFH6pEv/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  3 06:58:35 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<rzGBvnFHkplnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  3 07:00:23 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<a0/7xHFH/r9nmud6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.165.14.197
country_id: 3469034
description:
Jan  3 07:00:59 host2 sshd[1002787]: Disconnected from invalid user hadoop 45.165.14.197 port 22111 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.139.180.139
country_id: 3175395
description:
Jan  3 07:02:12 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<charanaw>, method=PLAIN, rip=185.139.180.139, lip=66.85.158.91, TLS, session=<lQmYynFH3gq5i7SL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.60.219.89
country_id: 6252001
description:
2026-01-03 07:02:25 dovecot_login authenticator failed for H=(136-60-219-89.googlefiber.net) [136.60.219.89]:53306: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.205
country_id: 6252001
description:
Jan  3 07:01:55 host2 dovecot[360729]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.205, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ck2NynFHecXG6xjN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.211.4.53
country_id: 2300660
description:
Jan  3 07:01:54 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=41.211.4.53, lip=66.85.158.91, TLS, session=<F5JayXFHhtQp0wQ1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.52
country_id: 798544
description:
2026-01-03 07:02:37 dovecot_login authenticator failed for H=89-67-37-52.dynamic.play.pl [89.67.37.52]:34254: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.218.54.218
country_id: 6252001
description:
Jan  3 07:02:43 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=104.218.54.218, lip=66.85.158.91, session=<cWhPzXFHWoJo2jba>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.169.85.177
country_id: 6252001
description:
Jan  3 07:03:54 host2 pure-ftpd[1006291]: (?@20.169.85.177) [INFO] New connection from 20.169.85.177


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-01-03 07:04:15 dovecot_login authenticator failed for H=(ip-103-29-185-162.pascalwave.com) [103.29.185.162]:60826: 535 Incorrect authentication data (set_id=office@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  3 07:04:15 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@askinternationalconsortium.com>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<18DM0nFHbuBCdMcv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.205
country_id: 337996
description:
2026-01-03 07:04:26 dovecot_login authenticator failed for H=([196.188.187.205]) [196.188.187.205]:56326: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.254.166.35
country_id: 1269750
description:
Jan  3 07:05:04 host2 sshd[1007702]: Disconnected from invalid user readonly 205.254.166.35 port 30115 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.254.166.35
country_id: 1269750
description:
Jan  3 07:05:51 host2 sshd[1008655]: Disconnected from invalid user adminuser 205.254.166.35 port 8783 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.172
country_id: 6252001
description:
Jan  3 07:07:00 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.172, lip=66.85.158.92, TLS, session=<q+W63HFHCPrG6xis>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.165.14.197
country_id: 3469034
description:
Jan  3 07:07:49 host2 sshd[1011199]: Disconnected from invalid user admin 45.165.14.197 port 55923 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.111.235
country_id: 1880251
description:
Jan  3 07:08:31 host2 sshd[1011967]: Disconnected from invalid user mustafa 146.190.111.235 port 58098 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 146.190.111.235
country_id: 1880251
description:
Jan  3 07:09:11 host2 sshd[1012746]: Disconnected from invalid user user2 146.190.111.235 port 37632 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.111.235
country_id: 1880251
description:
Jan  3 07:09:48 host2 sshd[1013447]: Disconnected from invalid user bitrix 146.190.111.235 port 50390 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.247.248.154
country_id: 3469034
description:
2026-01-03 07:11:05 dovecot_login authenticator failed for H=([170.247.248.154]) [170.247.248.154]:37033: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  3 07:11:15 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<rl/W63FH4KieRdvj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2026-01-03 07:10:51 dovecot_login authenticator failed for H=([185.134.179.106]) [185.101.16.250]:60409: 535 Incorrect authentication data (set_id=test@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.254.166.35
country_id: 1269750
description:
Jan  3 07:13:13 host2 sshd[1017999]: Disconnected from invalid user abc 205.254.166.35 port 26042 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  3 07:13:25 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<SFqS83FHfmsjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.120.182
country_id: 3144096
description:
2026-01-03 07:14:11 dovecot_login authenticator failed for H=(cm-178.232.120.182.get.no) [178.232.120.182]:40838: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.135.48
country_id: 3144096
description:
2026-01-03 07:13:56 dovecot_login authenticator failed for H=([188.124.135.48]) [188.124.135.48]:40189: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.176.4.105
country_id: 1168579
description:
2026-01-03 07:15:08 dovecot_login authenticator failed for H=([182.176.4.105]) [182.176.4.105]:58102: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.36.202.100
country_id: 3469034
description:
Jan  3 07:15:17 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=138.36.202.100, lip=66.85.158.91, TLS, session=<KD9Q+XFHBLeKJMpk>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.254.166.35
country_id: 1269750
description:
Jan  3 07:16:09 host2 sshd[1021897]: Disconnected from invalid user guest 205.254.166.35 port 47679 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.203.211.207
country_id: 1269750
description:
Jan  3 07:15:48 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=103.203.211.207, lip=66.85.158.91, TLS, session=<YaPx+nFHDJNny9PP>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 205.254.166.35
country_id: 1269750
description:
Jan  3 07:17:41 host2 sshd[1023435]: Disconnected from invalid user user2 205.254.166.35 port 34231 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 07:18:04 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<sjMiBHJHyIpyB6Oa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  3 07:20:09 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<JrKpC3JHvoQv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  3 07:21:20 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<eCnnD3JHPs5IpyJ4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  3 07:21:54 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<ZCLkEXJHutwUOAHJ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 07:23:44 host2 sshd[1031166]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 07:27:13 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<4jrsJHJHpoMyBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 07:27:22 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<iWF6JXJHoJ9n9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  3 07:27:29 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<IJLgJXJHaDVo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  3 07:29:12 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<Ic78K3JH9KWygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  3 07:29:29 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<2uUBLXJH6oai8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.40.238
country_id: 1210997
description:
2026-01-03 07:31:01 dovecot_login authenticator failed for H=([49.0.40.238]) [49.0.40.238]:49968: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-01-03 07:32:50 dovecot_plain authenticator failed for H=(undarcur) [24.187.213.29]:42314: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Jan  3 07:34:13 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<WuwPPnJH0t2LonQW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 07:34:36 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<TTJWP3JHdM4v/VJZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.35.240
country_id: 2077456
description:
2026-01-03 07:36:46 dovecot_login authenticator failed for H=([101.168.35.240]) [101.168.35.240]:55246: 535 Incorrect authentication data (set_id=contact@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.24
country_id: 2186224
description:
2026-01-03 07:37:07 dovecot_login authenticator failed for H=([121.73.169.24]) [121.73.169.24]:51542: 535 Incorrect authentication data (set_id=contact@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  3 07:38:30 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<LCxDTXJHpqlnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  3 07:39:45 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=</VC3UXJHNopnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  3 07:43:18 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@askinternationalconsortium.com>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<7jtvXnJHIs5CdMcv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.251.240
country_id: 290557
description:
2026-01-03 07:49:00 dovecot_login authenticator failed for H=([94.207.251.240]) [94.207.251.240]:42886: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.210.118
country_id: 1269750
description:
2026-01-03 07:49:10 dovecot_login authenticator failed for H=([125.17.48.129]) [152.52.210.118]:60336: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  3 07:49:54 host2 pure-ftpd[1057267]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  3 07:50:03 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<KeOJdnJHitGeRdvj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.123.45.2
country_id: 1269750
description:
2026-01-03 07:50:42 dovecot_login authenticator failed for H=([103.123.45.2]) [103.123.45.2]:38144: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  3 07:51:08 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<8Ah6enJHwIMjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 07:58:02 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<J3cak3JH3phyB6Oa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.171.86.81
country_id: 2017370
description:
2026-01-03 07:59:36 dovecot_login authenticator failed for H=([93.171.86.81]) [93.171.86.81]:43350: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.1.105.105
country_id: 1269750
description:
2026-01-03 07:59:36 dovecot_login authenticator failed for H=([61.1.105.105]) [61.1.105.105]:42209: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.130
country_id: 6252001
description:
Jan  3 07:58:34 host2 dovecot[360729]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=71.6.146.130, lip=66.85.158.92, session=<AQIrlXJH7s5HBpKC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  3 07:59:14 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<Zitql3JH0okv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  3 08:00:46 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<QqfmnHJHHOJIpyJ4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  3 08:03:51 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<VW3sp3JHgKIUOAHJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 08:05:45 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<n++3rnJHQMsyBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 08:08:02 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<OVDltnJHvuFn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.10
country_id: 1269750
description:
2026-01-03 08:08:11 dovecot_login authenticator failed for H=(abts-north-dynamic-121.212.66.182.airtelbroadband.in) [27.123.113.10]:59782: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  3 08:07:50 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<KAYutnJHzJxo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.146.144
country_id: 1819730
description:
2026-01-03 08:07:54 dovecot_login authenticator failed for H=(m121-202-146-144.smartone.com) [121.202.146.144]:48215: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  3 08:09:09 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<3yXbunJHrICi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  3 08:11:31 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<W9hWw3JHQNOygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 08:12:59 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<EbeLyHJHfpEv/VJZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
country_id: 6252001
description:
2026-01-03 08:16:09 dovecot_login authenticator failed for H=48.211.41.34.bc.googleusercontent.com [34.41.211.48]:50870: 535 Incorrect authentication data (set_id=test@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  3 08:16:10 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<ppT003JHnMZnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2026-01-03 08:16:23 dovecot_login authenticator failed for H=([115.240.244.52]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.142.132
country_id: 1733045
description:
2026-01-03 08:16:29 dovecot_login authenticator failed for H=([49.124.142.132]) [49.124.142.132]:53856: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.130
country_id: 1269750
description:
2026-01-03 08:16:33 dovecot_login authenticator failed for H=([152.52.238.88]) [182.95.184.130]:52000: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.33.59.116
country_id: 3469034
description:
Jan  3 08:17:27 host2 sshd[1087718]: Disconnected from invalid user update 187.33.59.116 port 48921 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.33.59.116
country_id: 3469034
description:
Jan  3 08:19:05 host2 sshd[1089514]: Disconnected from invalid user luser 187.33.59.116 port 34564 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.140.19.22
country_id: 1269750
description:
Jan  3 08:20:36 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=103.140.19.22, lip=66.85.158.91, session=<+/PT43JHXINnjBMW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  3 08:20:42 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<kTgx5HJH9I1npBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  3 08:22:10 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<N3Jo6XJHlOhCdMcv>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 129.213.226.156
country_id: 6252001
description:
Jan  3 08:22:39 host2 sshd[1094148]: Disconnected from invalid user prog 129.213.226.156 port 56996 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 154.81.15.190
country_id: 241170
description:
Jan  3 08:24:44 host2 dovecot[360729]: imap-login: Disconnected: Connection closed: read(size=1013) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=154.81.15.190, lip=66.85.158.92, session=<jnK78nJH9LmaUQ++>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.249
country_id: 1168579
description:
2026-01-03 08:24:45 dovecot_login authenticator failed for H=(249.92.zcomnetworks.com.pk) [103.148.92.249]:2577: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2026-01-03 08:24:58 dovecot_login authenticator failed for H=([128.185.23.89]) [125.19.160.206]:49346: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.83
country_id: 1733045
description:
2026-01-03 08:25:07 dovecot_login authenticator failed for H=([49.125.201.83]) [49.125.201.83]:58708: 535 Incorrect authentication data (set_id=contact@kiriaswanu.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.213.226.156
country_id: 6252001
description:
Jan  3 08:24:24 host2 sshd[1096368]: Disconnected from invalid user vlc 129.213.226.156 port 57480 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.43
country_id: 1819730
description:
Jan  3 08:27:46 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=45.142.154.43, lip=66.85.158.91, TLS handshaking: Connection closed, session=<JiKW/XJHnMstjpor>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  3 08:28:48 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<iTcmAXNHptyeRdvj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  3 08:29:14 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<NZ+3AnNHWN8jupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.121
country_id: 6252001
description:
Jan  3 08:30:10 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.121, lip=66.85.158.92, session=<nz0wBnNHDOrG6xh5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.22
country_id: 798549
description:
Jan  3 08:31:55 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.22, lip=66.85.158.92, session=<qMVqDHNH9shV2ZUW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.161.232.9
country_id: 6252001
description:
2026-01-03 08:33:57 dovecot_login authenticator failed for H=ip98-161-232-9.ph.ph.cox.net [98.161.232.9]:35330: 535 Incorrect authentication data (set_id=office@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.183.66
country_id: 1269750
description:
2026-01-03 08:33:58 dovecot_login authenticator failed for H=([125.19.183.66]) [125.19.183.66]:52584: 535 Incorrect authentication data (set_id=office@kiriaswanu.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.226
country_id: 6252001
description:
Jan  3 08:36:11 host2 pure-ftpd[1109496]: (?@198.235.24.226) [INFO] New connection from 198.235.24.226


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 08:37:36 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<dx+fIHNHSKdyB6Oa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  3 08:38:23 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<Cx1uI3NHqI4v+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  3 08:40:15 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<GxkYKnNHDodIpyJ4>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 213.225.7.103
country_id: 2782113
description:
Jan  3 08:42:18 host2 sshd[1116743]: Disconnected from invalid user secretaria 213.225.7.103 port 30084 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.225.7.103
country_id: 2782113
description:
Jan  3 08:41:40 host2 sshd[1116121]: Disconnected from invalid user sftp 213.225.7.103 port 30083 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.136.164.157
country_id: 6252001
description:
2026-01-03 08:42:30 dovecot_login authenticator failed for H=c-76-136-164-157.hsd1.il.comcast.net [76.136.164.157]:45939: 535 Incorrect authentication data (set_id=sales@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.214.49.194
country_id: 6252001
description:
2026-01-03 08:42:43 dovecot_login authenticator failed for H=wsip-72-214-49-194.hr.hr.cox.net [72.214.49.194]:58534: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.225.7.103
country_id: 2782113
description:
Jan  3 08:42:58 host2 sshd[1117708]: Disconnected from invalid user bull 213.225.7.103 port 30085 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 08:43:01 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<SdcCNHNHLuoyBvlc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.125.120.7
country_id: 2245662
description:
Jan  3 08:44:03 host2 sshd[1118792]: Disconnected from invalid user deluge 154.125.120.7 port 36825 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.225.7.103
country_id: 2782113
description:
Jan  3 08:43:37 host2 sshd[1118422]: Disconnected from invalid user lia 213.225.7.103 port 30086 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  3 08:44:24 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<kg31OHNHatcUOAHJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.125.120.7
country_id: 2245662
description:
Jan  3 08:45:18 host2 sshd[1120013]: Disconnected from invalid user spread 154.125.120.7 port 58872 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 08:47:05 host2 sshd[1121728]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.125.120.7
country_id: 2245662
description:
Jan  3 08:46:37 host2 sshd[1121238]: Disconnected from invalid user postgres 154.125.120.7 port 52178 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.14
country_id: 3017382
description:
Jan  3 08:47:10 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=91.196.152.14, lip=66.85.158.91, session=<fVbwQnNHS+hbxJgO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.99
country_id: 3017382
description:
Jan  3 08:47:20 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.196.152.99, lip=66.85.158.91, session=<SVeNQ3NHa79bxJhj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.10
country_id: 3017382
description:
Jan  3 08:47:34 host2 dovecot[360729]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=91.196.152.10, lip=66.85.158.91, session=<IDZeRHNHMbhbxJgK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.102
country_id: 3017382
description:
Jan  3 08:47:37 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.102, lip=66.85.158.91, session=<+4mQRHNH149bxJhm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  3 08:47:46 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<WC/5RHNH3KNo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 08:48:58 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<ucg1SXNHIotn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  3 08:49:00 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<7c5nSXNHuoui8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.201.237.208
country_id: 1269750
description:
2026-01-03 08:51:20 dovecot_login authenticator failed for H=(abts-west-static-208.237.201.106.airtelbroadband.in) [106.201.237.208]:42196: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.212.178
country_id: 1269750
description:
2026-01-03 08:51:22 dovecot_login authenticator failed for H=([152.52.144.161]) [128.185.212.178]:53276: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Jan  3 08:51:24 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<AnAAUnNHoNsFhH+s>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.157.95.30
country_id: 6251999
description:
2026-01-03 08:51:30 dovecot_login authenticator failed for H=d157-95-30.home4.cgocable.net [24.157.95.30]:40874: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.200.42.112
country_id: 1880251
description:
2026-01-03 08:51:40 dovecot_login authenticator failed for H=([118.200.42.112]) [118.200.42.112]:51250: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 08:51:44 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<xwYpU3NHPqgv/VJZ>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  3 08:52:38 host2 pure-ftpd[1127572]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  3 08:54:15 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<NEEdXHNHmoBnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  3 08:53:41 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<nCgoWnNHVt6ygBt7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 209.38.237.34
country_id: 2921044
description:
Jan  3 08:56:05 host2 dovecot[360729]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=209.38.237.34, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<GvLYYnNHvUPRJu0i>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.68.71.16
country_id: 2921044
description:
Jan  3 08:56:40 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=138.68.71.16, lip=66.85.158.91, TLS handshaking: Connection closed, session=<PFDxZHNHuo2KREcQ>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 152.32.190.153
country_id: 1819730
description:
Jan  3 08:58:22 host2 pure-ftpd[1135443]: (?@152.32.190.153) [INFO] New connection from 152.32.190.153


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 152.32.190.153
country_id: 1819730
description:
Jan  3 08:58:23 host2 pure-ftpd[1135461]: (?@152.32.190.153) [INFO] New connection from 152.32.190.153


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.162.191
country_id: 3144096
description:
2026-01-03 08:59:51 dovecot_login authenticator failed for H=(cm-178.232.162.191.get.no) [178.232.162.191]:40719: 535 Incorrect authentication data (set_id=postmaster@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.165.78.31
country_id: 1819730
description:
2026-01-03 08:59:51 dovecot_login authenticator failed for H=([69.165.78.31]) [69.165.78.31]:58466: 535 Incorrect authentication data (set_id=postmaster@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.130.206
country_id: 3144096
description:
2026-01-03 09:00:00 dovecot_login authenticator failed for H=(cm-178.232.130.206.get.no) [178.232.130.206]:57161: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.157.95.30
country_id: 6251999
description:
2026-01-03 09:00:06 dovecot_login authenticator failed for H=d157-95-30.home4.cgocable.net [24.157.95.30]:35118: 535 Incorrect authentication data (set_id=postmaster@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.77.179.130
country_id: 3469034
description:
Jan  3 09:01:06 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<charanaw>, method=PLAIN, rip=200.77.179.130, lip=66.85.158.91, TLS, session=<NnXBc3NHQ7TITbOC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  3 09:01:07 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<gmW2dHNHXKNCdMcv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.182
country_id: 3469034
description:
Jan  3 09:00:46 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=190.89.136.182, lip=66.85.158.91, TLS, session=<LRd3cnNHw6O+WYi2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  3 09:02:06 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<PPw/eHNHDLlnpBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2026-01-03 09:02:57 dovecot_plain authenticator failed for H=c-73-13-220-220.hsd1.de.comcast.net (beriniss) [73.13.220.220]:34640: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.62.25.91
country_id: 2635167
description:
Jan  3 09:05:46 host2 sshd[1143477]: Disconnected from invalid user soporte 178.62.25.91 port 48734 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.57.141
country_id: 6252001
description:
Jan  3 09:06:20 host2 sshd[1144028]: Disconnected from invalid user mcserver 198.98.57.141 port 33094 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  3 09:07:09 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<o7FLinNH5m4jupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  3 09:07:48 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<4GipjHNHnJCeRdvj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.57.141
country_id: 6252001
description:
Jan  3 09:07:59 host2 sshd[1145625]: Disconnected from invalid user teamspeak3 198.98.57.141 port 55878 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.135.208.32
country_id: 1861060
description:
2026-01-03 09:08:23 dovecot_login authenticator failed for H=dsl-212-135-208-32.dsl.easynet.co.uk [212.135.208.32]:50734: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.110
country_id: 1149361
description:
2026-01-03 09:08:26 dovecot_login authenticator failed for H=([180.94.75.110]) [180.94.75.110]:52253: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.218.47
country_id: 3144096
description:
2026-01-03 09:08:32 dovecot_login authenticator failed for H=(cm-178.232.218.47.get.no) [178.232.218.47]:41086: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.238.213.180
country_id: 2661886
description:
2026-01-03 09:08:37 dovecot_login authenticator failed for H=h85-238-213-180.cust.bredband2.com [85.238.213.180]:35016: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.98.57.141
country_id: 6252001
description:
Jan  3 09:08:41 host2 sshd[1146338]: Disconnected from invalid user lc 198.98.57.141 port 39386 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.176.79.137
country_id: 1643084
description:
Jan  3 09:09:35 host2 sshd[1147001]: Disconnected from invalid user user 103.176.79.137 port 44018 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.57.141
country_id: 6252001
description:
Jan  3 09:09:58 host2 sshd[1147363]: Disconnected from invalid user diego 198.98.57.141 port 34634 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.176.79.137
country_id: 1643084
description:
Jan  3 09:11:35 host2 sshd[1149347]: Disconnected from invalid user bitrix 103.176.79.137 port 54866 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.199.212.141
country_id: 719819
description:
Jan  3 09:11:55 host2 sshd[1149661]: Disconnected from invalid user kingbase 195.199.212.141 port 49452 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.218.54.218
country_id: 6252001
description:
Jan  3 09:12:14 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=104.218.54.218, lip=66.85.158.91, session=<KT1vnHNHiOJo2jba>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.62.25.91
country_id: 2635167
description:
Jan  3 09:12:19 host2 sshd[1150061]: Disconnected from invalid user mcserver 178.62.25.91 port 56144 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.2.19
country_id: 690791
description:
Jan  3 09:13:51 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=176.103.2.19, lip=66.85.158.91, TLS, session=<AlhPoXNHaJawZwIT>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 178.62.25.91
country_id: 2635167
description:
Jan  3 09:13:50 host2 sshd[1151535]: Disconnected from invalid user pavan 178.62.25.91 port 48668 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.121
country_id: 6252001
description:
Jan  3 09:13:52 host2 pure-ftpd[1151569]: (?@66.132.153.121) [INFO] New connection from 66.132.153.121


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.53.165.210
country_id: 3469034
description:
Jan  3 09:14:14 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=177.53.165.210, lip=66.85.158.91, TLS, session=<JIeRonNHguuxNaXS>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 09:14:25 host2 sshd[1152130]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  3 09:17:28 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<DLA1r3NHNpIv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  3 09:20:16 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<u9YzuXNHBptIpyJ4>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 69.74.29.21
country_id: 6252001
description:
Jan  3 09:21:45 host2 sshd[1159914]: Disconnected from invalid user sdc 69.74.29.21 port 25976 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 09:17:29 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<dlFJr3NHjrVyB6Oa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 09:21:07 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<KQxBvHNH4MEyBvlc>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 207.90.244.28
country_id: 6252001
description:
Jan  3 09:21:32 host2 pure-ftpd[1159724]: (?@207.90.244.28) [INFO] New connection from 207.90.244.28


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.132.181.70
country_id: 1522867
description:
2026-01-03 09:17:01 dovecot_login authenticator failed for H=2.132.181.70.dynamic.telecom.kz [2.132.181.70]:45035: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.233
country_id: 2635167
description:
Jan  3 09:18:27 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 14 secs): user=<>, rip=35.203.210.233, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<bBfWsnNHnsUjy9Lp>


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 207.90.244.28
country_id: 6252001
description:
Jan  3 09:21:33 host2 pure-ftpd[1159744]: (?@207.90.244.28) [INFO] New connection from 207.90.244.28


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.76.188.180
country_id: 1819730
description:
2026-01-03 09:17:07 dovecot_login authenticator failed for H=180.188.76.219.static.netvigator.com [219.76.188.180]:49308: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.178.224.92
country_id: 1880251
description:
Jan  3 09:23:45 host2 pure-ftpd[1162010]: (?@158.178.224.92) [INFO] New connection from 158.178.224.92


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 158.178.224.92
country_id: 1880251
description:
Jan  3 09:24:00 host2 pure-ftpd[1162253]: (?@158.178.224.92) [INFO] New connection from 158.178.224.92


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.176.79.137
country_id: 1643084
description:
Jan  3 09:23:23 host2 sshd[1161570]: Disconnected from invalid user server 103.176.79.137 port 56230 [preauth]


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 158.178.224.92
country_id: 1880251
description:
Jan  3 09:24:25 host2 pure-ftpd[1162827]: (?@158.178.224.92) [INFO] New connection from 158.178.224.92


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.178.224.92
country_id: 1880251
description:
Jan  3 09:24:23 host2 pure-ftpd[1162791]: (?@158.178.224.92) [INFO] New connection from 158.178.224.92


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  3 09:25:01 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<oT81ynNHOocUOAHJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.215.132
country_id: 3144096
description:
2026-01-03 09:25:30 dovecot_login authenticator failed for H=(cm-84.210.215.132.get.no) [84.210.215.132]:43216: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.110.96
country_id: 3144096
description:
2026-01-03 09:25:33 dovecot_login authenticator failed for H=(cm-84.215.110.96.get.no) [84.215.110.96]:46030: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.173.117.246
country_id: 6252001
description:
Jan  3 09:25:22 host2 sshd[1163937]: Disconnected from invalid user composeruser 172.173.117.246 port 44802 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.226.182
country_id: 3469034
description:
2026-01-03 09:25:22 dovecot_login authenticator failed for H=(189-108-192-66.customer.tdatabrasil.net.br) [187.50.226.182]:48529: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.233
country_id: 2635167
description:
Jan  3 09:26:24 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.233, lip=66.85.158.92, TLS, session=<Cr1Fz3NHmO8jy9Lp>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.173.117.246
country_id: 6252001
description:
Jan  3 09:26:38 host2 sshd[1165358]: Disconnected from invalid user test 172.173.117.246 port 42102 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.18.229.251
country_id: 1694008
description:
Jan  3 09:26:41 host2 sshd[1165372]: Disconnected from invalid user user 103.18.229.251 port 44704 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.18.229.251
country_id: 1694008
description:
Jan  3 09:27:30 host2 sshd[1166269]: Disconnected from invalid user sdadmin 103.18.229.251 port 50950 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  3 09:28:17 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<18vT1XNHyHlo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  3 09:28:59 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<G7Bj2HNHIKSi8GQy>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.140
country_id: 6252001
description:
Jan  3 09:39:41 host2 pure-ftpd[1168487]: (?@66.132.153.140) [INFO] New connection from 66.132.153.140


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 66.132.153.140
country_id: 6252001
description:
Jan  3 09:39:41 host2 pure-ftpd[1168504]: (?@66.132.153.140) [INFO] New connection from 66.132.153.140


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 09:39:41 host2 dovecot[360729]: pop3-login: Disconnected: Inactivity (no auth attempts in 548 secs): user=<>, rip=103.244.206.6, lip=66.85.158.91, session=<q7Gf/nNH2qhn9M4G>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 09:39:41 host2 dovecot[360729]: pop3-login: Disconnected: Inactivity (no auth attempts in 555 secs): user=<>, rip=47.253.82.89, lip=66.85.158.91, session=<AGqp/nNHAqUv/VJZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 196.251.102.24
country_id: 241170
description:
Jan  3 09:40:42 host2 dovecot[360729]: pop3-login: Disconnected: Shutting down (disconnected while authenticating, waited 51 secs): user=<>, method=PLAIN, rip=196.251.102.24, lip=66.85.158.91, session=<yb9i/3NHVOTE+2YY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  3 09:40:42 host2 dovecot[360729]: pop3-login: Disconnected: Shutting down (disconnected while authenticating, waited 28 secs): user=<>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<b2i5AHRHuodCdMcv>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 207.90.244.28
country_id: 6252001
description:
Jan  3 09:41:11 host2 pure-ftpd[1169845]: (?@207.90.244.28) [INFO] New connection from 207.90.244.28


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 207.90.244.28
country_id: 6252001
description:
Jan  3 09:41:12 host2 pure-ftpd[1169869]: (?@207.90.244.28) [INFO] New connection from 207.90.244.28


plugin: ossec
rule: 9703
name: Dovecot is Starting Up.
description:
Jan  3 09:42:36 host2 dovecot[1170103]: master: Dovecot v2.3.21.1 (d492236fa0) starting up for lmtp, imap, pop3 (core dumps disabled)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.188.10
country_id: 3144096
description:
2026-01-03 09:43:12 dovecot_login authenticator failed for H=(cm-178.232.188.10.get.no) [178.232.188.10]:49886: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.190.94
country_id: 2542007
description:
2026-01-03 09:43:14 dovecot_login authenticator failed for H=([105.73.190.94]) [105.73.190.94]:38589: 535 Incorrect authentication data (set_id=contact@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  3 09:43:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<d9nUC3RHnJdnpBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.49.166
country_id: 1269750
description:
2026-01-03 09:43:36 dovecot_login authenticator failed for H=([182.95.49.166]) [182.95.49.166]:57454: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  3 09:44:29 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 6 secs): user=<hr@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<gEqVD3RH+D8jupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  3 09:46:58 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<FY+xGHRHRqKeRdvj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  3 09:49:17 host2 sshd[1174337]: Disconnected from invalid user admin 2.57.121.112 port 22699 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  3 09:51:36 host2 pure-ftpd[1176422]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.70.122.245
country_id: 1269750
description:
2026-01-03 09:52:02 dovecot_login authenticator failed for H=(abts-mum-static-245.122.70.182.airtelbroadband.in) [182.70.122.245]:42309: 535 Incorrect authentication data (set_id=office@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.126
country_id: 1269750
description:
2026-01-03 09:52:06 dovecot_login authenticator failed for H=([27.123.114.126]) [27.123.114.126]:40400: 535 Incorrect authentication data (set_id=office@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.222.51.149
country_id: 2510769
description:
2026-01-03 09:52:11 dovecot_login authenticator failed for H=149.51.222.87.dynamic.jazztel.es [87.222.51.149]:51004: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.38.0.41
country_id: 6252001
description:
2026-01-03 09:52:24 dovecot_login authenticator failed for H=([45.38.0.41]) [45.38.0.41]:4345: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  3 09:56:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<JfjKOnRHzpUv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 09:57:37 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<xBzQPnRHusNyB6Oa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 09:58:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<pNk/Q3RHgK4yBvlc>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.136
country_id: 6252001
description:
Jan  3 10:00:11 host2 pure-ftpd[1185533]: (?@66.132.153.136) [INFO] New connection from 66.132.153.136


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  3 10:00:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<VXoHSHRHVLFIpyJ4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2026-01-03 10:00:37 dovecot_login authenticator failed for H=syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:51694: 535 Incorrect authentication data (set_id=sales@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.165.30.226
country_id: 1269750
description:
2026-01-03 10:00:53 dovecot_login authenticator failed for H=([103.165.30.206]) [103.165.30.226]:54223: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-01-03 10:00:41 dovecot_login authenticator failed for H=([197.219.228.242]) [197.219.228.242]:42458: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.181.196.96
country_id: 3469034
description:
2026-01-03 10:00:59 dovecot_login authenticator failed for H=(96.196.181.45.datasysteminfor.com.br) [45.181.196.96]:60546: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2026-01-03 10:01:28 dovecot_plain authenticator failed for H=c-73-13-220-220.hsd1.de.comcast.net (dizedolia) [73.13.220.220]:38006: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  3 10:05:48 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<FhAIXHRHaIkUOAHJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.171.99
country_id: 1819730
description:
Jan  3 10:06:48 host2 sshd[1192287]: Disconnected from invalid user ts3server 152.32.171.99 port 46776 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2026-01-03 10:07:43 dovecot_plain authenticator failed for H=(bandrols) [94.201.22.158]:46939: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.213.238.91
country_id: 1210997
description:
Jan  3 10:07:45 host2 sshd[1193255]: Disconnected from invalid user ts3server 103.213.238.91 port 52708 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.231.222.161
country_id: 3190538
description:
Jan  3 10:08:35 host2 pure-ftpd[1194186]: (?@91.231.222.161) [INFO] New connection from 91.231.222.161


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  3 10:08:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<rVs0Z3RH2rWi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 10:09:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<zYuDZ3RHwNsv/VJZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.83.15
country_id: 3144096
description:
2026-01-03 10:09:21 dovecot_login authenticator failed for H=(cm-178.232.83.15.get.no) [178.232.83.15]:47081: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.38.27
country_id: 798544
description:
2026-01-03 10:09:21 dovecot_login authenticator failed for H=89-67-38-27.dynamic.play.pl [89.67.38.27]:45070: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  3 10:09:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<eL1baXRHRP9o7MS0>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.213.238.91
country_id: 1210997
description:
Jan  3 10:09:57 host2 sshd[1195543]: Disconnected from invalid user server 103.213.238.91 port 37218 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  3 10:10:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<WPEFbXRHdrhnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 10:11:08 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<MYsab3RHPLpn9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.213.238.91
country_id: 1210997
description:
Jan  3 10:11:24 host2 sshd[1197310]: Disconnected from invalid user x 103.213.238.91 port 36300 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2026-01-03 10:13:35 dovecot_plain authenticator failed for H=(denes) [24.104.225.201]:41779: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.171.99
country_id: 1819730
description:
Jan  3 10:14:28 host2 sshd[1200936]: Disconnected from invalid user server 152.32.171.99 port 44956 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.196.64.198
country_id: 1835841
description:
Jan  3 10:14:34 host2 sshd[1201010]: Disconnected from invalid user nandan 20.196.64.198 port 40400 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.91.81.224
country_id: 1880251
description:
Jan  3 10:15:12 host2 sshd[1201809]: Disconnected from invalid user service 154.91.81.224 port 37212 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.196.64.198
country_id: 1835841
description:
Jan  3 10:17:07 host2 sshd[1204066]: Disconnected from invalid user postgres 20.196.64.198 port 59422 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.240
country_id: 6252001
description:
Jan  3 10:16:15 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.240, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<p3WKgXRH+9jN0h/w>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.171.99
country_id: 1819730
description:
Jan  3 10:16:38 host2 sshd[1203563]: Disconnected from invalid user postgres 152.32.171.99 port 56572 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.81.224
country_id: 1880251
description:
Jan  3 10:17:21 host2 sshd[1204293]: Disconnected from invalid user user7 154.91.81.224 port 46336 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.142.184.55
country_id: 1210997
description:
2026-01-03 10:17:43 dovecot_login authenticator failed for H=([103.133.175.82]) [103.142.184.55]:38829: 535 Incorrect authentication data (set_id=postmaster@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.222.166.212
country_id: 2077456
description:
2026-01-03 10:17:47 dovecot_login authenticator failed for H=(180-222-166-212.static.dsl.net.au) [180.222.166.212]:56659: 535 Incorrect authentication data (set_id=postmaster@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.199.94.128
country_id: 6252001
description:
Jan  3 10:17:54 host2 sshd[1205063]: Disconnected from invalid user debian 24.199.94.128 port 37744 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.89.161.111
country_id: 1269750
description:
Jan  3 10:18:25 host2 sshd[1205629]: Disconnected from invalid user paula 159.89.161.111 port 54970 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.196.64.198
country_id: 1835841
description:
Jan  3 10:18:29 host2 sshd[1205698]: Disconnected from invalid user max 20.196.64.198 port 39988 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.199.94.128
country_id: 6252001
description:
Jan  3 10:19:28 host2 sshd[1206969]: Disconnected from invalid user user7 24.199.94.128 port 51624 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  3 10:19:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<T+82jnRHLrVCdMcv>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.89.161.111
country_id: 1269750
description:
Jan  3 10:20:13 host2 sshd[1208084]: Disconnected from invalid user forest 159.89.161.111 port 47256 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.89.154.59
country_id: 285570
description:
Jan  3 10:20:26 host2 sshd[1208402]: Disconnected from invalid user service 78.89.154.59 port 34090 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 78.89.154.59
country_id: 285570
description:
Jan  3 10:21:13 host2 sshd[1209464]: Disconnected from invalid user vpn 78.89.154.59 port 38582 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  3 10:22:06 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<hYFglnRHfmAjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.89.161.111
country_id: 1269750
description:
Jan  3 10:22:37 host2 sshd[1210842]: Disconnected from invalid user borg 159.89.161.111 port 33620 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 159.89.161.111
country_id: 1269750
description:
Jan  3 10:23:12 host2 sshd[1211677]: Disconnected from invalid user super 159.89.161.111 port 55226 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.248.243.181
country_id: 2542007
description:
2026-01-03 10:24:22 dovecot_plain authenticator failed for H=(proks) [41.248.243.181]:53514: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.199.126
country_id: 1269750
description:
2026-01-03 10:26:07 dovecot_login authenticator failed for H=([182.79.31.107]) [152.52.199.126]:45992: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  3 10:25:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<zANfoXRHAuJnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  3 10:26:01 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<MERWpHRHrpyeRdvj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.149
country_id: 3996063
description:
2026-01-03 10:26:05 dovecot_login authenticator failed for H=([177.236.146.149]) [177.236.146.149]:33768: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.162.191
country_id: 3144096
description:
2026-01-03 10:26:13 dovecot_login authenticator failed for H=(cm-178.232.162.191.get.no) [178.232.162.191]:37402: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.16.55
country_id: 3469034
description:
2026-01-03 10:27:33 dovecot_login authenticator failed for H=(177-174-16-55.user.vivozap.com.br) [177.174.16.55]:41627: 535 Incorrect authentication data (set_id=office@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.83.135.122
country_id: 6251999
description:
2026-01-03 10:29:14 dovecot_login authenticator failed for H=([24.83.135.122]) [24.83.135.122]:57176: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.179.128
country_id: 3996063
description:
2026-01-03 10:29:24 dovecot_login authenticator failed for H=([140.84.179.128]) [140.84.179.128]:34634: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.251.120
country_id: 2921044
description:
Jan  3 10:29:52 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=164.92.251.120, lip=66.85.158.91, TLS handshaking: Connection closed, session=<piw8snRHTs+kXPt4>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.178.229.240
country_id: 1880251
description:
Jan  3 10:32:30 host2 pure-ftpd[1220948]: (?@158.178.229.240) [INFO] New connection from 158.178.229.240


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 158.178.229.240
country_id: 1880251
description:
Jan  3 10:32:34 host2 pure-ftpd[1221038]: (?@158.178.229.240) [INFO] New connection from 158.178.229.240


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.178.229.240
country_id: 1880251
description:
Jan  3 10:33:09 host2 pure-ftpd[1221749]: (?@158.178.229.240) [INFO] New connection from 158.178.229.240


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 158.178.229.240
country_id: 1880251
description:
Jan  3 10:33:10 host2 pure-ftpd[1221778]: (?@158.178.229.240) [INFO] New connection from 158.178.229.240


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.85
country_id: 1210997
description:
2026-01-03 10:33:57 dovecot_login authenticator failed for H=([103.115.252.60]) [103.115.252.85]:50765: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.106.190
country_id: 2077456
description:
2026-01-03 10:34:13 dovecot_login authenticator failed for H=([123.209.106.190]) [123.209.106.190]:44730: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.242.142
country_id: 1269750
description:
2026-01-03 10:34:58 dovecot_login authenticator failed for H=([125.19.172.137]) [182.78.242.142]:60246: 535 Incorrect authentication data (set_id=office@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  3 10:35:57 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<Xofjx3RHAJ4v+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.138.90.195
country_id: 2661886
description:
2026-01-03 10:35:13 dovecot_login authenticator failed for H=h79-138-90-195.cust.bredband2.com [79.138.90.195]:44394: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 10:37:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<47zOy3RHgrsyBvlc>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 10:37:54 host2 sshd[1226328]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 10:37:40 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<w1L9zXRH2tFyB6Oa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-01-03 10:38:04 dovecot_login authenticator failed for H=([197.219.228.242]) [197.219.228.242]:54406: 535 Incorrect authentication data (set_id=postmaster@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.207.210.23
country_id: 2960313
description:
2026-01-03 10:38:18 dovecot_plain authenticator failed for H=(eriseum) [88.207.210.23]:63936: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.222
country_id: 2186224
description:
2026-01-03 10:38:19 dovecot_login authenticator failed for H=([121.73.169.222]) [121.73.169.222]:35418: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.15.108
country_id: 290557
description:
2026-01-03 10:42:44 dovecot_plain authenticator failed for H=(ciddly) [5.31.15.108]:55233: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.123
country_id: 6252001
description:
Jan  3 10:43:17 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.123, lip=66.85.158.91, TLS: Connection closed, session=<TIY44nRHWrZChJl7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.253.56.73
country_id: 6252001
description:
Jan  3 10:46:13 host2 sshd[1235661]: Disconnected from invalid user simon 47.253.56.73 port 38270 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.163.123.45
country_id: 1880251
description:
Jan  3 10:48:45 host2 sshd[1237916]: Disconnected from invalid user k8s 43.163.123.45 port 48096 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.163.123.45
country_id: 1880251
description:
Jan  3 10:49:32 host2 sshd[1238794]: Disconnected from invalid user front 43.163.123.45 port 33694 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.173.2.164
country_id: 1643084
description:
Jan  3 10:49:55 host2 sshd[1239228]: Disconnected from invalid user k8s 43.173.2.164 port 39550 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.25.232.7
country_id: 953987
description:
Jan  3 10:50:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<amila@euroentertainmentlk.com>, method=PLAIN, rip=41.25.232.7, lip=66.85.158.91, session=<knTR+3RHRdEpGegH>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.163.123.45
country_id: 1880251
description:
Jan  3 10:50:16 host2 sshd[1239803]: Disconnected from invalid user rain 43.163.123.45 port 47516 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.4.245.222
country_id: 2661886
description:
Jan  3 10:50:18 host2 sshd[1239832]: Disconnected from invalid user kim 155.4.245.222 port 54792 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.173.2.164
country_id: 1643084
description:
Jan  3 10:51:20 host2 sshd[1240783]: Disconnected from invalid user admin 43.173.2.164 port 40174 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 10:52:56 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<SzKXBHVHTIpn9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.163.123.45
country_id: 1880251
description:
Jan  3 10:53:08 host2 sshd[1242728]: Disconnected from invalid user default 43.163.123.45 port 46322 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.173.2.164
country_id: 1643084
description:
Jan  3 10:53:15 host2 sshd[1242892]: Disconnected from invalid user admin 43.173.2.164 port 37504 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.253.56.73
country_id: 6252001
description:
Jan  3 10:53:25 host2 sshd[1243064]: Disconnected from invalid user xiaoli 47.253.56.73 port 59334 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 155.4.245.222
country_id: 2661886
description:
Jan  3 10:53:29 host2 sshd[1243097]: Disconnected from invalid user julien 155.4.245.222 port 17647 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2026-01-03 10:54:19 dovecot_plain authenticator failed for H=c-73-195-211-98.hsd1.nj.comcast.net (coecul) [73.195.211.98]:49958: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.4.245.222
country_id: 2661886
description:
Jan  3 10:54:43 host2 sshd[1244824]: Disconnected from invalid user devops 155.4.245.222 port 33001 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.173.2.164
country_id: 1643084
description:
Jan  3 10:55:09 host2 sshd[1245525]: Disconnected from invalid user zhang 43.173.2.164 port 38092 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  3 10:55:33 host2 pure-ftpd[1246159]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.85
country_id: 1210997
description:
2026-01-03 10:56:22 dovecot_login authenticator failed for H=([103.115.252.60]) [103.115.252.85]:50978: 535 Incorrect authentication data (set_id=contact@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.229
country_id: 3865483
description:
Jan  3 10:58:03 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=179.0.252.229, lip=66.85.158.91, TLS, session=<HovuFXVHO9qzAPzl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.253.56.73
country_id: 6252001
description:
Jan  3 10:57:16 host2 sshd[1247856]: Disconnected from invalid user paulo 47.253.56.73 port 45058 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.130.168.24
country_id: 3469034
description:
Jan  3 10:58:23 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw>, method=PLAIN, rip=177.130.168.24, lip=66.85.158.91, TLS, session=<BRwqF3VHaZ2xgqgY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.62.239.4
country_id: 732800
description:
2026-01-03 10:59:34 dovecot_plain authenticator failed for H=(lerse) [149.62.239.4]:48622: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2026-01-03 11:00:09 dovecot_plain authenticator failed for H=(pyrry) [94.201.22.158]:46452: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  3 11:02:41 host2 sshd[1253138]: Disconnected from invalid user admin 2.57.121.112 port 54337 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.15.163.174
country_id: 6252001
description:
Jan  3 11:03:16 host2 pure-ftpd[1253900]: (?@20.15.163.174) [INFO] New connection from 20.15.163.174


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 11:05:15 host2 sshd[1256175]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.54
country_id: 1149361
description:
2026-01-03 11:06:31 dovecot_login authenticator failed for H=([149.54.62.54]) [149.54.62.54]:53475: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.219.54
country_id: 1269750
description:
2026-01-03 11:06:41 dovecot_login authenticator failed for H=([125.21.200.57]) [128.185.219.54]:44800: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.157
country_id: 6252001
description:
Jan  3 11:08:49 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 4 secs): user=<>, rip=147.185.132.157, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<ECCIPXVH2duTuYSd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.157
country_id: 6252001
description:
Jan  3 11:09:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=147.185.132.157, lip=66.85.158.91, TLS: read(size=429) failed: Connection reset by peer, session=<3a3tQHVHZPyTuYSd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  3 11:10:16 host2 sshd[1261612]: Disconnected from invalid user user 2.57.121.25 port 54535 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.152
country_id: 3469034
description:
Jan  3 11:11:06 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=190.89.137.152, lip=66.85.158.91, TLS, session=<TbSMRHVHHIa+WYmY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.15
country_id: 3865483
description:
Jan  3 11:11:27 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=179.0.250.15, lip=66.85.158.91, TLS, session=<PnzWRXVHWbezAPoP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan  3 11:13:17 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<gtKGTXVHFr4DiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.89.159.59
country_id: 3865483
description:
2026-01-03 11:15:02 dovecot_login authenticator failed for H=(59-159-89-200.fibertel.com.ar) [200.89.159.59]:41504: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.135.48
country_id: 3144096
description:
2026-01-03 11:15:20 dovecot_login authenticator failed for H=([188.124.135.48]) [188.124.135.48]:56556: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.157
country_id: 6252001
description:
Jan  3 11:15:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.157, lip=66.85.158.91, TLS, session=<H5pqVnVHJuaTuYSd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan  3 11:15:48 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<UIZ8VnVHsMEDiUnd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 11:16:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<m1DGV3VHTOMyBvlc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan  3 11:17:49 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<GbW3XXVHWsgDiUnd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 11:18:06 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<h32gXnVHdOByB6Oa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan  3 11:18:26 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<2XLnX3VHQJ8DiUnd>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.137.73.221
country_id: 6252001
description:
Jan  3 11:19:49 host2 dovecot[1170291]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<7O7iZHVHcL8DiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan  3 11:20:32 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<OiZvZ3VHKMgDiUnd>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 161.118.238.65
country_id: 1880251
description:
Jan  3 11:21:03 host2 pure-ftpd[1272283]: (?@161.118.238.65) [INFO] New connection from 161.118.238.65


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 161.118.238.65
country_id: 1880251
description:
Jan  3 11:21:07 host2 pure-ftpd[1272354]: (?@161.118.238.65) [INFO] New connection from 161.118.238.65


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 161.118.238.65
country_id: 1880251
description:
Jan  3 11:21:08 host2 pure-ftpd[1272363]: (?@161.118.238.65) [INFO] New connection from 161.118.238.65


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 161.118.238.65
country_id: 1880251
description:
Jan  3 11:21:13 host2 pure-ftpd[1272446]: (?@161.118.238.65) [INFO] New connection from 161.118.238.65


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 161.118.238.65
country_id: 1880251
description:
Jan  3 11:22:09 host2 pure-ftpd[1273446]: (?@161.118.238.65) [INFO] New connection from 161.118.238.65


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 161.118.238.65
country_id: 1880251
description:
Jan  3 11:22:13 host2 pure-ftpd[1273512]: (?@161.118.238.65) [INFO] New connection from 161.118.238.65


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.2
country_id: 1269750
description:
2026-01-03 11:22:37 dovecot_login authenticator failed for H=([125.19.173.202]) [152.52.236.2]:45786: 535 Incorrect authentication data (set_id=test@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.247.239.202
country_id: 1269750
description:
2026-01-03 11:24:52 dovecot_login authenticator failed for H=(abts-north-static-194.142.160.122.airtelbroadband.in) [117.247.239.202]:40346: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.234
country_id: 2186224
description:
2026-01-03 11:25:02 dovecot_login authenticator failed for H=([121.73.168.234]) [121.73.168.234]:33272: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.51.34.229
country_id: 2510769
description:
2026-01-03 11:30:26 dovecot_login authenticator failed for H=(229.34.51.212.dynamic.reverse-mundo-r.com) [212.51.34.229]:44270: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.225.42.158
country_id: 719819
description:
2026-01-03 11:30:39 dovecot_login authenticator failed for H=netacc-gpn-5-42-158.pool.yettel.hu [84.225.42.158]:50798: 535 Incorrect authentication data (set_id=postmaster@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 11:34:47 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<sM5NmnVHlLhn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.213.16
country_id: 732800
description:
2026-01-03 11:35:42 dovecot_login authenticator failed for H=95-87-213-16.ip.btc-net.bg [95.87.213.16]:41012: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.62
country_id: 6252001
description:
Jan  3 11:36:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=167.94.146.62, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<qaQxn3VHqOmnXpI+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 31.208.188.18
country_id: 2661886
description:
Jan  3 11:35:25 host2 pure-ftpd[1287773]: (?@31.208.188.18) [INFO] New connection from 31.208.188.18


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 31.208.188.18
country_id: 2661886
description:
Jan  3 11:35:26 host2 sshd[1287771]: Invalid user mohdehiovita@epid.gov.lk from 31.208.188.18 port 49184


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 31.208.188.18
country_id: 2661886
description:
Jan  3 11:35:32 host2 pure-ftpd[1287773]: (?@31.208.188.18) [WARNING] Authentication failed for user [mohdehiovita@epid.gov.lk]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.62
country_id: 6252001
description:
Jan  3 11:36:08 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=167.94.146.62, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<WEBDn3VHvumnXpI+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.40.122.250
country_id: 2629691
description:
2026-01-03 11:38:45 dovecot_login authenticator failed for H=nova-185-040-122-250.cpe.novanet.is [185.40.122.250]:40580: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  3 11:39:13 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<fCo8qnVHOpoDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  3 11:40:10 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<mxeqrXVHdLkDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
country_id: 1269750
description:
2026-01-03 11:41:34 dovecot_login authenticator failed for H=(nsg-static-82.71.76.182-airtel.com) [182.76.71.82]:44736: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  3 11:41:59 host2 sshd[1293882]: Disconnected from invalid user admin 2.57.121.112 port 55908 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  3 11:42:14 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<tYQOtXVH/LQDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  3 11:43:52 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<dgrounVHZI8DjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.41
country_id: 2750405
description:
2026-01-03 11:45:08 dovecot_login authenticator failed for H=(Copy-of-VM-2022) [45.94.31.41]:29215: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  3 11:44:37 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<0GeUvXVHrrkDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.41
country_id: 2750405
description:
2026-01-03 11:45:16 dovecot_login authenticator failed for H=(Copy-of-VM-2022) [45.94.31.41]:29605: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  3 11:45:23 host2 dovecot[1170291]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<YUxOwHVHZKMDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  3 11:45:45 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<MJygwXVHYLwDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.95
country_id: 6252001
description:
Jan  3 11:45:58 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.95, lip=66.85.158.91, TLS, session=</HdgwnVHmOzN0h9f>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  3 11:47:08 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<7dCUxnVHbpADjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.5.238.101
country_id: 3175395
description:
2026-01-03 11:46:25 dovecot_login authenticator failed for H=host-87-5-238-101.retail.telecomitalia.it [87.5.238.101]:45240: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2026-01-03 11:46:36 dovecot_login authenticator failed for H=([122.184.120.98]) [122.184.120.98]:41194: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  3 11:47:44 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<fdyzyHVH9KcDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.213.178.212
country_id: 1861060
description:
2026-01-03 11:50:32 dovecot_login authenticator failed for H=([154.213.178.117]) [154.213.178.212]:17456: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.214
country_id: 1269750
description:
2026-01-03 11:50:54 dovecot_login authenticator failed for H=([182.95.181.214]) [182.95.181.214]:48904: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.218.50
country_id: 1269750
description:
2026-01-03 11:52:32 dovecot_login authenticator failed for H=([125.19.218.50]) [125.19.218.50]:58922: 535 Incorrect authentication data (set_id=office@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.239.182
country_id: 1269750
description:
2026-01-03 11:52:47 dovecot_login authenticator failed for H=([128.185.217.84]) [128.185.239.182]:49870: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 11:54:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<+TBK4nVHGqoyBvlc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2026-01-03 11:57:01 dovecot_login authenticator failed for H=([192.34.128.202]) [192.34.128.202]:50232: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.118.99.170
country_id: 3686110
description:
Jan  3 11:59:06 host2 sshd[1313174]: Disconnected from invalid user ubuntu 200.118.99.170 port 41798 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.188.141
country_id: 6252001
description:
Jan  3 11:58:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=44.220.188.141, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<9BR97nVHhtks3LyN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 11:58:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<DXP973VHVoByB6Oa>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  3 11:59:18 host2 pure-ftpd[1313369]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 106.51.1.63
country_id: 1269750
description:
Jan  3 11:59:31 host2 sshd[1313521]: Disconnected from invalid user ubuntu 106.51.1.63 port 32972 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.242.48.147
country_id: 3469034
description:
Jan  3 11:59:38 host2 sshd[1313634]: Disconnected from invalid user ubuntu 191.242.48.147 port 37528 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.24.64.220
country_id: 2635167
description:
Jan  3 11:59:07 host2 sshd[1313200]: Disconnected from invalid user dhis 82.24.64.220 port 52036 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 106.51.1.63
country_id: 1269750
description:
Jan  3 12:00:11 host2 sshd[1314371]: Disconnected from invalid user server 106.51.1.63 port 44978 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.242.48.147
country_id: 3469034
description:
Jan  3 12:00:20 host2 sshd[1314671]: Disconnected from invalid user macha 191.242.48.147 port 49396 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.118.99.170
country_id: 3686110
description:
Jan  3 12:00:34 host2 sshd[1314886]: Disconnected from invalid user ubuntu 200.118.99.170 port 33098 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.85
country_id: 2186224
description:
2026-01-03 12:00:59 dovecot_login authenticator failed for H=([121.73.163.85]) [121.73.163.85]:56296: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.227.185.238
country_id: 1269750
description:
Jan  3 12:01:49 host2 sshd[1316035]: Disconnected from invalid user colin 43.227.185.238 port 53730 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 191.242.48.147
country_id: 3469034
description:
Jan  3 12:01:45 host2 sshd[1315977]: Disconnected from invalid user idempiere 191.242.48.147 port 44902 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.215.80.173
country_id: 1819730
description:
Jan  3 12:02:15 host2 sshd[1316394]: Disconnected from invalid user steam 103.215.80.173 port 43142 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.118.99.170
country_id: 3686110
description:
Jan  3 12:02:20 host2 sshd[1316465]: Disconnected from invalid user student 200.118.99.170 port 39638 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.242.48.147
country_id: 3469034
description:
Jan  3 12:03:44 host2 sshd[1317794]: Disconnected from invalid user colin 191.242.48.147 port 52264 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.24.64.220
country_id: 2635167
description:
Jan  3 12:03:21 host2 sshd[1317383]: Disconnected from invalid user augusto 82.24.64.220 port 60824 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 106.51.1.63
country_id: 1269750
description:
Jan  3 12:04:23 host2 sshd[1318616]: Disconnected from invalid user root1 106.51.1.63 port 44208 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 82.24.64.220
country_id: 2635167
description:
Jan  3 12:04:26 host2 sshd[1318681]: Disconnected from invalid user daniel 82.24.64.220 port 35072 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.227.185.238
country_id: 1269750
description:
Jan  3 12:04:31 host2 sshd[1318770]: Disconnected from invalid user ubuntu 43.227.185.238 port 38046 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.8.161
country_id: 2658434
description:
Jan  3 12:04:37 host2 sshd[1318891]: Disconnected from invalid user deploy 185.196.8.161 port 59448 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.118.99.170
country_id: 3686110
description:
Jan  3 12:04:40 host2 sshd[1318971]: Disconnected from invalid user root1 200.118.99.170 port 57752 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.196.8.161
country_id: 2658434
description:
Jan  3 12:06:18 host2 sshd[1321668]: Disconnected from invalid user samira 185.196.8.161 port 46984 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.227.252.2
country_id: 1269750
description:
2026-01-03 12:06:31 dovecot_login authenticator failed for H=(abts-tn-dynamic-2.252.227.110.airtelbroadband.in) [110.227.252.2]:46274: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.46.235.137
country_id: 6252001
description:
Jan  3 12:06:48 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.46.235.137, lip=66.85.158.92, session=<hsvlDHZHsK0ULuuJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.227.185.238
country_id: 1269750
description:
Jan  3 12:06:59 host2 sshd[1322407]: Disconnected from invalid user student 43.227.185.238 port 38092 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.214.212
country_id: 3144096
description:
2026-01-03 12:08:07 dovecot_login authenticator failed for H=(cm-84.210.214.212.get.no) [84.210.214.212]:49204: 535 Incorrect authentication data (set_id=postmaster@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2026-01-03 12:08:21 dovecot_login authenticator failed for H=([152.52.93.82]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=contact@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.202
country_id: 1149361
description:
2026-01-03 12:08:34 dovecot_login authenticator failed for H=([180.94.75.202]) [180.94.75.202]:48172: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.140.160.28
country_id: 2542007
description:
[2026-01-03 12:11:24 +0530] info [cpaneld] 41.140.160.28 - info@cloudtourssrilanka.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 41.140.160.28
country_id: 2542007
description:
Login Blocked: IP reached maximum auth failures [Service]=[cpaneld] [Local IP Address]=[66.85.158.91] [Local Port]=[2083] [Remote IP Address]=[41.140.160.28] [Remote Port]=[57426] [Authentication Database]=[system] [Username]=[travel] (5/5 failures) (blocked until [Sat Jan  3 06:56:34 2026 UTC/Sat Jan  3 12:26:34 2026 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.50
country_id: 1269750
description:
2026-01-03 12:15:53 dovecot_login authenticator failed for H=(aes-static-089.153.22.125.airtel.in) [182.95.119.50]:37294: 535 Incorrect authentication data (set_id=test@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.124
country_id: 6252001
description:
Jan  3 12:15:57 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.124, lip=66.85.158.92, TLS: Connection closed, session=<MBSeLXZH1IdChJl8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 12:16:49 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<BBSVMHZH0MNn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2026-01-03 12:21:07 dovecot_plain authenticator failed for H=c-174-169-224-27.hsd1.vt.comcast.net (fally) [174.169.224.27]:32864: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2026-01-03 12:22:57 dovecot_login authenticator failed for H=([189.59.210.1]) [186.215.245.175]:51724: 535 Incorrect authentication data (set_id=sales@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.237.107
country_id: 3144096
description:
2026-01-03 12:23:07 dovecot_login authenticator failed for H=(cm-178.232.237.107.get.no) [178.232.237.107]:35146: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.168.156
country_id: 6252001
description:
Jan  3 12:24:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=40.124.168.156, lip=66.85.158.91, session=<ceS2TXZHpokofKic>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.166
country_id: 2993457
description:
Jan  3 12:26:04 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.166, lip=66.85.158.92, session=<JSbWUXZHl//CpRCm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 12:29:00 host2 sshd[1346210]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.215.1.201
country_id: 2635167
description:
2026-01-03 12:30:05 dovecot_login authenticator failed for H=([88.215.1.201]) [88.215.1.201]:38835: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.21.104
country_id: 1269750
description:
2026-01-03 12:30:15 dovecot_login authenticator failed for H=(abts-north-static-104.21.176.122.airtelbroadband.in) [122.176.21.104]:60832: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  3 12:31:43 host2 sshd[1349445]: Disconnected from invalid user user 2.57.121.25 port 37333 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 12:33:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<lLopbXZH3o0yBvlc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.8.241.171
country_id: 2077456
description:
2026-01-03 12:35:39 dovecot_login authenticator failed for H=([161.8.241.171]) [161.8.241.171]:59203: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 12:39:14 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<z5i7gHZHVo5yB6Oa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.197.178
country_id: 1269750
description:
2026-01-03 12:40:53 dovecot_login authenticator failed for H=([128.185.197.178]) [128.185.197.178]:37142: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.41.18
country_id: 1269750
description:
2026-01-03 12:41:54 dovecot_login authenticator failed for H=([182.73.193.249]) [122.187.41.18]:49890: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.226.163
country_id: 3144096
description:
2026-01-03 12:42:03 dovecot_login authenticator failed for H=([178.232.226.163]) [178.232.226.163]:38540: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2026-01-03 12:46:14 dovecot_plain authenticator failed for H=(retilly) [65.20.129.28]:40435: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2026-01-03 12:46:49 dovecot_plain authenticator failed for H=c-71-224-169-28.hsd1.pa.comcast.net (peratic) [71.224.169.28]:33316: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-03 12:47:38 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:60360: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.145.94
country_id: 3996063
description:
2026-01-03 12:49:46 dovecot_login authenticator failed for H=([177.236.145.94]) [177.236.145.94]:48403: 535 Incorrect authentication data (set_id=postmaster@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.23.68
country_id: 3144096
description:
2026-01-03 12:50:01 dovecot_login authenticator failed for H=(cm-178.232.23.68.get.no) [178.232.23.68]:36624: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2026-01-03 12:50:13 dovecot_plain authenticator failed for H=c-73-197-236-163.hsd1.nj.comcast.net (ruelambaky) [73.197.236.163]:58422: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.54
country_id: 3144096
description:
2026-01-03 12:51:06 dovecot_login authenticator failed for H=(54-170-97-62.cust.smartcall.no) [62.97.170.54]:59330: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.228.168.12
country_id: 1327865
description:
2026-01-03 12:51:20 dovecot_login authenticator failed for H=([136.228.168.12]) [136.228.168.12]:54480: 535 Incorrect authentication data (set_id=office@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-01-03 12:52:17 dovecot_plain authenticator failed for H=syn-074-218-095-154.biz.spectrum.com (khetiess) [74.218.95.154]:35005: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.224.171.101
country_id: 6252001
description:
2026-01-03 12:52:20 dovecot_plain authenticator failed for H=c-73-224-171-101.hsd1.fl.comcast.net (magess) [73.224.171.101]:36706: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  3 12:54:05 host2 sshd[1373508]: Disconnected from invalid user admin 2.57.121.112 port 42434 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.210.77.100
country_id: 3996063
description:
Jan  3 12:54:14 host2 sshd[1373876]: Disconnected from invalid user erpnext 187.210.77.100 port 36694 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.178
country_id: 6252001
description:
Jan  3 12:55:42 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.178, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<L8fIu3ZH2crN0h+y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.74.243.13
country_id: 2510769
description:
Jan  3 12:55:11 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=185.74.243.13, lip=66.85.158.91, TLS, session=<gqztuHZH6si5SvMN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.30.83.214
country_id: 1269750
description:
Jan  3 12:55:32 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<charanaw>, method=PLAIN, rip=103.30.83.214, lip=66.85.158.91, TLS, session=<6xUUunZHmsJnHlPW>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 12:56:27 host2 sshd[1376458]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.210.77.100
country_id: 3996063
description:
Jan  3 12:56:43 host2 sshd[1376661]: Disconnected from invalid user test_user 187.210.77.100 port 39670 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 219.92.8.45
country_id: 1733045
description:
Jan  3 12:58:32 host2 sshd[1378481]: Disconnected from invalid user hadoop 219.92.8.45 port 60994 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.131.53.100
country_id: 1269750
description:
Jan  3 12:58:48 host2 sshd[1378734]: Disconnected from invalid user erpnext 185.131.53.100 port 41124 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 12:58:53 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<tMMIx3ZHoNtn9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.131.53.100
country_id: 1269750
description:
Jan  3 12:59:21 host2 sshd[1379367]: Disconnected from invalid user test_user 185.131.53.100 port 41260 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 187.210.77.100
country_id: 3996063
description:
Jan  3 13:00:31 host2 sshd[1380933]: Received disconnect from 187.210.77.100 port 60126:11: Bye Bye [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.111
country_id: 6252001
description:
Jan  3 13:00:57 host2 pure-ftpd[1381408]: (?@147.185.132.111) [INFO] New connection from 147.185.132.111


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.131.53.100
country_id: 1269750
description:
Jan  3 13:01:36 host2 sshd[1381960]: Disconnected from invalid user frappe 185.131.53.100 port 56294 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  3 13:03:24 host2 pure-ftpd[1384077]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.145.10.140
country_id: 6252001
description:
2026-01-03 13:04:19 dovecot_plain authenticator failed for H=c-76-145-10-140.hsd1.ga.comcast.net (woonoste) [76.145.10.140]:46626: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.154
country_id: 3144096
description:
2026-01-03 13:07:02 dovecot_login authenticator failed for H=(cm-84.213.189.154.get.no) [84.213.189.154]:36097: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 219.92.8.45
country_id: 1733045
description:
Jan  3 13:06:19 host2 sshd[1387185]: Disconnected from invalid user admin 219.92.8.45 port 43654 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.6.83
country_id: 690791
description:
Jan  3 13:08:17 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=176.103.6.83, lip=66.85.158.91, TLS, session=<qhy553ZHB8awZwZT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.109.178.41
country_id: 1269750
description:
Jan  3 13:08:39 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=103.109.178.41, lip=66.85.158.91, TLS, session=<c8z66HZHvZFnbbIp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.144.20
country_id: 3996063
description:
2026-01-03 13:09:34 dovecot_login authenticator failed for H=([177.236.144.20]) [177.236.144.20]:51916: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.154.221.68
country_id: 2510769
description:
2026-01-03 13:09:23 dovecot_login authenticator failed for H=68.red-79-154-221.dynamicip.rima-tde.net [79.154.221.68]:44819: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 222.124.17.227
country_id: 1643084
description:
Jan  3 13:09:33 host2 sshd[1390694]: Disconnected from invalid user vmuser 222.124.17.227 port 60274 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.165.121.195
country_id: 1269750
description:
Jan  3 13:10:39 host2 sshd[1391990]: Disconnected from invalid user testuser 122.165.121.195 port 47482 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.80
country_id: 1880251
description:
Jan  3 13:10:11 host2 sshd[1391361]: Disconnected from invalid user user02 45.78.223.80 port 37648 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.165.121.195
country_id: 1269750
description:
Jan  3 13:11:31 host2 sshd[1392851]: Disconnected from invalid user erpnext 122.165.121.195 port 36252 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.165.121.195
country_id: 1269750
description:
Jan  3 13:12:23 host2 sshd[1393663]: Disconnected from invalid user deployer 122.165.121.195 port 58726 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.219.234.254
country_id: 6252001
description:
Jan  3 13:12:27 host2 pure-ftpd[1393746]: (?@104.219.234.254) [INFO] New connection from 104.219.234.254


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 13:14:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<NA+z/XZHBrAyBvlc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.221.89
country_id: 1880251
description:
Jan  3 13:18:16 host2 sshd[1399440]: Disconnected from invalid user anderson 45.78.221.89 port 45990 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2026-01-03 13:18:56 dovecot_plain authenticator failed for H=c-73-195-211-98.hsd1.nj.comcast.net (obsomysit) [73.195.211.98]:51120: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.221.89
country_id: 1880251
description:
Jan  3 13:19:16 host2 sshd[1400574]: Disconnected from invalid user chef 45.78.221.89 port 41874 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 13:19:57 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<x/ZeEndH+ptyB6Oa>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.178.229.240
country_id: 1880251
description:
Jan  3 13:20:34 host2 pure-ftpd[1402179]: (?@158.178.229.240) [INFO] New connection from 158.178.229.240


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 158.178.229.240
country_id: 1880251
description:
Jan  3 13:20:38 host2 pure-ftpd[1402271]: (?@158.178.229.240) [INFO] New connection from 158.178.229.240


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.58.87.108
country_id: 6252001
description:
2026-01-03 13:21:05 dovecot_plain authenticator failed for H=c-174-58-87-108.hsd1.fl.comcast.net (jaccia) [174.58.87.108]:47018: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.80
country_id: 1880251
description:
Jan  3 13:21:21 host2 sshd[1403042]: Disconnected from invalid user ubuntu 45.78.223.80 port 43744 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.178.229.240
country_id: 1880251
description:
Jan  3 13:21:08 host2 pure-ftpd[1402875]: (?@158.178.229.240) [INFO] New connection from 158.178.229.240


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 158.178.229.240
country_id: 1880251
description:
Jan  3 13:21:10 host2 pure-ftpd[1402901]: (?@158.178.229.240) [INFO] New connection from 158.178.229.240


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.38.130
country_id: 1210997
description:
2026-01-03 13:23:21 dovecot_login authenticator failed for H=([49.0.38.130]) [49.0.38.130]:54020: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.133.238
country_id: 3469034
description:
2026-01-03 13:23:31 dovecot_login authenticator failed for H=([187.51.128.233]) [189.44.133.238]:58687: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.220.16.51
country_id: 1269750
description:
2026-01-03 13:24:21 dovecot_login authenticator failed for H=([103.220.16.51]) [103.220.16.51]:54136: 535 Incorrect authentication data (set_id=test@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.182.44.104
country_id: 130758
description:
2026-01-03 13:24:44 dovecot_login authenticator failed for H=(static.104.44.182.5.clients.irandns.com) [5.182.44.104]:42552: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.80
country_id: 1880251
description:
Jan  3 13:25:05 host2 sshd[1407313]: Disconnected from invalid user admin 45.78.223.80 port 53608 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  3 13:26:55 host2 sshd[1409153]: Disconnected from invalid user admin 2.57.121.112 port 43607 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.154.125.60
country_id: 6251999
description:
Jan  3 13:27:45 host2 sshd[1409958]: Disconnected from invalid user media 66.154.125.60 port 49704 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.166
country_id: 1269750
description:
2026-01-03 13:29:00 dovecot_login authenticator failed for H=([103.56.85.65]) [128.185.227.166]:41546: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.121.43
country_id: 3144096
description:
2026-01-03 13:29:02 dovecot_login authenticator failed for H=(cm-178.232.121.43.get.no) [178.232.121.43]:47731: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.122.247
country_id: 3144096
description:
2026-01-03 13:29:13 dovecot_login authenticator failed for H=(cm-178.232.122.247.get.no) [178.232.122.247]:42545: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.190
country_id: 1269750
description:
2026-01-03 13:29:28 dovecot_login authenticator failed for H=([27.123.114.190]) [27.123.114.190]:36140: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.223.80
country_id: 1880251
description:
Jan  3 13:29:59 host2 sshd[1412302]: Disconnected from invalid user github 45.78.223.80 port 33162 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 84.54.2.78
country_id: 1819730
description:
Jan  3 13:30:13 host2 sshd[1412775]: Disconnected from invalid user hduser 84.54.2.78 port 42336 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 142.93.110.84
country_id: 2921044
description:
Jan  3 13:33:04 host2 sshd[1416115]: Disconnected from invalid user justin 142.93.110.84 port 56616 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.154.125.60
country_id: 6251999
description:
Jan  3 13:32:40 host2 sshd[1415640]: Disconnected from invalid user vbox 66.154.125.60 port 49810 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.154.125.60
country_id: 6251999
description:
Jan  3 13:33:17 host2 sshd[1416370]: Disconnected from invalid user nas 66.154.125.60 port 49868 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.68.150.253
country_id: 2635167
description:
Jan  3 13:33:20 host2 sshd[1416414]: Disconnected from invalid user nas 138.68.150.253 port 56342 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 142.93.110.84
country_id: 2921044
description:
Jan  3 13:33:36 host2 sshd[1416640]: Disconnected from invalid user spread 142.93.110.84 port 38872 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.154.125.60
country_id: 6251999
description:
Jan  3 13:34:30 host2 sshd[1417554]: Disconnected from invalid user production 66.154.125.60 port 49992 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.68.150.253
country_id: 2635167
description:
Jan  3 13:34:54 host2 sshd[1418098]: Disconnected from invalid user sandeep 138.68.150.253 port 50784 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.68.150.253
country_id: 2635167
description:
Jan  3 13:34:24 host2 sshd[1417447]: Disconnected from invalid user tmp 138.68.150.253 port 36840 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.122
country_id: 1269750
description:
2026-01-03 13:35:08 dovecot_login authenticator failed for H=([27.123.102.122]) [27.123.102.122]:33122: 535 Incorrect authentication data (set_id=postmaster@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 84.54.2.78
country_id: 1819730
description:
Jan  3 13:35:25 host2 sshd[1418816]: Disconnected from invalid user uftp 84.54.2.78 port 49076 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.156
country_id: 1269750
description:
2026-01-03 13:35:38 dovecot_login authenticator failed for H=([103.146.233.156]) [103.146.233.156]:51660: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.142.126.37
country_id: 6252001
description:
2026-01-03 13:35:43 dovecot_plain authenticator failed for H=c-69-142-126-37.hsd1.nj.comcast.net (spiering) [69.142.126.37]:42426: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.54
country_id: 1733045
description:
2026-01-03 13:36:11 dovecot_login authenticator failed for H=([49.124.151.54]) [49.124.151.54]:38628: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 13:40:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<VLGuXHdHrs5n9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.219.80
country_id: 3144096
description:
2026-01-03 13:46:33 dovecot_login authenticator failed for H=([84.210.219.80]) [84.210.219.80]:49018: 535 Incorrect authentication data (set_id=postmaster@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.32.163.238
country_id: 953987
description:
2026-01-03 13:46:54 dovecot_login authenticator failed for H=([102.32.163.238]) [102.32.163.238]:51279: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2026-01-03 13:51:26 dovecot_plain authenticator failed for H=c-98-204-134-124.hsd1.md.comcast.net (euncyated) [98.204.134.124]:47744: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 13:52:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<7xuzhXdHoqsyBvlc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.188.10
country_id: 3144096
description:
2026-01-03 14:00:29 dovecot_login authenticator failed for H=(cm-178.232.188.10.get.no) [178.232.188.10]:55872: 535 Incorrect authentication data (set_id=sales@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.206
country_id: 1269750
description:
2026-01-03 14:00:39 dovecot_login authenticator failed for H=([182.95.176.206]) [182.95.176.206]:57690: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.114.73
country_id: 1168579
description:
2026-01-03 14:00:43 dovecot_login authenticator failed for H=([103.186.114.73]) [103.186.114.73]:37669: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 14:00:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<1gWfpHdH4qlyB6Oa>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.8.199
country_id: 2658434
description:
Jan  3 14:03:53 host2 sshd[1451712]: Disconnected from invalid user backend 185.196.8.199 port 37628 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.217.12.57
country_id: 3437598
description:
Jan  3 14:04:12 host2 sshd[1452026]: Disconnected from invalid user andrey 201.217.12.57 port 59532 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 86.54.42.199
country_id: 241170
description:
Jan  3 14:04:38 host2 sshd[1452418]: Disconnected from invalid user z 86.54.42.199 port 55378 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  3 14:06:04 host2 sshd[1454438]: Disconnected from invalid user user 2.57.121.25 port 15318 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.217.12.57
country_id: 3437598
description:
Jan  3 14:05:43 host2 sshd[1453789]: Disconnected from invalid user kiosk 201.217.12.57 port 51908 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.194
country_id: 6252001
description:
Jan  3 14:05:57 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.194, lip=66.85.158.91, session=<QAcHt3dHmvPG6xjC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.179.188.92
country_id: 6252001
description:
Jan  3 14:06:25 host2 sshd[1454958]: Disconnected from invalid user deployer 66.179.188.92 port 47090 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  3 14:07:39 host2 pure-ftpd[1456347]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 86.54.42.199
country_id: 241170
description:
Jan  3 14:07:44 host2 sshd[1456418]: Disconnected from invalid user kiosk 86.54.42.199 port 48658 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.8.199
country_id: 2658434
description:
Jan  3 14:07:11 host2 sshd[1455821]: Disconnected from invalid user andrey 185.196.8.199 port 38652 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.217.12.57
country_id: 3437598
description:
Jan  3 14:07:12 host2 sshd[1455839]: Disconnected from invalid user z 201.217.12.57 port 36428 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.196.8.199
country_id: 2658434
description:
Jan  3 14:08:15 host2 sshd[1457082]: Disconnected from invalid user bitrix 185.196.8.199 port 56642 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.190.155.43
country_id: 6252001
description:
2026-01-03 14:08:33 dovecot_plain authenticator failed for H=(tinating) [76.190.155.43]:32833: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.217.12.57
country_id: 3437598
description:
Jan  3 14:08:40 host2 sshd[1457453]: Disconnected from invalid user test1 201.217.12.57 port 57310 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 86.54.42.199
country_id: 241170
description:
Jan  3 14:09:13 host2 sshd[1458026]: Disconnected from invalid user apache 86.54.42.199 port 55996 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 86.54.42.199
country_id: 241170
description:
Jan  3 14:10:12 host2 sshd[1459248]: Disconnected from invalid user oracle 86.54.42.199 port 36404 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 86.54.42.199
country_id: 241170
description:
Jan  3 14:10:41 host2 sshd[1459842]: Disconnected from invalid user admin 86.54.42.199 port 43174 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.179.188.92
country_id: 6252001
description:
Jan  3 14:11:12 host2 sshd[1460588]: Disconnected from invalid user david 66.179.188.92 port 45372 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.123.136.11
country_id: 3437598
description:
Jan  3 14:11:31 host2 sshd[1460968]: Disconnected from invalid user amit 181.123.136.11 port 45032 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.188.176.242
country_id: 3923057
description:
Jan  3 14:14:15 host2 sshd[1464212]: Disconnected from invalid user frontend 181.188.176.242 port 60430 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.188.176.242
country_id: 3923057
description:
Jan  3 14:15:41 host2 sshd[1466070]: Disconnected from invalid user trung 181.188.176.242 port 41464 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.123.136.11
country_id: 3437598
description:
Jan  3 14:15:51 host2 sshd[1466225]: Disconnected from invalid user maman 181.123.136.11 port 46920 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.139.193.223
country_id: 1643084
description:
Jan  3 14:16:50 host2 sshd[1467205]: Disconnected from invalid user oracle 103.139.193.223 port 38690 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.139
country_id: 6252001
description:
Jan  3 14:16:53 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.139, lip=66.85.158.92, TLS: Connection closed, session=<duse3ndHXA1ChJmL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.188.176.242
country_id: 3923057
description:
Jan  3 14:16:26 host2 sshd[1466909]: Disconnected from invalid user nana 181.188.176.242 port 51250 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.107.36.18
country_id: 1269750
description:
Jan  3 14:16:28 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<isuru@euroentertainmentlk.com>, method=PLAIN, rip=103.107.36.18, lip=66.85.158.91, TLS, session=<5X9523dH/IBnayQS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.219.125.70
country_id: 798544
description:
Jan  3 14:16:45 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<isuru>, method=PLAIN, rip=178.219.125.70, lip=66.85.158.91, TLS, session=<hnas3HdH7t6y231G>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 14:17:46 host2 sshd[1467848]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.188.176.242
country_id: 3923057
description:
Jan  3 14:17:12 host2 sshd[1467538]: Disconnected from invalid user oracle 181.188.176.242 port 49622 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.139.193.223
country_id: 1643084
description:
Jan  3 14:17:47 host2 sshd[1467977]: Disconnected from invalid user dummy 103.139.193.223 port 35124 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 14:20:06 host2 sshd[1470732]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.188.130
country_id: 3144096
description:
2026-01-03 14:19:55 dovecot_login authenticator failed for H=(cm-84.213.188.130.get.no) [84.213.188.130]:51290: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.5.63.166
country_id: 1694008
description:
2026-01-03 14:19:28 dovecot_login authenticator failed for H=([103.5.63.166]) [103.5.63.166]:38985: 535 Incorrect authentication data (set_id=office@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.113.185.14
country_id: 3469034
description:
2026-01-03 14:19:41 dovecot_login authenticator failed for H=([189.113.185.14]) [189.113.185.14]:47494: 535 Incorrect authentication data (set_id=office@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 14:22:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<z9js8ndHcMBn9M4G>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.154.40.244
country_id: 1819730
description:
Jan  3 14:25:22 host2 pure-ftpd[1476914]: (?@165.154.40.244) [INFO] New connection from 165.154.40.244


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.207.210.23
country_id: 2960313
description:
2026-01-03 14:26:05 dovecot_plain authenticator failed for H=(lency) [88.207.210.23]:61789: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Jan  3 14:26:14 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<bn6P/3dHILCLonQW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.84.34.85
country_id: 1210997
description:
2026-01-03 14:28:43 dovecot_login authenticator failed for H=(ppp075.bol-online.com) [202.84.34.85]:53930: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.186
country_id: 1269750
description:
2026-01-03 14:28:29 dovecot_login authenticator failed for H=([182.95.222.186]) [182.95.222.186]:45402: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 14:29:56 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<N1SuDHhHhJgyBvlc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-01-03 14:30:54 dovecot_plain authenticator failed for H=syn-074-218-095-154.biz.spectrum.com (reffess) [74.218.95.154]:40600: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.235
country_id: 3175395
description:
Jan  3 14:34:14 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=217.26.179.235, lip=66.85.158.91, TLS, session=<0fkkG3hHsKrZGrPr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.62.109
country_id: 953987
description:
Jan  3 14:34:36 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=102.129.62.109, lip=66.85.158.91, TLS, session=<qi1WHHhHbLlmgT5t>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 14:41:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<OGEVNnhHMLhyB6Oa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.10.56.170
country_id: 732800
description:
2026-01-03 14:42:08 dovecot_login authenticator failed for H=46-10-56-170.ip.btc-net.bg [46.10.56.170]:41825: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.228.168.12
country_id: 1327865
description:
2026-01-03 14:42:29 dovecot_login authenticator failed for H=([136.228.168.12]) [136.228.168.12]:52902: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.46
country_id: 1036973
description:
2026-01-03 14:44:26 dovecot_login authenticator failed for H=(dynamic-adsl.movitel.co.mz) [197.219.210.46]:41854: 535 Incorrect authentication data (set_id=office@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.250.1
country_id: 3469034
description:
2026-01-03 14:44:57 dovecot_login authenticator failed for H=(ticons.static.gvt.net.br) [177.207.250.1]:35422: 535 Incorrect authentication data (set_id=sales@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.43.254.214
country_id: 732800
description:
2026-01-03 14:45:10 dovecot_login authenticator failed for H=cable-84-43-254-214.mnet.bg [84.43.254.214]:49925: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.88.196.91
country_id: 6252001
description:
2026-01-03 14:46:04 dovecot_plain authenticator failed for H=c-73-88-196-91.hsd1.ky.comcast.net (tortion) [73.88.196.91]:45776: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 14:47:32 host2 sshd[1501101]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.182.207.45
country_id: 3469034
description:
Jan  3 14:52:59 host2 sshd[1507160]: Disconnected from invalid user carlos 45.182.207.45 port 41120 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.0.68
country_id: 1643084
description:
Jan  3 14:53:49 host2 sshd[1507981]: Disconnected from invalid user test 103.186.0.68 port 42238 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.182.207.45
country_id: 3469034
description:
Jan  3 14:54:03 host2 sshd[1508463]: Disconnected from invalid user admin 45.182.207.45 port 59882 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.61.63
country_id: 1861060
description:
Jan  3 14:54:52 host2 sshd[1509612]: Disconnected from invalid user newuser 118.193.61.63 port 56916 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.182.207.45
country_id: 3469034
description:
Jan  3 14:54:38 host2 sshd[1509377]: Disconnected from invalid user vncuser 45.182.207.45 port 51858 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.182.207.45
country_id: 3469034
description:
Jan  3 14:55:14 host2 sshd[1510115]: Disconnected from invalid user webadmin 45.182.207.45 port 48228 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.154.153.13
country_id: 3923057
description:
Jan  3 14:56:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=45.154.153.13, lip=66.85.158.91, session=<1lQgbXhHkqotmpkN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 82.102.27.92
country_id: 3144096
description:
Jan  3 14:56:53 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=82.102.27.92, lip=66.85.158.91, session=<5+otbXhHeotSZhtc>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.90.126.141
country_id: 3703430
description:
Jan  3 14:56:55 host2 pure-ftpd[1512140]: (?@91.90.126.141) [INFO] New connection from 91.90.126.141


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 161.118.238.65
country_id: 1880251
description:
Jan  3 14:56:45 host2 pure-ftpd[1511884]: (?@161.118.238.65) [INFO] New connection from 161.118.238.65


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 154.47.29.201
country_id: 3202326
description:
Jan  3 14:56:49 host2 pure-ftpd[1511972]: (?@154.47.29.201) [INFO] New connection from 154.47.29.201


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.154.153.13
country_id: 3923057
description:
Jan  3 14:56:49 host2 pure-ftpd[1511995]: (?@45.154.153.13) [INFO] New connection from 45.154.153.13


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.65.50.31
country_id: 597427
description:
Jan  3 14:56:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=185.65.50.31, lip=66.85.158.91, TLS handshaking: Connection closed, session=<XSg+bXhHBRq5QTIf>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 161.118.238.65
country_id: 1880251
description:
Jan  3 14:56:40 host2 pure-ftpd[1511792]: (?@161.118.238.65) [INFO] New connection from 161.118.238.65


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.241.80.139
country_id: 1814991
description:
Jan  3 14:56:52 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=188.241.80.139, lip=66.85.158.91, session=<w24cbXhHap+88VCL>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 188.215.235.49
country_id: 1831722
description:
Jan  3 14:56:55 host2 pure-ftpd[1512122]: (?@188.215.235.49) [INFO] New connection from 188.215.235.49


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 161.118.238.65
country_id: 1880251
description:
Jan  3 14:57:11 host2 pure-ftpd[1512475]: (?@161.118.238.65) [INFO] New connection from 161.118.238.65


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 161.118.238.65
country_id: 1880251
description:
Jan  3 14:57:15 host2 pure-ftpd[1512577]: (?@161.118.238.65) [INFO] New connection from 161.118.238.65


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.217.130.86
country_id: 3996063
description:
Jan  3 14:57:23 host2 sshd[1512705]: Disconnected from invalid user justin 189.217.130.86 port 20981 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.115.18.231
country_id: 2750405
description:
Jan  3 14:57:24 host2 sshd[1512714]: Disconnected from invalid user username 40.115.18.231 port 50148 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 40.115.18.231
country_id: 2750405
description:
Jan  3 14:58:00 host2 sshd[1513452]: Disconnected from invalid user buser 40.115.18.231 port 35612 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 161.118.238.65
country_id: 1880251
description:
Jan  3 14:58:10 host2 pure-ftpd[1513674]: (?@161.118.238.65) [INFO] New connection from 161.118.238.65


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 161.118.238.65
country_id: 1880251
description:
Jan  3 14:58:15 host2 pure-ftpd[1513777]: (?@161.118.238.65) [INFO] New connection from 161.118.238.65


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.61.63
country_id: 1861060
description:
Jan  3 14:59:42 host2 sshd[1515324]: Disconnected from invalid user console 118.193.61.63 port 44212 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.39.127
country_id: 1819730
description:
Jan  3 14:59:57 host2 sshd[1515607]: Disconnected from invalid user rich 118.193.39.127 port 33980 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.217.130.86
country_id: 3996063
description:
Jan  3 15:00:35 host2 sshd[1516652]: Disconnected from invalid user console 189.217.130.86 port 46649 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.61.63
country_id: 1861060
description:
Jan  3 15:01:03 host2 sshd[1517201]: Disconnected from invalid user coder 118.193.61.63 port 17014 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.81.211.221
country_id: 6252001
description:
2026-01-03 15:01:06 dovecot_login authenticator failed for H=vps-45907be8.vps.ovh.us [51.81.211.221]:50132: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.39.127
country_id: 1819730
description:
Jan  3 15:00:32 host2 sshd[1516571]: Disconnected from invalid user test 118.193.39.127 port 34458 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.115.18.231
country_id: 2750405
description:
Jan  3 15:01:29 host2 sshd[1517686]: Disconnected from invalid user low 40.115.18.231 port 33080 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.39.127
country_id: 1819730
description:
Jan  3 15:01:42 host2 sshd[1517925]: Disconnected from invalid user justin 118.193.39.127 port 36060 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.217.130.86
country_id: 3996063
description:
Jan  3 15:01:10 host2 sshd[1517356]: Disconnected from invalid user coder 189.217.130.86 port 52910 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.39.127
country_id: 1819730
description:
Jan  3 15:02:51 host2 sshd[1519307]: Disconnected from invalid user console 118.193.39.127 port 45206 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.0.68
country_id: 1643084
description:
Jan  3 15:02:49 host2 sshd[1519178]: Disconnected from invalid user rich 103.186.0.68 port 44316 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.186.0.68
country_id: 1643084
description:
Jan  3 15:03:42 host2 sshd[1520350]: Disconnected from invalid user low 103.186.0.68 port 38054 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 179.0.252.73
country_id: 3865483
description:
Jan  3 15:04:40 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 9 secs): user=<>, rip=179.0.252.73, lip=66.85.158.91, session=</Q8HiXhH9eKzAPxJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 15:04:49 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<0V9viXhH4Ipn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.190.167.214
country_id: 3865483
description:
Jan  3 15:05:35 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<charanaw>, method=PLAIN, rip=186.190.167.214, lip=66.85.158.91, TLS, session=<xQAAi3hHW+i6vqfW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.109.178.8
country_id: 1269750
description:
Jan  3 15:05:11 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=103.109.178.8, lip=66.85.158.91, TLS, session=<RovDiXhH58VnbbII>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.39.127
country_id: 1819730
description:
Jan  3 15:05:20 host2 sshd[1522638]: Disconnected from invalid user dev 118.193.39.127 port 47216 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.32
country_id: 1733045
description:
2026-01-03 15:07:31 dovecot_login authenticator failed for H=([49.124.151.32]) [49.124.151.32]:56386: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 15:07:34 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<V/pEk3hHdKkyBvlc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.38
country_id: 1269750
description:
2026-01-03 15:07:45 dovecot_login authenticator failed for H=(nsg-static-153.157.72.182.airtel.in) [182.95.229.38]:34412: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2026-01-03 15:10:06 dovecot_login authenticator failed for H=(nsg-static-217.97.72.182.airtel.in) [182.95.228.194]:52796: 535 Incorrect authentication data (set_id=contact@kiriaswanu.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  3 15:12:12 host2 pure-ftpd[1530538]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.64.93.161
country_id: 2077456
description:
2026-01-03 15:16:14 dovecot_login authenticator failed for H=115-64-93-161.tpgi.com.au [115.64.93.161]:45329: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.134.120
country_id: 1269750
description:
2026-01-03 15:16:32 dovecot_login authenticator failed for H=(abts-mum-static-120.134.179.122.airtelbroadband.in) [122.179.134.120]:33744: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.126.105.42
country_id: 3469034
description:
2026-01-03 15:22:27 dovecot_login authenticator failed for H=187-126-105-42.user.vtal.net.br (187-126-105-145.user.vtal.net.br) [187.126.105.42]:55768: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 15:22:36 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<LoYJyXhHvMVyB6Oa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.186.54.65
country_id: 298795
description:
2026-01-03 15:22:45 dovecot_login authenticator failed for H=([78.186.54.65]) [78.186.54.65]:43528: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.20
country_id: 241170
description:
Jan  3 15:23:49 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.20, lip=66.85.158.91, session=<v5JYzXhHnLTE+2YU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.96.29.14
country_id: 1269750
description:
2026-01-03 15:24:56 dovecot_login authenticator failed for H=(abts-kk-static-182.209.166.122.airtelbroadband.in) [14.96.29.14]:58764: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.5.135
country_id: 798544
description:
2026-01-03 15:25:17 dovecot_login authenticator failed for H=89-67-5-135.dynamic.play.pl [89.67.5.135]:36199: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.10
country_id: 241170
description:
Jan  3 15:29:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.10, lip=66.85.158.91, session=<ViA74XhHNp7E+2YK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.212
country_id: 1819730
description:
2026-01-03 15:32:47 dovecot_login authenticator failed for H=212.42.246.220.static.netvigator.com [220.246.42.212]:53591: 535 Incorrect authentication data (set_id=postmaster@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.211.220.203
country_id: 2661886
description:
2026-01-03 15:32:55 dovecot_login authenticator failed for H=31-211-220-203.customers.ownit.se [31.211.220.203]:58456: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
country_id: 6252001
description:
2026-01-03 15:34:13 dovecot_login authenticator failed for H=([67.213.230.122]) [67.213.230.122]:58439: 535 Incorrect authentication data (set_id=postmaster@kiriaswanu.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.23.160.197
country_id: 6252001
description:
Jan  3 15:36:17 host2 sshd[1558251]: Disconnected from invalid user user 198.23.160.197 port 40190 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.93.168.36
country_id: 298795
description:
Jan  3 15:37:08 host2 sshd[1559422]: Disconnected from invalid user angela 45.93.168.36 port 19302 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.159.34.135
country_id: 3017382
description:
Jan  3 15:38:59 host2 sshd[1561692]: Disconnected from invalid user test1 51.159.34.135 port 61444 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.93.168.36
country_id: 298795
description:
Jan  3 15:39:06 host2 sshd[1561816]: Disconnected from invalid user gitlab-runner 45.93.168.36 port 3740 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.93.168.36
country_id: 298795
description:
Jan  3 15:38:28 host2 sshd[1560992]: Disconnected from invalid user roman 45.93.168.36 port 54544 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.90.94
country_id: 1269750
description:
2026-01-03 15:39:43 dovecot_login authenticator failed for H=([125.20.183.201]) [27.123.90.94]:45202: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.225.99.151
country_id: 2921044
description:
Jan  3 15:39:44 host2 sshd[1562450]: Disconnected from invalid user admin 64.225.99.151 port 36114 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.119
country_id: 1819730
description:
2026-01-03 15:39:55 dovecot_login authenticator failed for H=(m121-202-206-119.smartone.com) [121.202.206.119]:50210: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.235.248.73
country_id: 3469034
description:
2026-01-03 15:40:45 dovecot_login authenticator failed for H=(186.235.248.73.girardi-rs.com.br) [186.235.248.73]:44282: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.225.99.151
country_id: 2921044
description:
Jan  3 15:40:52 host2 sshd[1563793]: Disconnected from invalid user github 64.225.99.151 port 46142 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.18.99.38
country_id: 1269750
description:
2026-01-03 15:40:30 dovecot_login authenticator failed for H=([182.95.20.225]) [125.18.99.38]:44312: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.159.34.135
country_id: 3017382
description:
Jan  3 15:41:13 host2 sshd[1564138]: Disconnected from invalid user temp 51.159.34.135 port 19918 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.225.99.151
country_id: 2921044
description:
Jan  3 15:41:26 host2 sshd[1564394]: Disconnected from invalid user admin 64.225.99.151 port 60084 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.23.160.197
country_id: 6252001
description:
Jan  3 15:42:49 host2 sshd[1565817]: Disconnected from invalid user test 198.23.160.197 port 46656 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.225.99.151
country_id: 2921044
description:
Jan  3 15:43:33 host2 sshd[1566466]: Disconnected from invalid user roman 64.225.99.151 port 40618 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.23.160.197
country_id: 6252001
description:
Jan  3 15:43:53 host2 sshd[1566837]: Disconnected from invalid user proxyuser 198.23.160.197 port 52996 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.159.34.135
country_id: 3017382
description:
Jan  3 15:43:18 host2 sshd[1566248]: Disconnected from invalid user user 51.159.34.135 port 53060 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.140.19.22
country_id: 1269750
description:
Jan  3 15:44:27 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=103.140.19.22, lip=66.85.158.91, session=<ZacmF3lHatJnjBMW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.36
country_id: 1733045
description:
2026-01-03 15:46:05 dovecot_login authenticator failed for H=([49.124.153.36]) [49.124.153.36]:38418: 535 Incorrect authentication data (set_id=sales@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 15:45:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<OTJUGnlH9s4yBvlc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.230.86.50
country_id: 6252001
description:
2026-01-03 15:46:21 dovecot_plain authenticator failed for H=c-73-230-86-50.hsd1.pa.comcast.net (knitriped) [73.230.86.50]:51402: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2026-01-03 15:46:25 dovecot_login authenticator failed for H=([125.20.245.182]) [125.20.245.182]:37756: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.214.49.194
country_id: 6252001
description:
2026-01-03 15:46:39 dovecot_login authenticator failed for H=wsip-72-214-49-194.hr.hr.cox.net [72.214.49.194]:34400: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.85
country_id: 2186224
description:
2026-01-03 15:46:51 dovecot_login authenticator failed for H=([121.73.163.85]) [121.73.163.85]:54996: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.168
country_id: 2186224
description:
2026-01-03 15:46:23 dovecot_login authenticator failed for H=([121.73.163.168]) [121.73.163.168]:36466: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.249.19.34
country_id: 1643084
description:
2026-01-03 15:46:48 dovecot_login authenticator failed for H=([103.249.19.34]) [103.249.19.34]:52032: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.56.228.149
country_id: 6252001
description:
2026-01-03 15:46:48 dovecot_login authenticator failed for H=ool-6038e495.static.optonline.net [96.56.228.149]:35652: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 15:47:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<8cv3IHlHTMNn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.21
country_id: 241170
description:
Jan  3 15:48:02 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.21, lip=66.85.158.91, session=<3b78I3lHyLbE+2YV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.19
country_id: 241170
description:
Jan  3 15:49:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.19, lip=66.85.158.91, session=<2RfCKHlHWOvE+2YT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.22.204.23
country_id: 1210997
description:
2026-01-03 15:50:01 dovecot_login authenticator failed for H=([202.22.204.23]) [202.22.204.23]:40822: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.23
country_id: 241170
description:
Jan  3 15:53:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.23, lip=66.85.158.91, session=<7KsnNnlHQILE+2YX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.218.247.234
country_id: 1522867
description:
2026-01-03 15:53:20 dovecot_login authenticator failed for H=([89.218.247.234]) [89.218.247.234]:50506: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.203.43
country_id: 2542007
description:
2026-01-03 15:53:38 dovecot_login authenticator failed for H=([105.73.203.43]) [105.73.203.43]:50017: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.30.86.18
country_id: 1522867
description:
2026-01-03 15:53:47 dovecot_login authenticator failed for H=([147.30.86.18]) [147.30.86.18]:38059: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.22
country_id: 241170
description:
Jan  3 16:01:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.22, lip=66.85.158.91, session=<3HqqU3lHxrTE+2YW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.23.140
country_id: 3144096
description:
2026-01-03 16:04:20 dovecot_login authenticator failed for H=(cm-178.232.23.140.get.no) [178.232.23.140]:45503: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 16:04:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<ly5iXnlHQtNyB6Oa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-03 16:06:18 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:59739: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.80.9
country_id: 3144096
description:
2026-01-03 16:10:29 dovecot_login authenticator failed for H=([178.232.80.9]) [178.232.80.9]:57658: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.112.28.181
country_id: 6252001
description:
2026-01-03 16:10:43 dovecot_login authenticator failed for H=ool-45701cb5.dyn.optonline.net [69.112.28.181]:47963: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 16:11:26 host2 sshd[1598196]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.90
country_id: 1149361
description:
2026-01-03 16:11:15 dovecot_login authenticator failed for H=([149.54.15.90]) [149.54.15.90]:52686: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  3 16:17:11 host2 pure-ftpd[1604303]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.18
country_id: 1269750
description:
2026-01-03 16:23:10 dovecot_login authenticator failed for H=([182.78.64.18]) [182.78.64.18]:38458: 535 Incorrect authentication data (set_id=test@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 16:23:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<fHg9onlHdrUyBvlc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2026-01-03 16:23:22 dovecot_login authenticator failed for H=([128.185.39.145]) [128.185.214.78]:36668: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.50
country_id: 6252001
description:
Jan  3 16:28:45 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.50, lip=66.85.158.91, TLS: Connection closed, session=<xjW4tXlHVJOnXpIy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 16:29:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<YLsFuXlHZoRn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.158.216
country_id: 2510769
description:
2026-01-03 16:31:13 dovecot_login authenticator failed for H=([207.188.158.216]) [207.188.158.216]:55615: 535 Incorrect authentication data (set_id=contact@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.112.178.133
country_id: 3469034
description:
2026-01-03 16:31:23 dovecot_login authenticator failed for H=(mvx-187-16-97-90.mundivox.com) [189.112.178.133]:47066: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.158.145.31
country_id: 2510769
description:
2026-01-03 16:32:01 dovecot_login authenticator failed for H=31.145.158.146.dynamic.jazztel.es [146.158.145.31]:38597: 535 Incorrect authentication data (set_id=postmaster@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.15
country_id: 1733045
description:
2026-01-03 16:34:09 dovecot_login authenticator failed for H=([49.124.151.15]) [49.124.151.15]:44014: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.16.55
country_id: 3469034
description:
2026-01-03 16:33:52 dovecot_login authenticator failed for H=(177-174-16-55.user.vivozap.com.br) [177.174.16.55]:60470: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.50.165.203
country_id: 6252001
description:
[2026-01-03 16:34:25 +0530] info [cpaneld] 209.50.165.203 - simpleengineerin "GET /execute/Variables/get_user_information HTTP/1.1" FAILED LOGIN cpaneld: User simpleengineerin has their account suspended. Login blocked.


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 16:38:55 host2 sshd[1627787]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.118.112.230
country_id: 6252001
description:
2026-01-03 16:38:37 dovecot_login authenticator failed for H=syn-070-118-112-230.biz.spectrum.com [70.118.112.230]:40044: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2026-01-03 16:44:25 dovecot_plain authenticator failed for H=c-71-224-169-28.hsd1.pa.comcast.net (dectidares) [71.224.169.28]:37862: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.195.66
country_id: 1269750
description:
2026-01-03 16:46:38 dovecot_login authenticator failed for H=([128.185.169.25]) [125.19.195.66]:52120: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.200.166
country_id: 149590
description:
2026-01-03 16:46:51 dovecot_login authenticator failed for H=(166.200-59-41.ttcl.co.tz) [41.59.200.166]:59389: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 16:47:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<GXaD93lHPOByB6Oa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.237.107
country_id: 3144096
description:
2026-01-03 16:52:31 dovecot_login authenticator failed for H=(cm-178.232.237.107.get.no) [178.232.237.107]:39140: 535 Incorrect authentication data (set_id=office@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.50.252
country_id: 953987
description:
Jan  3 16:54:48 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=102.129.50.252, lip=66.85.158.91, TLS, session=<F0HKEXpHX9RmgTL8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.130.116
country_id: 3469034
description:
Jan  3 16:54:15 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=191.53.130.116, lip=66.85.158.91, TLS, session=<9cq1D3pHUMC/NYJ0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.19.12.103
country_id: 2635167
description:
2026-01-03 16:54:39 dovecot_login authenticator failed for H=cpc122100-bmly10-2-0-cust102.2-3.cable.virginm.net [82.19.12.103]:43440: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.178.22
country_id: 298795
description:
2026-01-03 16:54:41 dovecot_login authenticator failed for H=([188.59.178.22]) [188.59.178.22]:39852: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.12.132.63
country_id: 294640
description:
2026-01-03 16:56:16 dovecot_login authenticator failed for H=([176.12.132.63]) [176.12.132.63]:49442: 535 Incorrect authentication data (set_id=office@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.146.144
country_id: 1819730
description:
2026-01-03 16:56:27 dovecot_login authenticator failed for H=(m121-202-146-144.smartone.com) [121.202.146.144]:44487: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.236.145.128
country_id: 6252001
description:
2026-01-03 17:00:04 dovecot_login authenticator failed for H=(node12.vindb.org) [104.236.145.128]:42923: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.107.158
country_id: 226074
description:
2026-01-03 16:59:45 dovecot_login authenticator failed for H=([196.0.107.158]) [196.0.107.158]:37319: 535 Incorrect authentication data (set_id=office@epid.gov.lk)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.106
country_id: 2635167
description:
Jan  3 17:01:00 host2 dovecot[1170291]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.106, lip=66.85.158.91, TLS, session=<HEwLKXpHe7hX7LBq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.98
country_id: 1269750
description:
2026-01-03 17:02:38 dovecot_login authenticator failed for H=([128.185.253.98]) [128.185.253.98]:33374: 535 Incorrect authentication data (set_id=sales@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.188.140
country_id: 3996063
description:
2026-01-03 17:02:57 dovecot_login authenticator failed for H=([140.84.188.140]) [140.84.188.140]:54954: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.162
country_id: 2993457
description:
Jan  3 17:02:27 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.162, lip=66.85.158.91, session=<ghg6LnpHV//CpRCi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.225.186
country_id: 1269750
description:
2026-01-03 17:05:30 dovecot_login authenticator failed for H=([203.145.139.81]) [128.185.225.186]:50458: 535 Incorrect authentication data (set_id=test@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.52.217.71
country_id: 3686110
description:
2026-01-03 17:05:42 dovecot_login authenticator failed for H=(static-ip-cr18152021771.cable.net.co) [181.52.217.71]:53684: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.162.191
country_id: 3144096
description:
2026-01-03 17:06:59 dovecot_login authenticator failed for H=(cm-178.232.162.191.get.no) [178.232.162.191]:56248: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.182.125.210
country_id: 6252001
description:
2026-01-03 17:10:07 dovecot_plain authenticator failed for H=(lulateate) [12.182.125.210]:49109: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.118.215.192
country_id: 3865483
description:
2026-01-03 17:21:22 dovecot_login authenticator failed for H=(red.138.118.215.192.ssservicios.com.ar) [138.118.215.192]:57036: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.168.9.94
country_id: 3996063
description:
Jan  3 17:21:50 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=201.168.9.94, lip=66.85.158.91, TLS, session=<EBx6cnpHLc3JqAle>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.237.82.103
country_id: 3469034
description:
Jan  3 17:22:09 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<charanaw>, method=PLAIN, rip=200.237.82.103, lip=66.85.158.91, TLS, session=<H0Cmc3pH3a3I7VJn>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  3 17:22:27 host2 pure-ftpd[1676585]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.158
country_id: 1269750
description:
2026-01-03 17:24:07 dovecot_login authenticator failed for H=(dsl-del-065.26.246.61.airtelbroadband.in) [182.95.230.158]:43234: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2026-01-03 17:23:50 dovecot_login authenticator failed for H=([128.185.18.217]) [122.185.176.126]:51878: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2026-01-03 17:25:06 dovecot_plain authenticator failed for H=c-68-82-141-145.hsd1.pa.comcast.net (dersipting) [68.82.141.145]:59652: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.92.243.14
country_id: 6252001
description:
Jan  3 17:26:35 host2 sshd[1681429]: Disconnected from invalid user proxyuser 91.92.243.14 port 50644 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.125.122
country_id: 1269750
description:
2026-01-03 17:27:01 dovecot_login authenticator failed for H=(nsg-static-233.166.76.182-airtel.com) [182.95.125.122]:33678: 535 Incorrect authentication data (set_id=office@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.188.10
country_id: 3144096
description:
2026-01-03 17:27:14 dovecot_login authenticator failed for H=(cm-178.232.188.10.get.no) [178.232.188.10]:39594: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.92.243.14
country_id: 6252001
description:
Jan  3 17:27:45 host2 sshd[1682635]: Disconnected from invalid user ubuntu 91.92.243.14 port 43406 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 91.92.243.14
country_id: 6252001
description:
Jan  3 17:31:00 host2 sshd[1685782]: Disconnected from invalid user rehan 91.92.243.14 port 44518 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.79.195
country_id: 337996
description:
2026-01-03 17:32:05 dovecot_login authenticator failed for H=([213.55.79.199]) [213.55.79.195]:37096: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.145.142.243
country_id: 1269750
description:
2026-01-03 17:32:32 dovecot_login authenticator failed for H=([203.145.142.243]) [203.145.142.243]:37722: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.106
country_id: 1269750
description:
2026-01-03 17:37:11 dovecot_login authenticator failed for H=([152.52.244.106]) [152.52.244.106]:33198: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.29.26
country_id: 3144096
description:
2026-01-03 17:37:24 dovecot_login authenticator failed for H=(cm-178.232.29.26.get.no) [178.232.29.26]:47719: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.178.70
country_id: 1269750
description:
2026-01-03 17:37:27 dovecot_login authenticator failed for H=([182.79.95.167]) [122.185.178.70]:40668: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.234.184.158
country_id: 357994
description:
2026-01-03 17:37:34 dovecot_plain authenticator failed for H=(648A5DR0V5VM) [41.234.184.158]:65087: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  3 17:38:14 host2 sshd[1692830]: Disconnected from invalid user admin 2.57.121.112 port 14986 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.62.126
country_id: 1269750
description:
2026-01-03 17:46:20 dovecot_login authenticator failed for H=([182.95.62.126]) [182.95.62.126]:50988: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.58.211.64
country_id: 2635167
description:
Jan  3 17:47:51 host2 sshd[1703695]: Disconnected from invalid user samuel 143.58.211.64 port 58516 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.199.95.142
country_id: 3469034
description:
Jan  3 17:48:48 host2 sshd[1704568]: Disconnected from invalid user lorenza 35.199.95.142 port 52074 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.236.182.231
country_id: 2661886
description:
Jan  3 17:49:54 host2 sshd[1706067]: Disconnected from invalid user sinusbot1 81.236.182.231 port 44500 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.199.95.142
country_id: 3469034
description:
Jan  3 17:50:28 host2 sshd[1707188]: Disconnected from invalid user merlin 35.199.95.142 port 53546 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.199.95.142
country_id: 3469034
description:
Jan  3 17:51:51 host2 sshd[1708634]: Disconnected from invalid user aaron 35.199.95.142 port 52828 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.151.249
country_id: 1819730
description:
2026-01-03 17:52:04 dovecot_login authenticator failed for H=249.151.48.116.static.netvigator.com [116.48.151.249]:60065: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.58.211.64
country_id: 2635167
description:
Jan  3 17:52:07 host2 sshd[1708963]: Disconnected from invalid user testtest 143.58.211.64 port 41166 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.236.182.231
country_id: 2661886
description:
Jan  3 17:52:34 host2 sshd[1709564]: Disconnected from invalid user engineering 81.236.182.231 port 37812 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.58.211.64
country_id: 2635167
description:
Jan  3 17:52:39 host2 sshd[1709666]: Disconnected from invalid user ina 143.58.211.64 port 55862 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 143.58.211.64
country_id: 2635167
description:
Jan  3 17:53:12 host2 sshd[1710417]: Disconnected from invalid user luis 143.58.211.64 port 45740 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2026-01-03 17:53:54 dovecot_plain authenticator failed for H=c-24-15-216-41.hsd1.il.comcast.net (boogaw) [24.15.216.41]:33892: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.236.182.231
country_id: 2661886
description:
Jan  3 17:54:23 host2 sshd[1712090]: Disconnected from invalid user soporte 81.236.182.231 port 45518 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.197.178
country_id: 1269750
description:
2026-01-03 17:55:39 dovecot_login authenticator failed for H=([128.185.197.178]) [128.185.197.178]:40734: 535 Incorrect authentication data (set_id=postmaster@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.52.217.71
country_id: 3686110
description:
2026-01-03 17:55:53 dovecot_login authenticator failed for H=(static-ip-cr18152021771.cable.net.co) [181.52.217.71]:48584: 535 Incorrect authentication data (set_id=postmaster@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.251.240
country_id: 290557
description:
2026-01-03 17:56:22 dovecot_login authenticator failed for H=([94.207.251.240]) [94.207.251.240]:50295: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.140.38.110
country_id: 1269750
description:
2026-01-03 17:58:44 dovecot_login authenticator failed for H=(202.140.38.110.convergentindia.com) [202.140.38.110]:46970: 535 Incorrect authentication data (set_id=contact@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.33.130
country_id: 1149361
description:
2026-01-03 17:58:53 dovecot_login authenticator failed for H=([149.54.33.130]) [149.54.33.130]:45183: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.68.37.25
country_id: 2661886
description:
2026-01-03 17:59:43 dovecot_plain authenticator failed for H=78-68-37-25-no2560.tbcn.telia.com (readaly) [78.68.37.25]:54393: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-01-03 17:59:45 dovecot_login authenticator failed for H=([197.219.228.242]) [197.219.228.242]:56910: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2026-01-03 17:59:33 dovecot_login authenticator failed for H=(138.219.244.10.static.softdados.net) [177.128.209.48]:44450: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.248.111.238
country_id: 6252001
description:
2026-01-03 17:59:39 dovecot_plain authenticator failed for H=(unconblent) [38.248.111.238]:56091: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.149.153.106
country_id: 3175395
description:
2026-01-03 18:00:16 dovecot_plain authenticator failed for H=(ceneuric) [88.149.153.106]:45635: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-03 18:00:18 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (aphorcid) [87.103.126.54]:49827: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 18:03:06 host2 sshd[1722654]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.161
country_id: 2993457
description:
Jan  3 18:08:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.161, lip=66.85.158.92, session=<zNSPGXtH9v7CpRCh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.123
country_id: 6252001
description:
Jan  3 18:11:37 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.123, lip=66.85.158.91, TLS: Connection closed, session=<OV+YJXtHgAdChJl7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.188.252.208
country_id: 6252001
description:
2026-01-03 18:11:45 dovecot_plain authenticator failed for H=c-73-188-252-208.hsd1.pa.comcast.net (plogly) [73.188.252.208]:53116: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.200.217.230
country_id: 3686110
description:
Jan  3 18:14:59 host2 sshd[1736080]: Disconnected from invalid user sameer 152.200.217.230 port 53783 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.95.132.54
country_id: 6252001
description:
Jan  3 18:15:38 host2 sshd[1736968]: Disconnected from invalid user nimesh 23.95.132.54 port 43144 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.200.217.230
country_id: 3686110
description:
Jan  3 18:16:06 host2 sshd[1737404]: Disconnected from invalid user adam 152.200.217.230 port 33648 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.200.217.230
country_id: 3686110
description:
Jan  3 18:16:49 host2 sshd[1738098]: Disconnected from invalid user kacper 152.200.217.230 port 39433 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.200.217.230
country_id: 3686110
description:
Jan  3 18:17:26 host2 sshd[1738760]: Disconnected from invalid user ubuntu 152.200.217.230 port 45217 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.42.14.196
country_id: 3469034
description:
Jan  3 18:18:58 host2 sshd[1740308]: Disconnected from invalid user app 206.42.14.196 port 60668 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.42.14.196
country_id: 3469034
description:
Jan  3 18:19:38 host2 sshd[1740983]: Disconnected from invalid user ubuntu 206.42.14.196 port 58986 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.8.166.171
country_id: 3469034
description:
Jan  3 18:19:41 host2 sshd[1741031]: Disconnected from invalid user deploy 177.8.166.171 port 60020 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 206.42.14.196
country_id: 3469034
description:
Jan  3 18:20:22 host2 sshd[1742051]: Disconnected from invalid user student1 206.42.14.196 port 55822 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.178.214
country_id: 1643084
description:
Jan  3 18:20:41 host2 sshd[1742367]: Disconnected from invalid user ts 103.193.178.214 port 57378 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.95.132.54
country_id: 6252001
description:
Jan  3 18:21:10 host2 sshd[1742948]: Disconnected from invalid user user2 23.95.132.54 port 44362 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.187.240
country_id: 3144096
description:
2026-01-03 18:22:06 dovecot_login authenticator failed for H=(cm-84.213.187.240.get.no) [84.213.187.240]:50508: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.42.14.196
country_id: 3469034
description:
Jan  3 18:21:41 host2 sshd[1743654]: Disconnected from invalid user new 206.42.14.196 port 38248 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.241.128.197
country_id: 6252001
description:
2026-01-03 18:21:50 dovecot_login authenticator failed for H=(syn-067-241-128-197.res.spectrum.com) [67.241.128.197]:33558: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 23.95.132.54
country_id: 6252001
description:
Jan  3 18:23:01 host2 sshd[1744982]: Disconnected from invalid user student 23.95.132.54 port 51336 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.8.166.171
country_id: 3469034
description:
Jan  3 18:23:06 host2 sshd[1745070]: Disconnected from invalid user sftpuser 177.8.166.171 port 55702 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.178.214
country_id: 1643084
description:
Jan  3 18:23:31 host2 sshd[1745590]: Disconnected from invalid user dd 103.193.178.214 port 38432 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  3 18:23:54 host2 sshd[1746028]: Disconnected from invalid user user 2.57.121.25 port 17593 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.178.214
country_id: 1643084
description:
Jan  3 18:24:26 host2 sshd[1746677]: Disconnected from invalid user radio 103.193.178.214 port 39516 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.8.166.171
country_id: 3469034
description:
Jan  3 18:24:38 host2 sshd[1746948]: Disconnected from invalid user nimesh 177.8.166.171 port 40702 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.8.166.171
country_id: 3469034
description:
Jan  3 18:25:30 host2 sshd[1747971]: Disconnected from invalid user ubuntu 177.8.166.171 port 57276 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  3 18:26:38 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: Connection closed, session=<0ttIW3tH2NcDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  3 18:27:48 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: Connection closed, session=<eGl8X3tHbtgDgmBb>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  3 18:29:39 host2 pure-ftpd[1752914]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 18:30:51 host2 sshd[1754326]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 13.74.233.64
country_id: 2963597
description:
Jan  3 18:30:48 host2 sshd[1754272]: Disconnected from invalid user couchdb 13.74.233.64 port 33318 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  3 18:31:30 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<RgO2bHtHtOkDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.227.252.2
country_id: 1269750
description:
2026-01-03 18:32:10 dovecot_login authenticator failed for H=(abts-tn-dynamic-2.252.227.110.airtelbroadband.in) [110.227.252.2]:41162: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 13.74.233.64
country_id: 2963597
description:
Jan  3 18:31:20 host2 sshd[1754774]: Disconnected from invalid user safeuser 13.74.233.64 port 58114 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  3 18:33:50 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<6lsRdXtHbLsDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  3 18:34:27 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS, session=<NSpHd3tHTtMDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  3 18:36:08 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: Connection closed, session=<0EJBfXtH5MsDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Jan  3 18:36:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<XHSlf3tHFOQrpAFm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  3 18:37:01 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<sPFrgHtHRNoDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 4.8.250.134
country_id: 6252001
description:
2026-01-03 18:38:06 dovecot_login authenticator failed for H=([4.8.250.134]) [4.8.250.134]:35274: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Jan  3 18:38:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shop@essenceceylontea.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=</qhYhHtHMJq2uHYF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  3 18:37:43 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<4wv1gntHAJ0DgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  3 18:39:49 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<XuhyintHZrsDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  3 18:40:22 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS, session=<041qjHtHDO4DgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.76.142
country_id: 1269750
description:
2026-01-03 18:41:01 dovecot_login authenticator failed for H=([128.185.213.82]) [182.78.76.142]:52086: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.147.131.177
country_id: 1814991
description:
Jan  3 18:41:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=8.147.131.177, lip=66.85.158.91, session=<A8OHkXtHBKgIk4Ox>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.223.83.53
country_id: 2510769
description:
Jan  3 18:45:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=82.223.83.53, lip=66.85.158.91, session=<BD7snHtHisJS31M1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 203.153.46.246
country_id: 1269750
description:
Jan  3 18:46:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=203.153.46.246, lip=66.85.158.91, session=<y7kQoXtHOpLLmS72>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.225.40.153
country_id: 6252001
description:
Jan  3 18:46:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=64.225.40.153, lip=66.85.158.91, session=<URFLontHSJdA4SiZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.83.135.122
country_id: 6251999
description:
2026-01-03 18:48:43 dovecot_login authenticator failed for H=([24.83.135.122]) [24.83.135.122]:59778: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  3 18:48:35 host2 sshd[1774389]: Disconnected from invalid user admin 2.57.121.112 port 26049 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.105.156.165
country_id: 3923057
description:
Jan  3 18:49:36 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=200.105.156.165, lip=66.85.158.91, session=<U0BVrXtHSsrIaZyl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  3 18:50:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@venee.lk>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<W/RRr3tHSL4IijoY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.181.196.96
country_id: 3469034
description:
2026-01-03 18:50:21 dovecot_login authenticator failed for H=(96.196.181.45.datasysteminfor.com.br) [45.181.196.96]:36434: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.212.54
country_id: 99237
description:
2026-01-03 18:50:38 dovecot_login authenticator failed for H=([62.201.212.54]) [62.201.212.54]:42430: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.166.54
country_id: 1269750
description:
2026-01-03 18:51:45 dovecot_login authenticator failed for H=([125.19.95.209]) [122.187.166.54]:58086: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  3 18:52:16 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<postfix@lankaherbalsolutions.com>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<LKzMtntHylSuijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 68.183.92.114
country_id: 1269750
description:
Jan  3 18:51:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=68.183.92.114, lip=66.85.158.91, session=<UjcEtHtH/GNEt1xy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.227.252.2
country_id: 1269750
description:
2026-01-03 18:51:34 dovecot_login authenticator failed for H=(abts-tn-dynamic-2.252.227.110.airtelbroadband.in) [110.227.252.2]:59282: 535 Incorrect authentication data (set_id=contact@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.210
country_id: 1269750
description:
2026-01-03 18:53:17 dovecot_login authenticator failed for H=(nsg-corporate-49.218.186.122.airtel.in) [103.251.31.210]:44086: 535 Incorrect authentication data (set_id=postmaster@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.126.105.42
country_id: 3469034
description:
2026-01-03 18:53:34 dovecot_login authenticator failed for H=187-126-105-42.user.vtal.net.br (187-126-105-145.user.vtal.net.br) [187.126.105.42]:57985: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Jan  3 18:54:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@nsteeleng.com>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<tmZRwHtHKuFAF6S9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.140.19.22
country_id: 1269750
description:
Jan  3 18:56:40 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=103.140.19.22, lip=66.85.158.91, session=<lJuUxntHorBnjBMW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 97.74.84.186
country_id: 1880251
description:
Jan  3 18:56:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=97.74.84.186, lip=66.85.158.91, session=<QJljx3tHaIZhSlS6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.42
country_id: 1733045
description:
2026-01-03 19:01:39 dovecot_login authenticator failed for H=([49.124.151.42]) [49.124.151.42]:34520: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.63.110
country_id: 3144096
description:
2026-01-03 19:01:47 dovecot_login authenticator failed for H=(cm-84.214.63.110.get.no) [84.214.63.110]:58063: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.61
country_id: 1269750
description:
Jan  3 19:05:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=66.116.199.61, lip=66.85.158.91, session=<hy5b5HtHDMpCdMc9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.61.22
country_id: 3144096
description:
2026-01-03 19:05:09 dovecot_login authenticator failed for H=(cm-178.232.61.22.get.no) [178.232.61.22]:59636: 535 Incorrect authentication data (set_id=test@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2026-01-03 19:05:47 dovecot_login authenticator failed for H=(netcomafrica.com) [41.219.149.74]:30485: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.135.208.32
country_id: 1861060
description:
2026-01-03 19:06:05 dovecot_login authenticator failed for H=dsl-212-135-208-32.dsl.easynet.co.uk [212.135.208.32]:40187: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.123.45.2
country_id: 1269750
description:
2026-01-03 19:05:28 dovecot_login authenticator failed for H=([103.123.45.2]) [103.123.45.2]:40376: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  3 19:07:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<gJ8u7ntHmswv/AU1>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.35.225.197
country_id: 3996063
description:
[2026-01-03 19:07:46 +0530] info [cpaneld] 38.35.225.197 - lezzarotech "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.210.147.41
country_id: 1819730
description:
Jan  3 19:07:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<shop@seyawin.com>, method=PLAIN, rip=8.210.147.41, lip=66.85.158.91, session=<HxSa7ntHJqUI0pMp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.148.29.174
country_id: 1643084
description:
Jan  3 19:08:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=103.148.29.174, lip=66.85.158.91, session=<bpqO8HtHstZnlB2u>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  3 19:09:26 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@mathsmotorcysle.xyz>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<BMBA9HtHvpUFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  3 19:10:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<z1ud9ntHmqAz0msW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.118.3
country_id: 3865483
description:
2026-01-03 19:11:10 dovecot_login authenticator failed for H=([167.250.118.3]) [167.250.118.3]:57439: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.215.132
country_id: 3144096
description:
2026-01-03 19:10:49 dovecot_login authenticator failed for H=(cm-84.210.215.132.get.no) [84.210.215.132]:42630: 535 Incorrect authentication data (set_id=postmaster@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  3 19:12:04 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@venee.lk>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<4nOg/XtHyJAvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Jan  3 19:12:53 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<0XyMAHxHir6nYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  3 19:12:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=</Ae3/ntH2IdIpyJ4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.16.99
country_id: 3144096
description:
2026-01-03 19:14:44 dovecot_login authenticator failed for H=(cm-178.232.16.99.get.no) [178.232.16.99]:56911: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.144.61.200
country_id: 6252001
description:
Jan  3 19:15:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=162.144.61.200, lip=66.85.158.91, session=<Sn9AC3xHHIqikD3I>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.140.19.22
country_id: 1269750
description:
Jan  3 19:16:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=103.140.19.22, lip=66.85.158.91, session=<c0bfDnxHQK5njBMW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.247
country_id: 1269750
description:
2026-01-03 19:18:07 dovecot_login authenticator failed for H=(nsg-corporate-247.229.187.122.airtel.in) [122.187.229.247]:42787: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.162.191
country_id: 3144096
description:
2026-01-03 19:17:34 dovecot_login authenticator failed for H=(cm-178.232.162.191.get.no) [178.232.162.191]:46300: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 111.223.189.73
country_id: 1227603
description:
Jan  3 19:17:35 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=111.223.189.73, lip=66.85.158.91, TLS, session=<Gc99EXxHFZtv371J>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.129.217.70
country_id: 1269750
description:
2026-01-03 19:17:56 dovecot_login authenticator failed for H=([203.129.217.70]) [203.129.217.70]:49279: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  3 19:19:29 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@venee.lk>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<f0Q2GHxHrJUv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 97.74.84.186
country_id: 1880251
description:
Jan  3 19:20:29 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=97.74.84.186, lip=66.85.158.91, session=<XQS/G3xH8OBhSlS6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  3 19:20:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<sqtUHXxHPOtnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.241.141.144
country_id: 6252001
description:
Jan  3 19:20:56 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<news@sivagnanamfoundation.com>, method=PLAIN, rip=192.241.141.144, lip=66.85.158.91, session=<RA9WHXxHZOTA8Y2Q>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Jan  3 19:22:06 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<t5yFIXxH7tCLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.231.254.192
country_id: 1819730
description:
Jan  3 19:21:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@nsteeleng.com>, method=PLAIN, rip=103.231.254.192, lip=66.85.158.91, session=<tRuZIHxHQu5n5/7A>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.147.131.177
country_id: 1814991
description:
Jan  3 19:22:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@venee.lk>, method=PLAIN, rip=8.147.131.177, lip=66.85.158.91, session=<R6amInxHTLEIk4Ox>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2026-01-03 19:22:41 dovecot_plain authenticator failed for H=(olver) [75.97.190.237]:48550: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.188.144
country_id: 6252001
description:
Jan  3 19:22:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=44.220.188.144, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<xR0IJHxHjtUs3LyQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Jan  3 19:22:48 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@kiriaswanu.com>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<52APJHxHRrOl0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.3.163.126
country_id: 6252001
description:
Jan  3 19:24:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@rehanseo.online>, method=PLAIN, rip=192.3.163.126, lip=66.85.158.91, session=<jr1mKXxHvIXAA6N+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Jan  3 19:25:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<tNZNLHxHMq6B4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  3 19:26:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<ZAHnL3xH6lKuijvy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-03 19:26:39 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (galnia) [87.103.126.54]:60005: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  3 19:27:49 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<pTT9NXxHaseeRdvj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan  3 19:29:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<RmYnOnxHJCwvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2026-01-03 19:30:13 dovecot_plain authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net (sismesidne) [71.62.34.216]:43924: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.208.46.130
country_id: 1522867
description:
2026-01-03 19:29:22 dovecot_login authenticator failed for H=([37.208.46.130]) [37.208.46.130]:51463: 535 Incorrect authentication data (set_id=office@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Jan  3 19:29:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@nsteeleng.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<E+8oPHxHZogImxNM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.13.61
country_id: 2077456
description:
2026-01-03 19:29:40 dovecot_login authenticator failed for H=([120.157.13.61]) [120.157.13.61]:58668: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.27.203.227
country_id: 3439705
description:
Jan  3 19:30:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@rehanseo.online>, method=PLAIN, rip=179.27.203.227, lip=66.85.158.91, session=<ZgyoP3xHHIKzG8vj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.30.137
country_id: 290557
description:
2026-01-03 19:31:15 dovecot_login authenticator failed for H=([94.207.30.137]) [94.207.30.137]:36194: 535 Incorrect authentication data (set_id=sales@kiriaswanu.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.133.47.143
country_id: 1522867
description:
Jan  3 19:31:51 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=62.133.47.143, lip=66.85.158.91, TLS handshaking: Connection closed, session=<4IOARHxHnrg+hS+P>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.70.59.147
country_id: 2264397
description:
Jan  3 19:31:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=146.70.59.147, lip=66.85.158.91, session=<dlV5RHxHNtaSRjuT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.235.142
country_id: 102358
description:
Jan  3 19:31:51 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=95.181.235.142, lip=66.85.158.91, TLS, session=<nneCRHxHprhfteuO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.253.97.234
country_id: 3144096
description:
Jan  3 19:31:50 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=185.253.97.234, lip=66.85.158.91, session=<9M52RHxHONa5/WHq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.84.102.18
country_id: 3439705
description:
Jan  3 19:31:50 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=45.84.102.18, lip=66.85.158.91, session=<8r11RHxHhqMtVGYS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-03 19:31:51 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:59088: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Jan  3 19:32:02 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shop@lankaherbalsolutions.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<LzUTRXxHJ1G2uHYF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.41.122
country_id: 1269750
description:
2026-01-03 19:31:24 dovecot_login authenticator failed for H=([125.23.243.66]) [125.23.41.122]:59084: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Jan  3 19:31:37 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<plqLQ3xHmpKkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.33.9
country_id: 953987
description:
Jan  3 19:32:37 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=102.64.33.9, lip=66.85.158.91, TLS, session=<g1IXRnxHbaxmQCEJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.149.83
country_id: 690791
description:
Jan  3 19:32:55 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=37.221.149.83, lip=66.85.158.91, TLS, session=<xopOR3xH/M0l3ZVT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2026-01-03 19:32:19 dovecot_plain authenticator failed for H=c-73-196-144-25.hsd1.nj.comcast.net (nogibled) [73.196.144.25]:37728: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 120.62.8.17
country_id: 1269750
description:
Jan  3 19:34:04 host2 sshd[1825267]: Disconnected from invalid user liang 120.62.8.17 port 58163 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 120.62.8.17
country_id: 1269750
description:
Jan  3 19:35:46 host2 sshd[1827044]: Disconnected from invalid user hector 120.62.8.17 port 42341 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  3 19:36:03 host2 pure-ftpd[1827365]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.133.161.162
country_id: 130758
description:
2026-01-03 19:37:10 dovecot_login authenticator failed for H=([85.133.161.162]) [85.133.161.162]:48016: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 120.62.8.17
country_id: 1269750
description:
Jan  3 19:36:33 host2 sshd[1827808]: Disconnected from invalid user botuser 120.62.8.17 port 49386 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 120.62.8.17
country_id: 1269750
description:
Jan  3 19:38:00 host2 sshd[1829294]: Disconnected from invalid user ubuntu 120.62.8.17 port 35239 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.122
country_id: 1269750
description:
2026-01-03 19:40:07 dovecot_login authenticator failed for H=([125.17.205.185]) [182.95.178.122]:51498: 535 Incorrect authentication data (set_id=office@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2026-01-03 19:39:49 dovecot_plain authenticator failed for H=(deptibar) [65.20.143.159]:43701: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.223.83.53
country_id: 2510769
description:
Jan  3 19:41:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=82.223.83.53, lip=66.85.158.91, session=<02AnZXxHMJBS31M1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 120.62.8.17
country_id: 1269750
description:
Jan  3 19:43:07 host2 sshd[1834746]: Disconnected from invalid user john 120.62.8.17 port 26189 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 203.153.46.246
country_id: 1269750
description:
Jan  3 19:46:21 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=203.153.46.246, lip=66.85.158.91, session=<HPY/eHxHyqbLmS72>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Jan  3 19:46:41 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postmaster@essenceceylontea.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<Xa17eXxH2aS2uHYF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 68.183.92.114
country_id: 1269750
description:
Jan  3 19:49:29 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=68.183.92.114, lip=66.85.158.91, session=<pM90g3xHCGZEt1xy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Jan  3 19:49:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@melanifinefood.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<QFJohHxHPuIrpAFm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.105.156.165
country_id: 3923057
description:
Jan  3 19:50:57 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@venee.lk>, method=PLAIN, rip=200.105.156.165, lip=66.85.158.91, session=<jEuviHxHDL/IaZyl>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.231.222.160
country_id: 3190538
description:
Jan  3 19:51:51 host2 pure-ftpd[1844277]: (?@91.231.222.160) [INFO] New connection from 91.231.222.160


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Jan  3 19:52:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<6EQOj3xHcIpAF6S9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  3 19:53:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<A0rAknxHpIeuijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  3 19:54:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<Z/PnlHxHJsUIijoY>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 19:55:32 host2 sshd[1848939]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2026-01-03 19:56:55 dovecot_plain authenticator failed for H=c-73-197-236-163.hsd1.nj.comcast.net (amoidines) [73.197.236.163]:59626: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  3 19:58:47 host2 sshd[1852641]: Disconnected from invalid user admin 2.57.121.112 port 32825 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 97.74.84.186
country_id: 1880251
description:
Jan  3 20:00:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=97.74.84.186, lip=66.85.158.91, session=<Qo0jqnxH3MRhSlS6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.238.92.245
country_id: 2623032
description:
2026-01-03 20:04:20 dovecot_plain authenticator failed for H=(ingeleud) [84.238.92.245]:33203: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.147.131.177
country_id: 1814991
description:
Jan  3 20:04:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=8.147.131.177, lip=66.85.158.91, session=<9867uHxHRpUIk4Ox>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.7
country_id: 2635167
description:
Jan  3 20:06:04 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=35.203.211.7, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<OqrgvnxHrNkjy9MH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  3 20:06:36 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@sobaherbal.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<JW2zwHxHBuUv/AU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.7
country_id: 2635167
description:
Jan  3 20:06:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=35.203.211.7, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<wW+0v3xHLPcjy9MH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.61
country_id: 1269750
description:
Jan  3 20:09:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=66.116.199.61, lip=66.85.158.91, session=<P9/by3xHSNpCdMc9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.148.29.174
country_id: 1643084
description:
Jan  3 20:10:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@sivagnanamfoundation.com>, method=PLAIN, rip=103.148.29.174, lip=66.85.158.91, session=<HWRuz3xHtJJnlB2u>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Jan  3 20:11:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<JWGL0XxH1q6nYwhf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.105.157.220
country_id: 6252001
description:
Jan  3 20:11:43 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=172.105.157.220, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher, session=<HH0d03xH0lusaZ3c>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  3 20:11:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<xjih03xH2rkFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  3 20:15:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<JwWB33xHtscvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  3 20:15:17 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@seyawin.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<eme833xHAKlIpyJ4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.241.141.144
country_id: 6252001
description:
Jan  3 20:16:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@sivagnanamfoundation.com>, method=PLAIN, rip=192.241.141.144, lip=66.85.158.91, session=<iaZt43xH5tLA8Y2Q>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-03 20:18:08 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (whing) [87.103.126.54]:51974: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.144.61.200
country_id: 6252001
description:
Jan  3 20:17:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=162.144.61.200, lip=66.85.158.91, session=<1M5c53xH+sSikD3I>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  3 20:19:27 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<yR+k7nxHyoQv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2026-01-03 20:21:31 dovecot_plain authenticator failed for H=c-73-195-211-98.hsd1.nj.comcast.net (fitics) [73.195.211.98]:43960: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Jan  3 20:22:56 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@sivagnanamfoundation.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<Hgkd+3xHfLmLO0qU>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 62.169.18.6
country_id: 3017382
description:
Denial of Service (DoS) attack was discovered from 62.169.18.6: 250 connections per 30 seconds to 80 port.


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.231.254.192
country_id: 1819730
description:
Jan  3 20:24:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@nsteeleng.com>, method=PLAIN, rip=103.231.254.192, lip=66.85.158.91, session=<K4jg/nxH8NJn5/7A>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.44.140.207
country_id: 690791
description:
Jan  3 20:24:54 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=194.44.140.207, lip=66.85.158.91, TLS, session=<2lQ9AX1HnMvCLIzP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.73.219
country_id: 3469034
description:
Jan  3 20:25:16 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<charanaw>, method=PLAIN, rip=187.120.73.219, lip=66.85.158.91, TLS, session=<iZlrAn1HjJi7eEnb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Jan  3 20:26:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<3mGSB31HAK+l0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Jan  3 20:27:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@kiriaswanu.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<EBlICn1Hns2B4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  3 20:27:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<wvZADH1HxO1nmud6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  3 20:27:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<HgnrDH1Hymiuijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  3 20:29:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<3NYXEn1HyLqeRdvj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.27.203.227
country_id: 3439705
description:
Jan  3 20:29:58 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=179.27.203.227, lip=66.85.158.91, session=<hp88FH1H9LqzG8vj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Jan  3 20:30:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@nsteeleng.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<zGp8FX1H9IQImxNM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.140.19.22
country_id: 1269750
description:
Jan  3 20:32:48 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colperlab.com>, method=PLAIN, rip=103.140.19.22, lip=66.85.158.91, session=<wQ9jHn1HLK9njBMW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan  3 20:33:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<0DjPH31HsnsvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Jan  3 20:34:01 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<5FbAIn1HEL2kXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.223.83.53
country_id: 2510769
description:
Jan  3 20:36:29 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=82.223.83.53, lip=66.85.158.91, session=<KeSQK31HbMdS31M1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Jan  3 20:39:48 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postmaster@lankaherbalsolutions.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<B2hvN31HQ1m2uHYF>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  3 20:41:27 host2 pure-ftpd[1900212]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.152.52.226
country_id: 6252001
description:
Jan  3 20:43:34 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=104.152.52.226, lip=66.85.158.91, TLS: Connection closed, session=<sT0JRX1Hq7BomDTi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 203.153.46.246
country_id: 1269750
description:
Jan  3 20:44:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=203.153.46.246, lip=66.85.158.91, session=<+ErYRn1H+tTLmS72>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.147.131.177
country_id: 1814991
description:
Jan  3 20:44:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=8.147.131.177, lip=66.85.158.91, session=<fCqFSX1HCMMIk4Ox>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 68.183.92.114
country_id: 1269750
description:
Jan  3 20:45:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=68.183.92.114, lip=66.85.158.91, session=<0/61Sn1HYJBEt1xy>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 20:46:54 host2 sshd[1907179]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Jan  3 20:49:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<9USnWX1HfrJAF6S9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.105.156.165
country_id: 3923057
description:
Jan  3 20:51:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@venee.lk>, method=PLAIN, rip=200.105.156.165, lip=66.85.158.91, session=<niHjYH1HJOXIaZyl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Jan  3 20:54:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<Chlra31Hfi22uHYF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  3 20:55:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<edYdb31HWniuijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  3 20:56:56 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@venee.lk>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<Py6xdH1H7ssIijoY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.237.123.204
country_id: 6252001
description:
Jan  3 20:56:09 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=135.237.123.204, lip=66.85.158.91, session=<t84Gcn1HXNGH7XvM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.73
country_id: 6252001
description:
Jan  3 21:05:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=162.216.149.73, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<1q5klH1HAsGi2JVJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  3 21:06:36 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sobaherbal.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<3xVGl31HKrMv/AU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.73
country_id: 6252001
description:
Jan  3 21:06:40 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=162.216.149.73, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<6wShl31HoOKi2JVJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 97.74.84.186
country_id: 1880251
description:
Jan  3 21:06:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=97.74.84.186, lip=66.85.158.91, session=<PQUTmH1HOIZhSlS6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.129.57.71
country_id: 6252001
description:
2026-01-03 21:07:00 dovecot_plain authenticator failed for H=c-73-129-57-71.hsd1.md.comcast.net (sconimon) [73.129.57.71]:53220: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  3 21:08:39 host2 sshd[1932945]: Disconnected from invalid user admin 2.57.121.112 port 33150 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.148.29.174
country_id: 1643084
description:
Jan  3 21:09:32 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<help@sivagnanamfoundation.com>, method=PLAIN, rip=103.148.29.174, lip=66.85.158.91, session=<V9GzoX1HssZnlB2u>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.254.223.39
country_id: 6252001
description:
2026-01-03 21:10:23 dovecot_login authenticator failed for H=(QdRmHEa) [157.254.223.39]:61999: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Jan  3 21:10:37 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<GOqcpX1Hom6nYwhf>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 157.254.223.39
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Remote IP Address]=[157.254.223.39] [Authentication Database]=[mail] [Username]=[washeera@lezzarotech.com] (5/5 failures) (blocked until [Sat Jan  3 15:56:15 2026 UTC/Sat Jan  3 21:26:15 2026 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.254.223.39
country_id: 6252001
description:
2026-01-03 21:11:17 dovecot_login authenticator failed for H=(y849RoU) [157.254.223.39]:52902: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.241.141.144
country_id: 6252001
description:
Jan  3 21:11:47 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=192.241.141.144, lip=66.85.158.91, session=<whTMqX1HRsHA8Y2Q>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 38.148.242.242
country_id: 6252001
description:
Jan  3 21:12:45 host2 pure-ftpd[1938354]: (?@38.148.242.242) [INFO] New connection from 38.148.242.242


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.61
country_id: 1269750
description:
Jan  3 21:12:51 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=66.116.199.61, lip=66.85.158.91, session=<yh6XrX1HYJlCdMc9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.73
country_id: 6252001
description:
Jan  3 21:13:14 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=162.216.149.73, lip=66.85.158.92, TLS, session=<ESgTr31H1Omi2JVJ>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.64.114.133
country_id: 6252001
description:
[2026-01-03 21:13:32 +0530] info [cpaneld] 192.64.114.133 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 21:14:33 host2 sshd[1940377]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  3 21:14:21 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<KfX/sn1HFooFhXlo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.254.223.39
country_id: 6252001
description:
2026-01-03 21:14:18 dovecot_login authenticator failed for H=(YazTGdTh) [157.254.223.39]:64289: 535 Incorrect authentication data


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.210.147.41
country_id: 1819730
description:
Jan  3 21:15:57 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=8.210.147.41, lip=66.85.158.91, session=<CUi2uH1HWLwI0pMp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  3 21:16:34 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@seyawin.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<1jDlun1HHsdIpyJ4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  3 21:17:01 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<NKuDvH1H7psvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.144.61.200
country_id: 6252001
description:
Jan  3 21:18:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@sivagnanamfoundation.com>, method=PLAIN, rip=162.144.61.200, lip=66.85.158.91, session=<B0TdwX1HSIiikD3I>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  3 21:20:35 host2 sshd[1946773]: Disconnected from invalid user user 2.57.121.25 port 43494 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  3 21:20:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@venee.lk>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<pH1kyn1H2Ogv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.140.19.22
country_id: 1269750
description:
Jan  3 21:21:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=103.140.19.22, lip=66.85.158.91, session=<LH1by31HOsRnjBMW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Jan  3 21:23:40 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<6LpE1H1HwLqLO0qU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2026-01-03 21:23:43 dovecot_plain authenticator failed for H=c-73-168-136-150.hsd1.il.comcast.net (luought) [73.168.136.150]:51818: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.147.131.177
country_id: 1814991
description:
Jan  3 21:26:01 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@venee.lk>, method=PLAIN, rip=8.147.131.177, lip=66.85.158.91, session=<0Zqr3H1HCIEIk4Ox>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.231.254.192
country_id: 1819730
description:
Jan  3 21:26:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=103.231.254.192, lip=66.85.158.91, session=<hIAo3n1HMqhn5/7A>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Jan  3 21:29:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<p2Bf531HDJyl0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  3 21:29:49 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<rLpI6n1HtHGuijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  3 21:30:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<NWhm7H1HwOmeRdvj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 97.74.84.186
country_id: 1880251
description:
Jan  3 21:30:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=97.74.84.186, lip=66.85.158.91, session=<PQso7n1HWIhhSlS6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Jan  3 21:30:58 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<6gVs7n1HMuMImxNM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.58.87.108
country_id: 6252001
description:
2026-01-03 21:31:29 dovecot_plain authenticator failed for H=c-174-58-87-108.hsd1.fl.comcast.net (ebyrican) [174.58.87.108]:55632: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  3 21:32:53 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<tnlE9X1HXMZnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Jan  3 21:32:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<W0Sy9H1HqMKB4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.94.106.254
country_id: 6252001
description:
Jan  3 21:32:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=66.94.106.254, lip=66.85.158.91, session=<u8bB9H1HqM5CXmr+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.223.83.53
country_id: 2510769
description:
Jan  3 21:33:08 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=82.223.83.53, lip=66.85.158.91, session=<XGgn9n1HXIBS31M1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.27.203.227
country_id: 3439705
description:
Jan  3 21:33:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@rehanseo.online>, method=PLAIN, rip=179.27.203.227, lip=66.85.158.91, session=<tgrZ9n1HkJ+zG8vj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Jan  3 21:36:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@mathsmotorcysle.xyz>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<AXzRAH5HxsikXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.140.19.22
country_id: 1269750
description:
Jan  3 21:36:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=103.140.19.22, lip=66.85.158.91, session=<btUeAX5H/NxnjBMW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.195.57
country_id: 6252001
description:
Jan  3 21:36:47 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.65.195.57, lip=66.85.158.92, session=<icRRA35H+rwUQcM5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan  3 21:36:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<HyzqAH5HnvovTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  3 21:37:39 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<zv1KBn5HxssFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.140.19.22
country_id: 1269750
description:
Jan  3 21:38:21 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@monarchdss.com>, method=PLAIN, rip=103.140.19.22, lip=66.85.158.91, session=<bzfJCH5HhuFnjBMW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2026-01-03 21:39:37 dovecot_plain authenticator failed for H=(delass) [75.97.190.237]:33453: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 68.183.92.114
country_id: 1269750
description:
Jan  3 21:40:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=68.183.92.114, lip=66.85.158.91, session=<Qz81D35HNrREt1xy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 203.153.46.246
country_id: 1269750
description:
Jan  3 21:45:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=203.153.46.246, lip=66.85.158.91, session=<SFmtI35H4JbLmS72>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  3 21:46:51 host2 pure-ftpd[1981556]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Jan  3 21:48:35 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@nsteeleng.com>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<4kxsLX5H2MZAF6S9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Jan  3 21:48:53 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<ONh6Ln5HdU+2uHYF>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 21:51:59 host2 sshd[2000462]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.105.156.165
country_id: 3923057
description:
Jan  3 21:53:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@venee.lk>, method=PLAIN, rip=200.105.156.165, lip=66.85.158.91, session=<kboNP35HUs3IaZyl>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 102.204.223.16
country_id: 2328926
description:
Jan  3 21:54:11 host2 pure-ftpd[2003025]: (?@102.204.223.16) [INFO] New connection from 102.204.223.16


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.62.156.122
country_id: 6252001
description:
Jan  3 21:56:01 host2 pure-ftpd[2005256]: (?@64.62.156.122) [INFO] New connection from 64.62.156.122


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2026-01-03 21:56:56 dovecot_plain authenticator failed for H=c-98-227-25-115.hsd1.il.comcast.net (oring) [98.227.25.115]:34430: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  3 21:57:40 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<e3roTX5HXPmuijvy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.167.228.123
country_id: 933860
description:
Jan  3 21:58:00 host2 sshd[2007061]: Disconnected from invalid user wang 168.167.228.123 port 36368 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 168.167.228.123
country_id: 933860
description:
Jan  3 22:00:21 host2 sshd[2009475]: Disconnected from invalid user wagner 168.167.228.123 port 36370 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  3 22:01:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@venee.lk>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<WCBZXH5HmNIIijoY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.214
country_id: 6252001
description:
Jan  3 22:03:27 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.214, lip=66.85.158.92, session=<RRq0Yn5Hg/FAPpzW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.212
country_id: 6252001
description:
Jan  3 22:03:40 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.212, lip=66.85.158.92, TLS: Connection closed, session=<cnl5Y35H5JNAPpzU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  3 22:04:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<KA8iZX5H4uQv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Jan  3 22:04:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@essenceceylontea.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<RVuoZ35HQbC2uHYF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.147.131.177
country_id: 1814991
description:
Jan  3 22:07:02 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=8.147.131.177, lip=66.85.158.91, session=<8upnb35HHusIk4Ox>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.228
country_id: 6252001
description:
Jan  3 22:07:17 host2 pure-ftpd[2017289]: (?@205.210.31.228) [INFO] New connection from 205.210.31.228


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.148.29.174
country_id: 1643084
description:
Jan  3 22:07:34 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=103.148.29.174, lip=66.85.158.91, session=<zgRFcX5HJo5nlB2u>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.94.106.254
country_id: 6252001
description:
Jan  3 22:07:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.94.106.254, lip=66.85.158.91, session=<zY4fcH5HXoFCXmr+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2026-01-03 22:08:36 dovecot_plain authenticator failed for H=c-24-1-200-187.hsd1.il.comcast.net (pulatisess) [24.1.200.187]:51444: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.198.54.145
country_id: 1861060
description:
Jan  3 22:09:51 host2 sshd[2019822]: Disconnected from invalid user debian 52.198.54.145 port 35630 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 67.10.185.103
country_id: 6252001
description:
Jan  3 22:09:28 host2 sshd[2019447]: Disconnected from invalid user debian 67.10.185.103 port 49170 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  3 22:11:01 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<OVuafX5HgqsFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.241.141.144
country_id: 6252001
description:
Jan  3 22:10:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=192.241.141.144, lip=66.85.158.91, session=<2RHmen5H/KzA8Y2Q>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 67.10.185.103
country_id: 6252001
description:
Jan  3 22:11:55 host2 sshd[2022197]: Disconnected from invalid user int 67.10.185.103 port 58530 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 67.10.185.103
country_id: 6252001
description:
Jan  3 22:11:16 host2 sshd[2021523]: Disconnected from invalid user test 67.10.185.103 port 46414 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 97.74.84.186
country_id: 1880251
description:
Jan  3 22:11:39 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@essenceceylontea.com>, method=PLAIN, rip=97.74.84.186, lip=66.85.158.91, session=<o5Pof35H8M1hSlS6>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 102.204.223.58
country_id: 2328926
description:
Jan  3 22:11:47 host2 pure-ftpd[2022100]: (?@102.204.223.58) [INFO] New connection from 102.204.223.58


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.198.54.145
country_id: 1861060
description:
Jan  3 22:15:29 host2 sshd[2026513]: Disconnected from invalid user rohan 52.198.54.145 port 43590 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.19.243.145
country_id: 3017382
description:
Jan  3 22:16:39 host2 sshd[2027755]: Disconnected from invalid user claude 162.19.243.145 port 40480 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.61
country_id: 1269750
description:
Jan  3 22:16:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shop@anandaobauae.org>, method=PLAIN, rip=66.116.199.61, lip=66.85.158.91, session=<osMJkn5HPsNCdMc9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.164.1.102
country_id: 1605651
description:
Jan  3 22:16:56 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=43.164.1.102, lip=66.85.158.91, session=<bE3Pkn5H+JgrpAFm>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.19.243.145
country_id: 3017382
description:
Jan  3 22:17:47 host2 sshd[2029169]: Disconnected from invalid user test 162.19.243.145 port 49312 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.94.106.254
country_id: 6252001
description:
Jan  3 22:18:05 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.94.106.254, lip=66.85.158.91, session=<Th8Jl35HbJJCXmr+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.19.243.145
country_id: 3017382
description:
Jan  3 22:18:20 host2 sshd[2029648]: Disconnected from invalid user joel 162.19.243.145 port 41002 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  3 22:19:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<jjHomn5HbOdIpyJ4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  3 22:19:58 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<OZ6bnX5HLMYFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  3 22:20:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<qK8BoH5HipsvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.144.61.200
country_id: 6252001
description:
Jan  3 22:20:49 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=162.144.61.200, lip=66.85.158.91, session=<dF6toH5HAs2ikD3I>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.210.147.41
country_id: 1819730
description:
Jan  3 22:21:21 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@seyawin.com>, method=PLAIN, rip=8.210.147.41, lip=66.85.158.91, session=<itWFon5HNpEI0pMp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  3 22:23:56 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<BLXTq35H0uQv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Jan  3 22:25:42 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<BLcisn5HquWLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.231.254.192
country_id: 1819730
description:
Jan  3 22:26:17 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=103.231.254.192, lip=66.85.158.91, session=<YK0+tH5HTtln5/7A>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  3 22:26:39 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<9qKNtX5HDoqeRdvj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  3 22:26:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=50.6.195.206, lip=66.85.158.91, session=<ct3ktX5HFucyBsPO>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.57
country_id: 6252001
description:
Jan  3 22:28:04 host2 pure-ftpd[2039814]: (?@205.210.31.57) [INFO] New connection from 205.210.31.57


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.17.125.36
country_id: 690791
description:
Jan  3 22:28:37 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=185.17.125.36, lip=66.85.158.91, TLS, session=<vMeeu35HLdW5EX0k>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.37.45
country_id: 3469034
description:
Jan  3 22:28:57 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw>, method=PLAIN, rip=191.240.37.45, lip=66.85.158.91, TLS, session=<RBXOvH5H1a+/8CUt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.155.19.76
country_id: 1814991
description:
Jan  3 22:29:26 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@nsteeleng.com>, method=PLAIN, rip=8.155.19.76, lip=66.85.158.91, session=<lsuEv35HFNsImxNM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.223.83.53
country_id: 2510769
description:
Jan  3 22:30:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=82.223.83.53, lip=66.85.158.91, session=<8BA5wn5HOr1S31M1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Jan  3 22:31:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<epO7x35HBtil0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  3 22:33:34 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<5x1Hzn5HJLmuijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 97.74.84.186
country_id: 1880251
description:
Jan  3 22:35:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@lankaherbalsolutions.com>, method=PLAIN, rip=97.74.84.186, lip=66.85.158.91, session=<I1qb1n5HHNNhSlS6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 68.183.92.114
country_id: 1269750
description:
Jan  3 22:36:49 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=68.183.92.114, lip=66.85.158.91, session=<fSDg2X5HZD5Et1xy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.27.203.227
country_id: 3439705
description:
Jan  3 22:37:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=179.27.203.227, lip=66.85.158.91, session=<UOV4235HBMuzG8vj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Jan  3 22:37:47 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<N/tY3X5H8JqkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  3 22:37:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<Ivow235HwIpnmud6>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 22:38:51 host2 sshd[2052985]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan  3 22:39:47 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@seyawin.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<5p195H5HqJwvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Jan  3 22:39:27 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<vilM435HeMeB4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.56
country_id: 3175395
description:
Jan  3 22:42:09 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=185.197.9.56, lip=66.85.158.91, TLS, session=<Gisf7H5HBuC5xQk4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 131.255.183.6
country_id: 3865483
description:
Jan  3 22:42:41 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=131.255.183.6, lip=66.85.158.91, TLS, session=<xLHf7X5HR82D/7cG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.147.131.177
country_id: 1814991
description:
Jan  3 22:46:34 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@venee.lk>, method=PLAIN, rip=8.147.131.177, lip=66.85.158.91, session=<gFnA/H5H/NkIk4Ox>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 161.35.222.121
country_id: 2921044
description:
Jan  3 22:48:29 host2 pure-ftpd[2065017]: (?@161.35.222.121) [INFO] New connection from 161.35.222.121


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2026-01-03 22:48:34 dovecot_plain authenticator failed for H=c-67-172-54-29.hsd1.pa.comcast.net (chrylisman) [67.172.54.29]:36290: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 203.153.46.246
country_id: 1269750
description:
Jan  3 22:48:41 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=203.153.46.246, lip=66.85.158.91, session=<9xpTBH9HYLnLmS72>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.226.64.185
country_id: 2921044
description:
Jan  3 22:48:29 host2 pure-ftpd[2065005]: (?@64.226.64.185) [INFO] New connection from 64.226.64.185


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.116.247.31
country_id: 1522867
description:
2026-01-03 22:48:30 dovecot_login authenticator failed for H=([212.116.247.31]) [212.116.247.31]:48742: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Jan  3 22:48:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@nsteeleng.com>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<uHbjBH9HxOVAF6S9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.33
country_id: 1819730
description:
2026-01-03 22:49:04 dovecot_login authenticator failed for H=(223-197-145-33.static.imsbiz.com) [223.197.145.33]:58138: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.245
country_id: 6252001
description:
Jan  3 22:51:01 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.245, lip=66.85.158.91, session=<PQnODH9HGO+s7OT1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 192.155.90.118
country_id: 6252001
description:
Jan  3 22:51:01 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=192.155.90.118, lip=66.85.158.92, session=<7vXLDH9HjKDAm1p2>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  3 22:51:23 host2 pure-ftpd[2068313]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  3 22:55:17 host2 sshd[2072848]: Disconnected from invalid user admin 2.57.121.112 port 57182 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-03 22:55:13 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:58458: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-03 23:00:05 dovecot_login authenticator failed for H=(E4w0jpY42n) [158.94.208.110]:49957: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.173.58.47
country_id: 6252001
description:
2026-01-03 23:00:50 dovecot_plain authenticator failed for H=c-67-173-58-47.hsd1.il.comcast.net (melyin) [67.173.58.47]:55120: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-03 23:00:13 dovecot_login authenticator failed for H=(wyWje2iOed) [158.94.208.110]:51399: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 158.94.208.110
country_id: 2921044
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Remote IP Address]=[158.94.208.110] [Authentication Database]=[mail] [Username]=[contact] (5/5 failures) (blocked until [Sat Jan  3 17:45:23 2026 UTC/Sat Jan  3 23:15:23 2026 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-03 23:03:27 dovecot_login authenticator failed for H=(7ehkBfyHB) [158.94.208.110]:57526: 535 Incorrect authentication data


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 23:06:21 host2 sshd[2085080]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.102.4.12
country_id: 298795
description:
Jan  3 23:08:23 host2 sshd[2087349]: Disconnected from invalid user claude 94.102.4.12 port 45420 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.23.199.89
country_id: 2029969
description:
Jan  3 23:09:23 host2 sshd[2088450]: Disconnected from invalid user deploy 203.23.199.89 port 16711 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 94.102.4.12
country_id: 298795
description:
Jan  3 23:09:40 host2 sshd[2088722]: Disconnected from invalid user claude 94.102.4.12 port 41612 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.102.4.12
country_id: 298795
description:
Jan  3 23:10:12 host2 sshd[2089427]: Disconnected from invalid user test01 94.102.4.12 port 53482 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.26.136.173
country_id: 1210997
description:
Jan  3 23:11:15 host2 sshd[2090566]: Disconnected from invalid user claude 103.26.136.173 port 49526 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.79.87
country_id: 1643084
description:
Jan  3 23:11:20 host2 sshd[2090635]: Disconnected from invalid user sammy 27.112.79.87 port 34356 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.231.254.192
country_id: 1819730
description:
Jan  3 23:11:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=103.231.254.192, lip=66.85.158.91, session=<noRXV39HHNZn5/7A>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.52.217.71
country_id: 3686110
description:
2026-01-03 23:13:03 dovecot_login authenticator failed for H=(static-ip-cr18152021771.cable.net.co) [181.52.217.71]:60183: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.148.29.174
country_id: 1643084
description:
Jan  3 23:12:21 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=103.148.29.174, lip=66.85.158.91, session=<DtT6WH9HKJtnlB2u>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.194.231
country_id: 3144096
description:
2026-01-03 23:13:14 dovecot_login authenticator failed for H=(cm-178.232.194.231.get.no) [178.232.194.231]:36861: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Jan  3 23:13:16 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<kZREXH9HWqsI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  3 23:13:27 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<dWXkXH9HUK2eRdGr>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 203.23.199.89
country_id: 2029969
description:
Jan  3 23:13:16 host2 sshd[2092693]: Disconnected from invalid user andrew 203.23.199.89 port 60296 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.154.128
country_id: 1814991
description:
Jan  3 23:13:48 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=8.138.154.128, lip=66.85.158.91, session=<feosXn9HNp8IipqA>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.79.87
country_id: 1643084
description:
Jan  3 23:14:07 host2 sshd[2093606]: Disconnected from invalid user claude 27.112.79.87 port 36236 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.231.254.192
country_id: 1819730
description:
Jan  3 23:14:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@kiriaswanu.com>, method=PLAIN, rip=103.231.254.192, lip=66.85.158.91, session=<JRRjYH9H0JNn5/7A>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Jan  3 23:14:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<X2LfYH9HZLYI04Sw>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.79.87
country_id: 1643084
description:
Jan  3 23:15:23 host2 sshd[2095176]: Disconnected from invalid user ai 27.112.79.87 port 33652 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.175.193.205
country_id: 1269750
description:
Jan  3 23:15:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=122.175.193.205, lip=66.85.158.91, session=<KlADZX9HMt96r8HN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.175.193.205
country_id: 1269750
description:
Jan  3 23:16:57 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=122.175.193.205, lip=66.85.158.91, session=<E8lqaX9H0oV6r8HN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.124
country_id: 2635167
description:
Jan  3 23:17:05 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=35.203.211.124, lip=66.85.158.91, session=<CUEMan9HeO8jy9N8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.154.128
country_id: 1814991
description:
Jan  3 23:16:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=8.138.154.128, lip=66.85.158.91, session=<xXc4Z39H6t0IipqA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Jan  3 23:17:35 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<Pkiwa39HzYsvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  3 23:18:02 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<+eVLbX9HENqeRdGr>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.26.136.173
country_id: 1210997
description:
Jan  3 23:18:53 host2 sshd[2099289]: Disconnected from invalid user toni 103.26.136.173 port 58072 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  3 23:19:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<5LDNcX9HbtWeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Jan  3 23:19:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<mPdxcn9HvkovWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.175.193.205
country_id: 1269750
description:
Jan  3 23:19:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=122.175.193.205, lip=66.85.158.91, session=<eZd/c39HULB6r8HN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.79.87
country_id: 1643084
description:
Jan  3 23:20:29 host2 sshd[2101312]: Disconnected from invalid user devops 27.112.79.87 port 52796 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Jan  3 23:20:51 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<fhZed39HiNEvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.148.29.174
country_id: 1643084
description:
Jan  3 23:22:36 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=103.148.29.174, lip=66.85.158.91, session=<5COnfX9HLrBnlB2u>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.231.254.192
country_id: 1819730
description:
Jan  3 23:23:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@seyawin.com>, method=PLAIN, rip=103.231.254.192, lip=66.85.158.91, session=<9lNFgn9HOrln5/7A>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Jan  3 23:25:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.113.212, lip=66.85.158.91, TLS: Connection closed, session=<laG+hn9HZuyLonHU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  3 23:27:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@seyawin.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<ImmakH9HdoyeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.148.29.174
country_id: 1643084
description:
Jan  3 23:28:02 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@seyawin.com>, method=PLAIN, rip=103.148.29.174, lip=66.85.158.91, session=<j179kH9HJupnlB2u>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.212.178
country_id: 1269750
description:
2026-01-03 23:27:31 dovecot_login authenticator failed for H=([152.52.144.161]) [128.185.212.178]:45414: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.231.254.192
country_id: 1819730
description:
Jan  3 23:27:35 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=103.231.254.192, lip=66.85.158.91, session=<g6Ztj39HyMRn5/7A>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.225
country_id: 1733045
description:
2026-01-03 23:29:06 dovecot_login authenticator failed for H=([49.124.152.225]) [49.124.152.225]:54776: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Jan  3 23:28:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<8twnkn9HQpoI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.148.29.174
country_id: 1643084
description:
Jan  3 23:28:40 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=103.148.29.174, lip=66.85.158.91, session=<okxQk39Hno9nlB2u>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2026-01-03 23:28:49 dovecot_login authenticator failed for H=([189.59.210.1]) [186.215.245.175]:46305: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Jan  3 23:29:17 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<zRCLlX9HPOAvT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Jan  3 23:29:39 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@seyawin.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<P37Rln9HPqUI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.154.128
country_id: 1814991
description:
Jan  3 23:29:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=8.138.154.128, lip=66.85.158.91, session=<IBq4l39HgtQIipqA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.231.254.192
country_id: 1819730
description:
Jan  3 23:30:08 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=103.231.254.192, lip=66.85.158.91, session=<nVmMmH9HBrRn5/7A>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.161
country_id: 6252001
description:
Jan  3 23:30:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=195.184.76.161, lip=66.85.158.92, session=<hGFgmX9HHarDuEyh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.160
country_id: 6252001
description:
Jan  3 23:30:32 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=195.184.76.160, lip=66.85.158.92, session=<ylsjmn9HIYjDuEyg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.165
country_id: 6252001
description:
Jan  3 23:30:35 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.165, lip=66.85.158.92, session=<eVNTmn9HkeHDuEyl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.175.193.205
country_id: 1269750
description:
Jan  3 23:30:56 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=122.175.193.205, lip=66.85.158.91, session=<Z/Zrm39HfMV6r8HN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.200
country_id: 6252001
description:
Jan  3 23:30:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.200, lip=66.85.158.92, session=<dHvFmH9H0drDuEzI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Jan  3 23:31:14 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<gM2AnH9HdtsvWbHj>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 23:33:06 host2 sshd[2116157]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  3 23:32:28 host2 sshd[2115279]: Disconnected from invalid user admin 2.57.121.112 port 30863 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.154.128
country_id: 1814991
description:
Jan  3 23:32:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=8.138.154.128, lip=66.85.158.91, session=<9F0goX9HEqMIipqA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  3 23:32:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@kiriaswanu.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<4GM7oX9HSIeeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.175.193.205
country_id: 1269750
description:
Jan  3 23:32:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=122.175.193.205, lip=66.85.158.91, session=<cdLzn39Hdod6r8HN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2026-01-03 23:33:51 dovecot_login authenticator failed for H=([128.185.247.14]) [122.184.124.46]:36130: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Jan  3 23:33:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<vxpao39HNZovWbHj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.194
country_id: 99237
description:
2026-01-03 23:35:50 dovecot_plain authenticator failed for H=(legaleaky) [65.20.148.194]:45823: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.91.252.38
country_id: 3017382
description:
Jan  3 23:37:07 host2 sshd[2120860]: Disconnected from invalid user olivier 51.91.252.38 port 40686 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.217.136.36
country_id: 6252001
description:
Jan  3 23:37:17 host2 sshd[2121152]: Disconnected from invalid user sachin 206.217.136.36 port 53404 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.126
country_id: 6252001
description:
Jan  3 23:38:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.126, lip=66.85.158.91, TLS: Connection closed, session=<bCoKtn9HUMRChJl+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.180.118
country_id: 3932488
description:
Jan  3 23:39:03 host2 sshd[2123550]: Disconnected from invalid user qwe 161.132.180.118 port 7160 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.180.118
country_id: 3932488
description:
Jan  3 23:40:31 host2 sshd[2125063]: Disconnected from invalid user marc 161.132.180.118 port 7161 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.249.87.201
country_id: 3625428
description:
Jan  3 23:41:45 host2 sshd[2126369]: Disconnected from invalid user alex 201.249.87.201 port 51058 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.132.180.118
country_id: 3932488
description:
Jan  3 23:41:50 host2 sshd[2126467]: Disconnected from invalid user ubuntu 161.132.180.118 port 7163 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.128.241.2
country_id: 3437598
description:
Jan  3 23:42:03 host2 sshd[2126648]: Disconnected from invalid user claude 190.128.241.2 port 53004 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.217.136.36
country_id: 6252001
description:
Jan  3 23:42:26 host2 sshd[2127041]: Disconnected from invalid user claude 206.217.136.36 port 46098 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.77.150.244
country_id: 3017382
description:
Jan  3 23:43:46 host2 sshd[2128508]: Disconnected from invalid user sol 51.77.150.244 port 36360 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.249.87.201
country_id: 3625428
description:
Jan  3 23:43:12 host2 sshd[2127834]: Disconnected from invalid user joshua 201.249.87.201 port 50044 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.180.118
country_id: 3932488
description:
Jan  3 23:43:35 host2 sshd[2128273]: Disconnected from invalid user kt 161.132.180.118 port 7166 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Jan  3 23:44:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<k/s9y39HzqgvT1jH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.217.136.36
country_id: 6252001
description:
Jan  3 23:44:22 host2 sshd[2129505]: Disconnected from invalid user znc-admin 206.217.136.36 port 55552 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.249.87.201
country_id: 3625428
description:
Jan  3 23:44:43 host2 sshd[2130061]: Disconnected from invalid user ubuntu 201.249.87.201 port 48726 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.77.150.244
country_id: 3017382
description:
Jan  3 23:44:50 host2 sshd[2130228]: Disconnected from invalid user claude 51.77.150.244 port 35938 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.128.241.2
country_id: 3437598
description:
Jan  3 23:44:10 host2 sshd[2129046]: Disconnected from invalid user rdp 190.128.241.2 port 52576 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.77.150.244
country_id: 3017382
description:
Jan  3 23:45:50 host2 sshd[2132119]: Disconnected from invalid user client 51.77.150.244 port 44060 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.217.136.36
country_id: 6252001
description:
Jan  3 23:45:52 host2 sshd[2132196]: Disconnected from invalid user build 206.217.136.36 port 43888 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.128.241.2
country_id: 3437598
description:
Jan  3 23:45:39 host2 sshd[2131942]: Disconnected from invalid user prueba 190.128.241.2 port 46672 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 104.248.245.89
country_id: 2921044
description:
Jan  3 23:47:01 host2 sshd[2133555]: Received disconnect from 104.248.245.89 port 33144:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.77.150.244
country_id: 3017382
description:
Jan  3 23:47:21 host2 sshd[2133928]: Disconnected from invalid user it 51.77.150.244 port 56762 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.248.245.89
country_id: 2921044
description:
Jan  3 23:47:29 host2 sshd[2134091]: Disconnected from invalid user sol 104.248.245.89 port 42126 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.91.252.38
country_id: 3017382
description:
Jan  3 23:48:19 host2 sshd[2135006]: Disconnected from invalid user claude 51.91.252.38 port 47254 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.248.245.89
country_id: 2921044
description:
Jan  3 23:48:26 host2 sshd[2135138]: Disconnected from invalid user claude 104.248.245.89 port 50542 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Jan  3 23:48:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<z7Me239H3LovT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Jan  3 23:49:37 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<YbdE3n9HKsEvT1jH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.248.245.89
country_id: 2921044
description:
Jan  3 23:49:49 host2 sshd[2136765]: Disconnected from invalid user it 104.248.245.89 port 40536 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.91.252.38
country_id: 3017382
description:
Jan  3 23:49:18 host2 sshd[2136076]: Disconnected from invalid user claude 51.91.252.38 port 59436 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  3 23:55:14 host2 pure-ftpd[2144468]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.140.19.22
country_id: 1269750
description:
Jan  4 00:00:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=103.140.19.22, lip=66.85.158.91, session=<lA9sBoBHMKJnjBMW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  4 00:04:12 host2 sshd[2156825]: Disconnected from invalid user admin 2.57.121.112 port 50833 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 00:07:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<vtnqHYBHpoSOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.223.83.53
country_id: 2510769
description:
Jan  4 00:08:01 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=82.223.83.53, lip=66.85.158.91, session=<1+UHIIBH7u1S31M1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.105.156.165
country_id: 3923057
description:
Jan  4 00:10:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@seyawin.com>, method=PLAIN, rip=200.105.156.165, lip=66.85.158.91, session=<SG+vKYBHdsTIaZyl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 00:11:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<avjQK4BH8tsjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 105.174.17.50
country_id: 3351879
description:
Jan  4 00:11:39 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=105.174.17.50, lip=66.85.158.91, session=<EfQOLYBHCJ9prhEy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 163.182.174.251
country_id: 6252001
description:
Jan  4 00:11:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=163.182.174.251, lip=66.85.158.91, session=<JyN6LYBHAMyjtq77>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 105.174.17.50
country_id: 3351879
description:
Jan  4 00:15:53 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=105.174.17.50, lip=66.85.158.91, session=<JI8tPIBHH9RprhEy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  4 00:16:30 host2 sshd[2171786]: Disconnected from invalid user user 2.57.121.25 port 17690 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Jan  4 00:18:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<GY2YRYBHlLekXF7M>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.119.99.179
country_id: 1831722
description:
Jan  4 00:19:38 host2 pure-ftpd[2175501]: (?@103.119.99.179) [INFO] New connection from 103.119.99.179


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Jan  4 00:20:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<rM2gS4BHNrqkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.223.83.53
country_id: 2510769
description:
Jan  4 00:21:14 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=82.223.83.53, lip=66.85.158.91, session=<KT5KT4BHrJlS31M1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.105.156.165
country_id: 3923057
description:
Jan  4 00:23:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@kiriaswanu.com>, method=PLAIN, rip=200.105.156.165, lip=66.85.158.91, session=<7yw+VoBH3rXIaZyl>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.62.197.122
country_id: 6252001
description:
Jan  4 00:24:17 host2 pure-ftpd[2181646]: (?@64.62.197.122) [INFO] New connection from 64.62.197.122


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 202.93.247.247
country_id: 1643084
description:
Jan  4 00:24:51 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=202.93.247.247, lip=66.85.158.91, session=<B6dFXIBHCOrKXff3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.169.82.194
country_id: 935317
description:
2026-01-04 00:25:46 dovecot_login authenticator failed for H=(165-169-82-194.zeop.re) [165.169.82.194]:52593: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.118
country_id: 1269750
description:
2026-01-04 00:26:19 dovecot_login authenticator failed for H=([125.18.210.161]) [182.95.119.118]:42206: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2026-01-04 00:28:55 dovecot_plain authenticator failed for H=(unkhoinkey) [12.150.243.22]:5859: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 00:30:00 host2 sshd[2187661]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 00:29:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<uc5lboBHJrFA46ZK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.62
country_id: 6252001
description:
Jan  4 00:31:39 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.62, lip=66.85.158.92, TLS: Connection closed, session=<WqirdIBH8kWnXpI+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 163.182.174.251
country_id: 6252001
description:
Jan  4 00:32:40 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=163.182.174.251, lip=66.85.158.91, session=<ZUY6eIBHNKejtq77>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 00:33:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<ttp+fIBHWoyOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.223.83.53
country_id: 2510769
description:
Jan  4 00:35:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=82.223.83.53, lip=66.85.158.91, session=<tmIIgoBHIrFS31M1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 163.182.174.251
country_id: 6252001
description:
Jan  4 00:38:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=163.182.174.251, lip=66.85.158.91, session=<qYpcjIBHAJejtq77>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.206.225.242
country_id: 6252001
description:
Jan  4 00:38:26 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=172.206.225.242, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<8hzxjIBHurKszuHy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.105.156.165
country_id: 3923057
description:
Jan  4 00:39:40 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@seyawin.com>, method=PLAIN, rip=200.105.156.165, lip=66.85.158.91, session=<UVc2kYBHDpHIaZyl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 00:39:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<VK8hkoBHiD4jupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.112.106.236
country_id: 3175395
description:
Jan  4 00:39:54 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=217.112.106.236, lip=66.85.158.91, TLS, session=<q0YwkYBHworZcGrs>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 174.138.59.242
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[174.138.59.242] [Remote Port]=[39476] [Authentication Database]=[mail] [Username]=[test@anandaobauae.org] (10/10 failures) (blocked until [Sun Jan  4 19:09:17 2026 UTC/Mon Jan  5 00:39:17 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 00:39:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<eR8DkIBHNJquijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.215
country_id: 3865483
description:
Jan  4 00:40:19 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<charanaw>, method=PLAIN, rip=179.0.250.215, lip=66.85.158.91, TLS, session=<9c1vkoBH66mzAPrX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 105.174.17.50
country_id: 3351879
description:
Jan  4 00:41:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@kiriaswanu.com>, method=PLAIN, rip=105.174.17.50, lip=66.85.158.91, session=<+phhl4BH+oxprhEy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 202.93.247.247
country_id: 1643084
description:
Jan  4 00:41:42 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=202.93.247.247, lip=66.85.158.91, session=<rI2BmIBHVp/KXff3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 00:45:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<nwxPpoBHuoBnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 105.174.17.50
country_id: 3351879
description:
Jan  4 00:45:40 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@seyawin.com>, method=PLAIN, rip=105.174.17.50, lip=66.85.158.91, session=<03y6poBHYbJprhEy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Jan  4 00:46:21 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@kiriaswanu.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<uFkhqYBHxq6kXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Jan  4 00:48:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@seyawin.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=</DM8r4BHGNqkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.223.83.53
country_id: 2510769
description:
Jan  4 00:48:56 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=82.223.83.53, lip=66.85.158.91, session=<485psoBHfpNS31M1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.105.156.165
country_id: 3923057
description:
Jan  4 00:52:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=200.105.156.165, lip=66.85.158.91, session=<QhG5voBHiLrIaZyl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.242.226.33
country_id: 6252001
description:
Jan  4 00:53:46 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=185.242.226.33, lip=66.85.158.92, TLS handshaking: Connection closed, session=<AeXPw4BHUOi58uIh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.239.77.14
country_id: 3996063
description:
Jan  4 00:53:52 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=45.239.77.14, lip=66.85.158.91, TLS, session=<C3UUw4BH/7ot700O>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 202.93.247.247
country_id: 1643084
description:
Jan  4 00:54:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=202.93.247.247, lip=66.85.158.91, session=<ZpssxYBH6MzKXff3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.96.195
country_id: 3469034
description:
Jan  4 00:54:12 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=191.240.96.195, lip=66.85.158.91, TLS, session=<twFDxIBHXqe/8GDD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.177.158
country_id: 6252001
description:
Jan  4 00:54:36 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.65.177.158, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<DHnIxoBH5LMUQbGe>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 00:57:19 host2 sshd[2217508]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.11.89.19
country_id: 6252001
description:
[2026-01-04 00:58:08 +0530] info [cpaneld] 45.11.89.19 - kamechot "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.153.188.246
country_id: 6252001
description:
Jan  4 00:58:23 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=148.153.188.246, lip=66.85.158.91, session=<ah1M1IBHIqeUmbz2>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.141
country_id: 6252001
description:
Jan  4 00:58:28 host2 pure-ftpd[2218813]: (?@66.132.153.141) [INFO] New connection from 66.132.153.141


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  4 00:58:51 host2 pure-ftpd[2219321]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 00:58:59 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<copS1oBHjKBA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 163.182.174.251
country_id: 6252001
description:
Jan  4 00:59:26 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=163.182.174.251, lip=66.85.158.91, session=<h47v14BHcLGjtq77>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 01:00:48 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<vW/Q3IBHgueOq2dI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.5.11
country_id: 6252001
description:
Jan  4 01:03:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 19 secs): user=<>, rip=45.79.5.11, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<3f/85IBH87UtTwUL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.223.83.53
country_id: 2510769
description:
Jan  4 01:03:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=82.223.83.53, lip=66.85.158.91, session=<9FrV5YBHbOZS31M1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 163.182.174.251
country_id: 6252001
description:
Jan  4 01:05:04 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=163.182.174.251, lip=66.85.158.91, session=<kn8P7IBHhuKjtq77>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 01:06:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<+S0E8IBHeDiuijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.105.156.165
country_id: 3923057
description:
Jan  4 01:09:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=200.105.156.165, lip=66.85.158.91, session=<5YaL+oBH6NXIaZyl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 01:08:49 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<MQ9/+YBHprkjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.51.216.210
country_id: 1269750
description:
Jan  4 01:09:59 host2 sshd[2232715]: Disconnected from invalid user claude 103.51.216.210 port 42936 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 202.93.247.247
country_id: 1643084
description:
Jan  4 01:11:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=202.93.247.247, lip=66.85.158.91, session=<PLlMAYFHGOHKXff3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 105.174.17.50
country_id: 3351879
description:
Jan  4 01:11:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=105.174.17.50, lip=66.85.158.91, session=<7LW3AoFHcr9prhEy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.41
country_id: 2750405
description:
2026-01-04 01:13:00 dovecot_login authenticator failed for H=(Copy-of-VM-2022) [45.94.31.41]:58286: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.147.24
country_id: 1643084
description:
Jan  4 01:13:27 host2 sshd[2237154]: Disconnected from invalid user github 103.187.147.24 port 55746 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.146.90
country_id: 1643084
description:
Jan  4 01:13:57 host2 sshd[2237617]: Disconnected from invalid user soporte 103.187.146.90 port 40646 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.187.146.90
country_id: 1643084
description:
Jan  4 01:14:36 host2 sshd[2238314]: Disconnected from invalid user devops 103.187.146.90 port 43848 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.138.75.244
country_id: 1733045
description:
Jan  4 01:14:44 host2 sshd[2238477]: Disconnected from invalid user dtl 175.138.75.244 port 45286 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.102.40.218
country_id: 6252001
description:
Jan  4 01:14:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=212.102.40.218, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<XCjUDoFHZtvUZija>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.49.117.132
country_id: 3686110
description:
Jan  4 01:14:13 host2 sshd[2237875]: Disconnected from invalid user webuser 181.49.117.132 port 41688 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Jan  4 01:14:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@kiriaswanu.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<rav+DYFHytukXF7M>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.203.166
country_id: 1880251
description:
Jan  4 01:14:11 host2 sshd[2237654]: Disconnected from invalid user www 45.78.203.166 port 58386 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.147.24
country_id: 1643084
description:
Jan  4 01:15:21 host2 sshd[2239422]: Disconnected from invalid user claude 103.187.147.24 port 35366 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.207.4.157
country_id: 2635167
description:
Jan  4 01:15:46 host2 sshd[2239957]: Disconnected from invalid user bitrix 92.207.4.157 port 54224 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.51.216.210
country_id: 1269750
description:
Jan  4 01:16:10 host2 sshd[2240368]: Disconnected from invalid user claude 103.51.216.210 port 51696 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.187.147.24
country_id: 1643084
description:
Jan  4 01:16:39 host2 sshd[2240877]: Disconnected from invalid user user 103.187.147.24 port 39312 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.189.29.175
country_id: 2960313
description:
Jan  4 01:17:08 host2 sshd[2241331]: Disconnected from invalid user claude 107.189.29.175 port 38836 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.207.4.157
country_id: 2635167
description:
Jan  4 01:16:21 host2 sshd[2240574]: Disconnected from invalid user claude 92.207.4.157 port 39564 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.146.90
country_id: 1643084
description:
Jan  4 01:17:05 host2 sshd[2241267]: Disconnected from invalid user claude 103.187.146.90 port 36150 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.138.75.244
country_id: 1733045
description:
Jan  4 01:17:09 host2 sshd[2241355]: Disconnected from invalid user bitrix 175.138.75.244 port 58060 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.51.216.210
country_id: 1269750
description:
Jan  4 01:17:21 host2 sshd[2241613]: Disconnected from invalid user claude 103.51.216.210 port 36612 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.207.4.157
country_id: 2635167
description:
Jan  4 01:17:28 host2 sshd[2241723]: Disconnected from invalid user pz 92.207.4.157 port 38464 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.146.90
country_id: 1643084
description:
Jan  4 01:17:40 host2 sshd[2241935]: Disconnected from invalid user ivan 103.187.146.90 port 44094 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.49.117.132
country_id: 3686110
description:
Jan  4 01:17:43 host2 sshd[2241922]: Disconnected from invalid user claude 181.49.117.132 port 54644 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.138.75.244
country_id: 1733045
description:
Jan  4 01:17:45 host2 sshd[2242037]: Disconnected from invalid user debian 175.138.75.244 port 41922 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.189.29.175
country_id: 2960313
description:
Jan  4 01:18:11 host2 sshd[2242534]: Disconnected from invalid user ftpuser 107.189.29.175 port 56314 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.51.216.210
country_id: 1269750
description:
Jan  4 01:18:31 host2 sshd[2242867]: Disconnected from invalid user www 103.51.216.210 port 53112 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.147.24
country_id: 1643084
description:
Jan  4 01:19:07 host2 sshd[2243510]: Disconnected from invalid user test 103.187.147.24 port 47008 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 175.138.75.244
country_id: 1733045
description:
Jan  4 01:18:20 host2 sshd[2242683]: Disconnected from invalid user mc 175.138.75.244 port 54020 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.138.75.244
country_id: 1733045
description:
Jan  4 01:19:34 host2 sshd[2243988]: Disconnected from invalid user test 175.138.75.244 port 49978 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2026-01-04 01:19:35 dovecot_plain authenticator failed for H=c-73-197-236-163.hsd1.nj.comcast.net (coarshew) [73.197.236.163]:47460: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 01:20:17 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<K/aBIoFHEoxnmud6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.66
country_id: 6252001
description:
Jan  4 01:20:29 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.20.66, lip=66.85.158.91, session=<AbVPI4FHTvZBMRRC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.49.117.132
country_id: 3686110
description:
Jan  4 01:20:55 host2 sshd[2246009]: Disconnected from invalid user dtl 181.49.117.132 port 33702 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.203.166
country_id: 1880251
description:
Jan  4 01:21:42 host2 sshd[2246783]: Disconnected from invalid user claude 45.78.203.166 port 42218 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.189.29.175
country_id: 2960313
description:
Jan  4 01:21:49 host2 sshd[2246911]: Disconnected from invalid user test 107.189.29.175 port 49826 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.192
country_id: 6252001
description:
Jan  4 01:21:36 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.192, lip=66.85.158.92, TLS handshaking: Connection closed, session=<CGZPJ4FHCOZAPpzA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.27
country_id: 798549
description:
Jan  4 01:21:29 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.27, lip=66.85.158.92, session=<ek3tJoFHhspV2ZUb>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 49.228.103.72
country_id: 1605651
description:
Jan  4 01:21:31 host2 sshd[2246622]: Disconnected from invalid user webuser 49.228.103.72 port 37310 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.228.103.72
country_id: 1605651
description:
Jan  4 01:21:17 host2 sshd[2246401]: Disconnected from invalid user claude 49.228.103.72 port 48708 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.197
country_id: 6252001
description:
Jan  4 01:21:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.197, lip=66.85.158.92, TLS handshaking: Connection closed, session=<ZcI7JoFHY0BAPpzF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.228.103.72
country_id: 1605651
description:
Jan  4 01:25:13 host2 sshd[2250810]: Disconnected from invalid user vivek 49.228.103.72 port 44448 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 01:28:08 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<mgSTPoFHFLJA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 01:27:56 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<OMzXPYFHeLmOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 01:32:59 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<5n3qT4FHwpyuijvy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.67
country_id: 6252001
description:
Jan  4 01:33:01 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.20.67, lip=66.85.158.92, session=<o10mUIFH1hJBMRRD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.3
country_id: 6252001
description:
Jan  4 01:34:02 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=74.82.47.3, lip=66.85.158.92, TLS handshaking: Connection closed, session=<7TrJU4FHpAxKUi8D>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.67
country_id: 6252001
description:
Jan  4 01:33:13 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=65.49.20.67, lip=66.85.158.92, TLS: Connection closed, session=<5QDbUIFHyItBMRRD>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.203.166
country_id: 1880251
description:
Jan  4 01:34:45 host2 sshd[2263064]: Disconnected from invalid user composeruser 45.78.203.166 port 41010 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.3
country_id: 6252001
description:
Jan  4 01:34:23 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=74.82.47.3, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Y/IIVYFHYDRKUi8D>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2026-01-04 01:35:50 dovecot_plain authenticator failed for H=c-174-161-27-82.hsd1.tn.comcast.net (bundum) [174.161.27.82]:42073: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 01:37:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<I4YbYIFHAmUjupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.99.128.35
country_id: 2921044
description:
Jan  4 01:40:04 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=167.99.128.35, lip=66.85.158.92, TLS handshaking: Connection closed, session=<OARkaYFHOs+nY4Aj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.223.31.123
country_id: 2921044
description:
Jan  4 01:39:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=159.223.31.123, lip=66.85.158.92, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<wjlAZ4FH7zqf3x97>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2026-01-04 01:47:20 dovecot_plain authenticator failed for H=(oviouss) [23.30.11.253]:44540: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.181.179
country_id: 6252001
description:
Jan  4 01:48:26 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=45.79.181.179, lip=66.85.158.91, TLS, session=<og1Nh4FHIsItT7Wz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  4 01:50:06 host2 sshd[2281658]: Disconnected from invalid user admin 2.57.121.112 port 30262 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.140.19.22
country_id: 1269750
description:
Jan  4 01:53:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=103.140.19.22, lip=66.85.158.91, session=<YKUEmYFHZpZnjBMW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 01:54:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<GEounIFHCOxnmud6>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 38.148.242.232
country_id: 6252001
description:
Jan  4 01:55:01 host2 pure-ftpd[2288188]: (?@38.148.242.232) [INFO] New connection from 38.148.242.232


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 01:55:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<56Rsn4FHbMWOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 01:57:27 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<NPJpp4FH5IJA46ZK>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.119.99.179
country_id: 1831722
description:
Jan  4 01:59:41 host2 pure-ftpd[2293630]: (?@103.119.99.179) [INFO] New connection from 103.119.99.179


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 02:00:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<ynOFsoFHNoquijvy>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  4 02:02:17 host2 pure-ftpd[2297173]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.86
country_id: 6252001
description:
Jan  4 02:04:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.86, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=</juAwYFHUsjG6xhW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Jan  4 02:06:06 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.92, TLS: Connection closed, session=<QnJ+xoFHhIWLonHU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 02:06:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<d1vXx4FHpsEjupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.172
country_id: 6252001
description:
Jan  4 02:12:03 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.172, lip=66.85.158.91, TLS handshaking: Connection closed, session=<H1a+24FHto1APpys>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2026-01-04 02:12:04 dovecot_plain authenticator failed for H=c-73-145-107-251.hsd1.mi.comcast.net (agnagis) [73.145.107.251]:34054: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.227.254.152
country_id: 3703430
description:
Jan  4 02:17:36 host2 pure-ftpd[2313891]: (?@45.227.254.152) [INFO] New connection from 45.227.254.152


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
country_id: 1269750
description:
2026-01-04 02:19:20 dovecot_login authenticator failed for H=(nsg-static-82.71.76.182-airtel.com) [182.76.71.82]:58716: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.10
country_id: 1269750
description:
2026-01-04 02:19:44 dovecot_login authenticator failed for H=([125.20.249.192]) [27.123.113.10]:37056: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 02:20:33 host2 sshd[2317085]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.94.106.254
country_id: 6252001
description:
Jan  4 02:20:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.94.106.254, lip=66.85.158.91, session=<W+X8+YFHOLVCXmr+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  4 02:21:29 host2 sshd[2318046]: Disconnected from invalid user admin 2.57.121.112 port 65261 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 02:22:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<eN+EAIJHjJSOq2dI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2026-01-04 02:23:17 dovecot_plain authenticator failed for H=c-73-145-107-251.hsd1.mi.comcast.net (nones) [73.145.107.251]:39460: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.156.129.83
country_id: 2264397
description:
Jan  4 02:23:23 host2 pure-ftpd[2320110]: (?@45.156.129.83) [INFO] New connection from 45.156.129.83


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.156.129.82
country_id: 2264397
description:
Jan  4 02:23:24 host2 pure-ftpd[2320127]: (?@45.156.129.82) [INFO] New connection from 45.156.129.82


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.156.129.80
country_id: 2264397
description:
Jan  4 02:23:26 host2 pure-ftpd[2320178]: (?@45.156.129.80) [INFO] New connection from 45.156.129.80


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.70
country_id: 6252001
description:
Jan  4 02:25:16 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.70, lip=66.85.158.91, TLS handshaking: Connection closed, session=<JAH/CoJHl7RBMQFG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.66
country_id: 6252001
description:
Jan  4 02:25:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.66, lip=66.85.158.91, TLS handshaking: Connection closed, session=<skMKDIJHDN9BMQFC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.140.19.22
country_id: 1269750
description:
Jan  4 02:26:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.140.19.22, lip=66.85.158.91, session=<FQeAD4JHgrFnjBMW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 02:27:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<k4WgEYJHurxA46ZK>


