# incident

plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Jan  6 01:25:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<M84jcKlHUu0vT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  6 01:26:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<yyBOc6lHRuwvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.12
country_id: 3175395
description:
Jan  6 01:28:03 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.197.9.12, lip=66.85.158.91, TLS, session=<PqIfealH/oi5xQkM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.133
country_id: 6252001
description:
Jan  6 01:27:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.133, lip=66.85.158.91, TLS handshaking: Connection closed, session=<S74YeKlHSchAPpyF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.177.113.32
country_id: 3175395
description:
Jan  6 01:27:35 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=195.177.113.32, lip=66.85.158.91, TLS, session=<zLhwd6lHHefDsXEg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.132
country_id: 6252001
description:
Jan  6 01:27:48 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.132, lip=66.85.158.91, TLS handshaking: Connection closed, session=<0w0wealHcE5APpyE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 01:29:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<Nn9SgKlHmsxCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.37.11.109
country_id: 3469034
description:
Jan  6 01:30:09 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=191.37.11.109, lip=66.85.158.91, TLS, session=<d2uEgKlHDMa/JQtt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  6 01:30:14 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<T1+/galHmKYvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.17.108.155
country_id: 6290252
description:
Jan  6 01:30:39 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 29 secs): user=<hr>, method=PLAIN, rip=217.17.108.155, lip=66.85.158.91, TLS handshaking: Connection closed, session=<sxesgalHwuXZEWyb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 143.0.0.50
country_id: 3469034
description:
Jan  6 01:30:57 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=143.0.0.50, lip=66.85.158.91, TLS, session=<BKJzhKlHrNSPAAAy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.70
country_id: 1269750
description:
2026-01-06 01:32:01 dovecot_login authenticator failed for H=([125.17.70.25]) [125.20.251.70]:42238: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.158.138.179
country_id: 1269750
description:
2026-01-06 01:32:25 dovecot_login authenticator failed for H=([103.158.138.179]) [103.158.138.179]:58162: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.217.241.75
country_id: 6251999
description:
Jan  6 01:34:41 host2 sshd[1225703]: Disconnected from invalid user daniel 144.217.241.75 port 46796 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 01:34:48 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<92IbkqlHKp1m2gqW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.254.21
country_id: 1819730
description:
Jan  6 01:36:19 host2 sshd[1227545]: Disconnected from invalid user daniel 152.32.254.21 port 32176 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.254.21
country_id: 1819730
description:
Jan  6 01:36:53 host2 sshd[1228149]: Disconnected from invalid user claude 152.32.254.21 port 43728 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  6 01:37:06 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<hOVNmqlHqIyygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan  6 01:37:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<2HFmm6lH3Jcv/lVz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.254.21
country_id: 1819730
description:
Jan  6 01:37:27 host2 sshd[1228710]: Disconnected from invalid user client 152.32.254.21 port 55282 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.217.241.75
country_id: 6251999
description:
Jan  6 01:37:31 host2 sshd[1228781]: Disconnected from invalid user client 144.217.241.75 port 59564 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 144.217.241.75
country_id: 6251999
description:
Jan  6 01:38:31 host2 sshd[1229929]: Disconnected from invalid user build 144.217.241.75 port 56364 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 01:38:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<RzYWoKlH3MMIijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Jan  6 01:39:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@dataesite.lk>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<xjOqo6lHVKiB4kCN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.217.241.75
country_id: 6251999
description:
Jan  6 01:39:59 host2 sshd[1231202]: Disconnected from invalid user claude 144.217.241.75 port 58196 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.115
country_id: 6252001
description:
Jan  6 01:40:32 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.115, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<JSizpqlHjM/G6xhz>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.235
country_id: 6252001
description:
Jan  6 01:42:32 host2 pure-ftpd[1233693]: (?@195.184.76.235) [INFO] New connection from 195.184.76.235


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.12
country_id: 6252001
description:
Jan  6 01:42:31 host2 pure-ftpd[1233691]: (?@195.184.76.12) [INFO] New connection from 195.184.76.12


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.224.26
country_id: 1269750
description:
2026-01-06 01:43:20 dovecot_login authenticator failed for H=([152.52.224.26]) [152.52.224.26]:33360: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.0.141.138
country_id: 2750405
description:
2026-01-06 01:44:18 dovecot_login authenticator failed for H=(lezzarotech.com) [136.0.141.138]:52905: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 01:44:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<RHrEtalHMp4vWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 01:45:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<RM0dt6lHlr0vWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 01:45:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<RAd7t6lHCOMifrCV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 01:45:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<XZawt6lH0NlA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 01:45:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<PxX+t6lHgpwIijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 01:47:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<dxjovqlHKPR100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 01:48:51 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<QN5WxKlHWpRA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 01:49:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<Yc5RxqlHKulm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  6 01:49:35 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<XfD7xqlHuuOi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 01:50:05 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<7hXDyKlH0oKi8KbF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.124.28
country_id: 3042225
description:
2026-01-06 01:49:08 dovecot_login authenticator failed for H=(ADMIN) [91.90.124.28]:21639: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  6 01:49:17 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<bNXoxalHCO0yBvlc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.232
country_id: 6252001
description:
Jan  6 01:52:47 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.232, lip=66.85.158.92, TLS handshaking: Connection closed, session=<FCqP0qlHsvlBMQHo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 01:52:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<4re20qlHVugIhpC/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.232
country_id: 6252001
description:
Jan  6 01:53:15 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.232, lip=66.85.158.92, TLS: Connection closed, session=<7psz1KlH9P1BMQHo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Jan  6 01:53:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<qcKR1KlHQKGPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  6 01:54:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<1Eiq16lHitGi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 01:54:47 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<VbeT2alHtNOi8GQy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.244.49.14
country_id: 1668284
description:
Jan  6 01:55:15 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=173.244.49.14, lip=66.85.158.91, TLS handshaking: Connection closed, session=<zZlW26lHvuCt9DEO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.88.26.16
country_id: 294640
description:
Jan  6 01:55:16 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=149.88.26.16, lip=66.85.158.91, session=<n6to26lHBJqVWBoQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.70.11.12
country_id: 3895114
description:
Jan  6 01:55:15 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=146.70.11.12, lip=66.85.158.91, TLS, session=<J2tV26lHzuCSRgsM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 116.90.74.165
country_id: 2186224
description:
Jan  6 01:55:16 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=116.90.74.165, lip=66.85.158.91, session=<aOFt26lHxCJ0Wkql>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 01:55:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<nnoA3KlHoIIyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  6 01:55:41 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<af7E3KlHbJSygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  6 01:56:40 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@lankaherbalsolutions.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<a2NQ4KlHbIIvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Jan  6 01:56:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<owl34KlHCNVetwuC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  6 01:59:58 host2 sshd[1243713]: Disconnected from invalid user admin 2.57.121.112 port 16993 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 02:00:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<aewK7qlHJJhCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  6 02:00:48 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@sobaherbal.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<iBAX76lHitMvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Jan  6 02:02:42 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@melanifinefood.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<rX3k9alHWN0vT1jH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2026-01-06 02:03:58 dovecot_plain authenticator failed for H=c-73-13-220-220.hsd1.de.comcast.net (sthral) [73.13.220.220]:47788: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.37.122.175
country_id: 1643084
description:
Jan  6 02:05:24 host2 sshd[1248008]: Disconnected from invalid user claude 36.37.122.175 port 58436 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan  6 02:06:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<S/jlBKpHhJIv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2026-01-06 02:07:14 dovecot_login authenticator failed for H=([125.20.249.39]) [128.185.214.78]:45724: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.115.173.11
country_id: 1269750
description:
2026-01-06 02:07:46 dovecot_login authenticator failed for H=([45.115.173.11]) [45.115.173.11]:47304: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.37.122.175
country_id: 1643084
description:
Jan  6 02:08:02 host2 sshd[1250473]: Disconnected from invalid user claude 36.37.122.175 port 33966 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.72.22.61
country_id: 6251999
description:
2026-01-06 02:08:06 dovecot_login authenticator failed for H=static24-72-22-61.r.rev.accesscomm.ca [24.72.22.61]:55181: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 02:07:35 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<5NdLB6pH7uVm2gqW>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 02:08:24 host2 sshd[1250910]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.37.122.175
country_id: 1643084
description:
Jan  6 02:09:23 host2 sshd[1251744]: Disconnected from invalid user claude 36.37.122.175 port 35052 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  6 02:10:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<7M8PE6pH1tyygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 02:12:06 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<RdJ2F6pHLtMIijoY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2026-01-06 02:12:26 dovecot_plain authenticator failed for H=(mazonodly) [91.73.188.251]:58173: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.118.53
country_id: 3865483
description:
2026-01-06 02:13:16 dovecot_login authenticator failed for H=([167.250.118.53]) [167.250.118.53]:45030: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.213.10
country_id: 933860
description:
Jan  6 02:13:19 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=41.216.213.10, lip=66.85.158.91, TLS, session=<n1uIGqpHieEp2NUK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.90.94
country_id: 1269750
description:
2026-01-06 02:13:36 dovecot_login authenticator failed for H=([182.95.85.106]) [27.123.90.94]:56204: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.73.136
country_id: 3469034
description:
Jan  6 02:13:42 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<charanaw>, method=PLAIN, rip=187.120.73.136, lip=66.85.158.91, TLS, session=<47kbHKpH5Oq7eEmI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 02:15:51 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@lankaherbalsolutions.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<It/nJKpHStsvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 02:16:14 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@sobaherbal.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<5SxFJqpHaIwvWBNS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  6 02:17:21 host2 sshd[1259788]: Disconnected from invalid user admin 2.57.121.112 port 49270 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 02:17:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<b0D/K6pH7pdA46ZK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.122
country_id: 6252001
description:
Jan  6 02:18:22 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.122, lip=66.85.158.91, TLS handshaking: Connection closed, session=<a1YALqpHcPFAPpx6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.2
country_id: 6252001
description:
Jan  6 02:18:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=74.82.47.2, lip=66.85.158.91, session=<8K2pLqpHihdKUi8C>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 02:18:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<cauZL6pH3qsIijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 02:19:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<cZskMKpHVqoifrCV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  6 02:20:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 7 secs): user=<finance@melanifinefood.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<6HSoM6pHLJ4yBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 02:20:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<+fgzNapHotx100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 02:20:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<ptLWNqpHxtGi8KbF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  6 02:21:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<y3QcOKpHXHGi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 02:21:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<GpuGOKpHOshA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 02:21:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<qGGLOqpHNIJm2gqW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.178
country_id: 3144096
description:
2026-01-06 02:22:33 dovecot_login authenticator failed for H=(cm-84.213.189.178.get.no) [84.213.189.178]:49566: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.226.8
country_id: 6252001
description:
Jan  6 02:22:57 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.65.226.8, lip=66.85.158.92, session=<aAFrPqpHQpUUQeII>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Jan  6 02:23:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@rehanseo.online>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<fhhJQKpHutyPbtX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.238.122
country_id: 2542007
description:
2026-01-06 02:23:36 dovecot_login authenticator failed for H=([154.146.238.122]) [154.146.238.122]:57624: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  6 02:24:38 host2 sshd[1266439]: Disconnected from invalid user user 2.57.121.25 port 48788 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 02:25:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<jsloR6pHKJoyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  6 02:25:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@nsteeleng.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<eJLUSKpH5JGi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 02:25:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<uTFCRqpHlKWi8GQy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.237.125.78
country_id: 6252001
description:
Jan  6 02:26:09 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=135.237.125.78, lip=66.85.158.91, session=<lTnYSapHyIWH7X1O>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 02:26:47 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<T2EFTKpHzI4IhpC/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  6 02:27:32 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@lankaherbalsolutions.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<HvqwTqpHeNMvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Jan  6 02:29:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<4GtxVKpHSgtetwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  6 02:29:27 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<8R6EVapHFumygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 02:31:14 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<HXvrW6pHYJBCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  6 02:31:40 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@sobaherbal.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<wuJ5XapH6M0vWfaQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2026-01-06 02:32:08 dovecot_plain authenticator failed for H=c-98-227-25-115.hsd1.il.comcast.net (piting) [98.227.25.115]:44570: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.149.27.208
country_id: 1819730
description:
Jan  6 02:33:20 host2 sshd[1275113]: Disconnected from invalid user yangkai 103.149.27.208 port 44518 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.122
country_id: 6252001
description:
Jan  6 02:33:51 host2 pure-ftpd[1275588]: (?@66.132.153.122) [INFO] New connection from 66.132.153.122


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.149.27.208
country_id: 1819730
description:
Jan  6 02:34:31 host2 sshd[1276176]: Disconnected from invalid user test123 103.149.27.208 port 42406 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.149.27.208
country_id: 1819730
description:
Jan  6 02:35:42 host2 sshd[1277591]: Disconnected from invalid user claude 103.149.27.208 port 34432 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan  6 02:36:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<c0CTbqpHGI0v/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 02:40:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<IVXwe6pHXqJm2gqW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.4.145.50
country_id: 1210997
description:
Jan  6 02:45:05 host2 sshd[1288269]: Disconnected from invalid user vpn 103.4.145.50 port 55236 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.4.145.50
country_id: 1210997
description:
Jan  6 02:44:25 host2 sshd[1287405]: Disconnected from invalid user claude 103.4.145.50 port 42966 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  6 02:44:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<XAo1jKpH3qOygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 02:45:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<r9UGj6pHcOIIijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 02:47:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@lankaherbalsolutions.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<4siAlKpHwqovWBNS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.76.120.106
country_id: 1643084
description:
Jan  6 02:47:09 host2 sshd[1290841]: Disconnected from invalid user claude 103.76.120.106 port 47782 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 02:47:27 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@sobaherbal.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<gtzklapHMsovWBNS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.4.145.50
country_id: 1210997
description:
Jan  6 02:47:40 host2 sshd[1291197]: Disconnected from invalid user claude 103.4.145.50 port 47860 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.190.22.247
country_id: 2750405
description:
Jan  6 02:48:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=146.190.22.247, lip=66.85.158.91, session=<hi5qmqpHkouSvhb3>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.76.120.106
country_id: 1643084
description:
Jan  6 02:49:53 host2 sshd[1293213]: Disconnected from invalid user lek 103.76.120.106 port 48008 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 02:51:07 host2 sshd[1294683]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 02:50:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<+BGwn6pHbq9A46ZK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.76.120.106
country_id: 1643084
description:
Jan  6 02:50:31 host2 sshd[1294018]: Disconnected from invalid user caja01 103.76.120.106 port 48064 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  6 02:50:42 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<PXiNoapHouMyBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 02:51:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<RVLbpapHvtWi8KbF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.87.21.241
country_id: 953987
description:
Jan  6 02:51:43 host2 sshd[1295198]: Disconnected from invalid user kamil 20.87.21.241 port 46112 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 02:52:56 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<HDmJqapH6MgifrCV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 02:52:16 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<HtMkp6pHGLsIijoY>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.87.21.241
country_id: 953987
description:
Jan  6 02:52:34 host2 sshd[1296119]: Disconnected from invalid user marcelo 20.87.21.241 port 48030 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  6 02:53:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<JdBjqqpHIGqi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 02:53:32 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<GfGvq6pHPFB100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 02:53:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<arBQrKpHGqtA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Jan  6 02:54:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@rehanseo.online>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<MdUQrqpHQqCPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 02:54:47 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<y+QjsKpHeNVm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 02:55:41 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<mG9fs6pH+OSi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 02:56:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<WgevtKpHsuMyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  6 02:58:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@nsteeleng.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<WRnYu6pH6Cyi8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2026-01-06 02:57:11 dovecot_login authenticator failed for H=([152.52.234.134]) [125.20.245.182]:47492: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.205.169
country_id: 1733045
description:
2026-01-06 02:57:31 dovecot_login authenticator failed for H=([49.124.205.169]) [49.124.205.169]:34458: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.148.0.202
country_id: 6252001
description:
2026-01-06 02:57:51 dovecot_login authenticator failed for H=syn-131-148-000-202.biz.spectrum.com [131.148.0.202]:54354: 535 Incorrect authentication data (set_id=marketing)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 162.240.154.125
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[162.240.154.125] [Remote Port]=[11496] [Authentication Database]=[mail] [Username]=[finance@nsteeleng.com] (10/10 failures) (blocked until [Tue Jan  6 21:28:01 2026 UTC/Wed Jan  7 02:58:01 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  6 02:58:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<oY27vqpH5q8vWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 03:00:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<QZzkw6pHNuYIhpC/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Jan  6 03:00:57 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<lbotxqpHJ9VetwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 03:02:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<H6R6yqpHiulCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  6 03:03:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<KR2xzapHwIsvWfaQ>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 47.89.246.144
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[47.89.246.144] [Remote Port]=[35776] [Authentication Database]=[mail] [Username]=[sales@sobaherbal.com] (10/10 failures) (blocked until [Tue Jan  6 21:33:01 2026 UTC/Wed Jan  7 03:03:01 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  6 03:03:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<vDvdzqpHcNCygBt7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2026-01-06 03:07:08 dovecot_login authenticator failed for H=([128.185.189.57]) [182.78.79.134]:40614: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan  6 03:06:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<l8un2apHXIcv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.172
country_id: 3144096
description:
2026-01-06 03:07:29 dovecot_login authenticator failed for H=(172-161-97-62.cust.smartcall.no) [62.97.161.172]:60708: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.54.18.220
country_id: 1694008
description:
Jan  6 03:10:20 host2 sshd[1313364]: Disconnected from invalid user claude 122.54.18.220 port 58575 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.80
country_id: 2328926
description:
Jan  6 03:11:05 host2 sshd[1314210]: Disconnected from invalid user claude 102.88.137.80 port 1491 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.68.9.182
country_id: 6252001
description:
Jan  6 03:11:07 host2 sshd[1314245]: Disconnected from invalid user claude 138.68.9.182 port 45072 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.54.18.220
country_id: 1694008
description:
Jan  6 03:11:46 host2 sshd[1314735]: Disconnected from invalid user ctf 122.54.18.220 port 24780 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.47.94.55
country_id: 1643084
description:
Jan  6 03:13:54 host2 sshd[1316970]: Disconnected from invalid user claude 38.47.94.55 port 47054 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.68.9.182
country_id: 6252001
description:
Jan  6 03:14:43 host2 sshd[1317783]: Disconnected from invalid user ctf 138.68.9.182 port 57038 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.68.9.182
country_id: 6252001
description:
Jan  6 03:15:40 host2 sshd[1318834]: Disconnected from invalid user john 138.68.9.182 port 54200 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.88.137.80
country_id: 2328926
description:
Jan  6 03:15:46 host2 sshd[1318966]: Disconnected from invalid user jhcho 102.88.137.80 port 1267 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.128.181.199
country_id: 357994
description:
Jan  6 03:16:52 host2 sshd[1319978]: Disconnected from invalid user claude 41.128.181.199 port 58292 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.80
country_id: 2328926
description:
Jan  6 03:16:24 host2 sshd[1319614]: Disconnected from invalid user reporting 102.88.137.80 port 33759 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Jan  6 03:17:51 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<uHOnAqtHKI0vT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  6 03:18:16 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<NSwdBKtHEoiygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 03:18:34 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<H0QwBatHcugvWBNS>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 47.88.19.82
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[47.88.19.82] [Remote Port]=[39314] [Authentication Database]=[mail] [Username]=[contact@sobaherbal.com] (10/10 failures) (blocked until [Tue Jan  6 21:48:55 2026 UTC/Wed Jan  7 03:18:55 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 03:19:02 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<TF/YBqtHWoMIijoY>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 178.128.27.123
country_id: 1880251
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[178.128.27.123] [Remote Port]=[34834] [Authentication Database]=[mail] [Username]=[sales@sobaherbal.com] (10/10 failures) (blocked until [Tue Jan  6 21:48:14 2026 UTC/Wed Jan  7 03:18:14 2026 LOCAL])


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 41.128.181.199
country_id: 357994
description:
Jan  6 03:19:36 host2 sshd[1322804]: Received disconnect from 41.128.181.199 port 44126:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.128.181.199
country_id: 357994
description:
Jan  6 03:19:36 host2 sshd[1322804]: Disconnected from invalid user claude 41.128.181.199 port 44126 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.211.28.92
country_id: 6252001
description:
[2026-01-06 03:20:28 +0530] info [whostmgrd] 74.211.28.92 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  6 03:20:42 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<35fWDKtHjNcyBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 03:23:04 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<DA5OFatHYrSi8KbF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.141.74
country_id: 298795
description:
2026-01-06 03:22:18 dovecot_plain authenticator failed for H=(peffres) [5.11.141.74]:39750: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.104
country_id: 6252001
description:
Jan  6 03:22:26 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.104, lip=66.85.158.92, TLS, session=<ZcwrE6tHJuzG6xho>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 03:22:53 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<Wt2gFKtHtuJA46ZK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.157.219.158
country_id: 6252001
description:
2026-01-06 03:24:01 dovecot_plain authenticator failed for H=c-76-157-219-158.hsd1.il.comcast.net (vates) [76.157.219.158]:55828: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Jan  6 03:25:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@rehanseo.online>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<m8veHKtHVs+PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  6 03:25:39 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<ExaJHqtHrF6i8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 03:25:48 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<8g0MH6tHWMoIijoY>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 8.138.58.24
country_id: 1814991
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[8.138.58.24] [Remote Port]=[51800] [Authentication Database]=[mail] [Username]=[support@lankaherbalsolutions.com] (10/10 failures) (blocked until [Tue Jan  6 21:55:46 2026 UTC/Wed Jan  7 03:25:46 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 03:27:04 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<3ZecI6tHRNQifrCV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 03:26:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<mSWSIKtHarWi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 03:26:27 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<zhxgIatHMOdA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 03:26:32 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<ugy1IatHk55100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 03:26:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<ZmILIqtHopoyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 03:27:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<wyF7JqtHxLdm2gqW>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 102.218.10.150
country_id: 51537
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[102.218.10.150] [Remote Port]=[47044] [Authentication Database]=[mail] [Username]=[help@anandaobauae.org] (10/10 failures) (blocked until [Tue Jan  6 21:57:50 2026 UTC/Wed Jan  7 03:27:50 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  6 03:29:53 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<ZJqoLatHErYvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  6 03:30:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@nsteeleng.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<v6aVL6tHkHmi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 03:32:51 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<XkJMOKtH8t9CdMzo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.154
country_id: 3144096
description:
2026-01-06 03:32:11 dovecot_login authenticator failed for H=(cm-84.213.189.154.get.no) [84.213.189.154]:57285: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.68
country_id: 1733045
description:
2026-01-06 03:32:30 dovecot_login authenticator failed for H=([49.125.201.68]) [49.125.201.68]:49786: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Jan  6 03:32:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<H8HbN6tHyjhetwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  6 03:33:59 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<E/ZXPKtHmt4vWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 03:34:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<xUyNPKtHxNQIhpC/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan  6 03:36:14 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<MdpnRKtH6IEv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  6 03:36:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<wC6dRKtHBIOygBt7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.128.214.238
country_id: 798544
description:
Jan  6 03:41:10 host2 sshd[1344302]: Disconnected from invalid user claude 57.128.214.238 port 39754 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.40.122.250
country_id: 2629691
description:
2026-01-06 03:41:33 dovecot_login authenticator failed for H=nova-185-040-122-250.cpe.novanet.is [185.40.122.250]:41118: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.221.180
country_id: 3144096
description:
2026-01-06 03:41:45 dovecot_login authenticator failed for H=(cm-178.232.221.180.get.no) [178.232.221.180]:37561: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.128.214.238
country_id: 798544
description:
Jan  6 03:45:40 host2 sshd[1347972]: Disconnected from invalid user user 57.128.214.238 port 58144 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.135.241.151
country_id: 130758
description:
Jan  6 03:45:45 host2 sshd[1348092]: Disconnected from invalid user camera 45.135.241.151 port 37820 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.157.177.161
country_id: 1733045
description:
Jan  6 03:45:50 host2 sshd[1348308]: Disconnected from invalid user ali 202.157.177.161 port 32980 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 57.128.214.238
country_id: 798544
description:
Jan  6 03:46:10 host2 sshd[1348588]: Disconnected from invalid user minecraft 57.128.214.238 port 50190 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 03:46:17 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<0V5SaKtHHoxm2gqW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.128.214.238
country_id: 798544
description:
Jan  6 03:47:08 host2 sshd[1349489]: Disconnected from invalid user anthony 57.128.214.238 port 51006 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.157.177.161
country_id: 1733045
description:
Jan  6 03:47:32 host2 sshd[1349747]: Disconnected from invalid user db2fenc1 202.157.177.161 port 39314 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.135.241.151
country_id: 130758
description:
Jan  6 03:48:13 host2 sshd[1350142]: Disconnected from invalid user alberto 45.135.241.151 port 44982 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 03:49:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<1dEhdatHqLcvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 03:50:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<KhODdqtHCNcvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  6 03:50:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@melanifinefood.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<XNTjd6tHTqoyBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  6 03:51:29 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<AeHleqtHWrOygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 03:52:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<w9MHgKtHypIIijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 03:54:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<EAlKhatHspmi8KbF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Jan  6 03:55:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<FsMOiqtHXoAvT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Jan  6 03:56:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@rehanseo.online>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<j15JjKtHILaPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 03:56:37 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<ucBFjatHKIai8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 03:56:14 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<Mn3ji6tHlrpA46ZK>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 03:58:05 host2 sshd[1357685]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  6 03:58:14 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<CtYMk6tHSLWi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 03:58:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<Ct1Lk6tHeMsyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 03:59:32 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<lfOtl6tHSdJ100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 04:00:26 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<bCDrmqtHDqlA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 04:01:01 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<6zAHnatHxtkIijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  6 04:01:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<XJ1dnatHHo4vWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 04:01:08 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<QZtonatH5ogifrCV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 04:02:40 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<PFbnoqtH7rFm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  6 04:02:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<P3LTo6tHwqSi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 04:03:47 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<NEXrpqtHXN5CdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Jan  6 04:04:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<hCV2qatHuWtetwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  6 04:05:17 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<EaQ/rKtH0rYvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan  6 04:06:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<tVf/rqtHkOov/lVz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.211.209.191
country_id: 2464461
description:
Jan  6 04:06:18 host2 sshd[1364537]: Disconnected from invalid user odoo 102.211.209.191 port 49350 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.76.82.80
country_id: 2328926
description:
Jan  6 04:06:33 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=41.76.82.80, lip=66.85.158.91, TLS, session=<MJzRr6tHJuYpTFJQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.210
country_id: 6252001
description:
Jan  6 04:06:51 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.230.168.210, lip=66.85.158.91, TLS handshaking: Connection closed, session=<D3L+satH69Bb5qjS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.41.71
country_id: 953987
description:
Jan  6 04:06:56 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<charanaw>, method=PLAIN, rip=102.64.41.71, lip=66.85.158.91, TLS, session=<5hkOsatHNJpmQClH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.93
country_id: 6252001
description:
Jan  6 04:07:01 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.230.168.93, lip=66.85.158.91, TLS: Connection closed, session=<ptacsqtHadpb5qhd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.91
country_id: 6252001
description:
Jan  6 04:07:14 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.230.168.91, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<FQtds6tHLcRb5qhb>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.211.209.191
country_id: 2464461
description:
Jan  6 04:07:17 host2 sshd[1364981]: Disconnected from invalid user ubuntu 102.211.209.191 port 33998 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.214
country_id: 6252001
description:
Jan  6 04:07:17 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.230.168.214, lip=66.85.158.91, TLS: Connection closed, session=<cI2Ls6tH5YVb5qjW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.175.193.205
country_id: 1269750
description:
Jan  6 04:08:34 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@sobaherbal.com>, method=PLAIN, rip=122.175.193.205, lip=66.85.158.91, session=<y4wCuKtHCs16r8HN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 04:09:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<E7/yuqtHUt8IhpC/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  6 04:10:04 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<++RcvatHysGygBt7>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.161.114.113
country_id: 2017370
description:
[2026-01-06 04:10:43 +0530] info [cpaneld] 195.161.114.113 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.137.32.187
country_id: 3017382
description:
Jan  6 04:12:06 host2 sshd[1370083]: Disconnected from invalid user test 79.137.32.187 port 56624 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.17
country_id: 6252001
description:
Jan  6 04:12:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.230.168.17, lip=66.85.158.91, TLS handshaking: Connection closed, session=<IYrtxatHuYtb5qgR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.31
country_id: 6252001
description:
Jan  6 04:12:36 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.230.168.31, lip=66.85.158.91, TLS: Connection closed, session=<Up+JxqtH955b5qgf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.29
country_id: 6252001
description:
Jan  6 04:12:51 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.230.168.29, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<O8h4x6tH8YJb5qgd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.30
country_id: 6252001
description:
Jan  6 04:12:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.230.168.30, lip=66.85.158.91, TLS: Connection closed, session=<vjanx6tHcetb5qge>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-06 04:13:09 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:50227: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 79.137.32.187
country_id: 3017382
description:
Jan  6 04:14:15 host2 sshd[1372102]: Disconnected from invalid user sysadmin 79.137.32.187 port 43062 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.137.32.187
country_id: 3017382
description:
Jan  6 04:15:27 host2 sshd[1373590]: Disconnected from invalid user ubuntu 79.137.32.187 port 45068 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.175.193.205
country_id: 1269750
description:
Jan  6 04:15:34 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=122.175.193.205, lip=66.85.158.91, session=<MX0O0atH0N16r8HN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.144.27.228
country_id: 6252001
description:
2026-01-06 04:18:10 dovecot_plain authenticator failed for H=c-73-144-27-228.hsd1.mi.comcast.net (brobowl) [73.144.27.228]:60834: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.92.242.178
country_id: 2750405
description:
[2026-01-06 04:19:33 +0530] info [cpaneld] 91.92.242.178 - cloudtourssrilan "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.96.197.166
country_id: 3865483
description:
Jan  6 04:20:18 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=186.96.197.166, lip=66.85.158.91, TLS, session=<fvT+4KtH/p66YMWm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.197
country_id: 3469034
description:
Jan  6 04:20:49 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=177.44.96.197, lip=66.85.158.91, TLS, session=<KyTd4qtHkZexLGDF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 04:21:05 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<cZDH5KtH4IYvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 04:21:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<WBwk5qtHQqYvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 04:21:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<iPRS5qtH/JNm2gqW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.172.190.181
country_id: 2921044
description:
Jan  6 04:22:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.172.190.181, lip=66.85.158.92, session=<rNLX6KtHQ3CnrL61>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 161.35.79.234
country_id: 2921044
description:
Jan  6 04:22:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=161.35.79.234, lip=66.85.158.92, session=<zkzf6KtHsJyhI0/q>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  6 04:23:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<S0RH7KtHCK0yBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  6 04:24:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<WrL68atH4OiygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 04:27:01 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<IOb6+atHwsWi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 04:27:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<BiFT+6tHLpKi8KbF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Jan  6 04:27:27 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@rehanseo.online>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=</fSN+6tHTJGPbtX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.209
country_id: 3996063
description:
2026-01-06 04:27:45 dovecot_login authenticator failed for H=([177.236.146.209]) [177.236.146.209]:48588: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 04:27:59 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<hats/atHDqIIijoY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.103
country_id: 6252001
description:
Jan  6 04:28:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.103, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<QDok/qtHwsuTuYRn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.228.53.136
country_id: 6252001
description:
Jan  6 04:28:52 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=66.228.53.136, lip=66.85.158.91, session=<D9K5AKxHarpC5DWI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-06 04:29:00 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (pnonglos) [87.103.126.54]:7277: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.248.111.238
country_id: 6252001
description:
2026-01-06 04:29:27 dovecot_plain authenticator failed for H=(uncot) [38.248.111.238]:55185: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  6 04:29:56 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@bostonlanka.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<YXZzBKxHhuKi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 04:30:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<yyYWBaxHsMsyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 04:29:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<PQ28AaxHdMBA46ZK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.226.119.1
country_id: 2921044
description:
Jan  6 04:30:58 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.226.119.1, lip=66.85.158.92, session=<cddACKxHuXRA4ncB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.59.134.178
country_id: 2921044
description:
Jan  6 04:30:59 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.59.134.178, lip=66.85.158.92, session=<u85GCKxH8EGLO4ay>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  6 04:31:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<gAd0C6xHQtAvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 04:32:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<fQ1HDaxHxst100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 04:32:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<uKYcDqxHBJtA46ZK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.213.126
country_id: 1819730
description:
Jan  6 04:32:49 host2 sshd[1391714]: Disconnected from invalid user es 123.58.213.126 port 37566 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 123.58.213.126
country_id: 1819730
description:
Jan  6 04:33:33 host2 sshd[1392087]: Disconnected from invalid user docker 123.58.213.126 port 38214 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  6 04:34:36 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@nsteeleng.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<I2wcFaxHxkqi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 04:34:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<+2eEFaxHBukIijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 04:35:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<IRj8FqxHvsEifrCV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.213.126
country_id: 1819730
description:
Jan  6 04:34:24 host2 sshd[1392421]: Disconnected from invalid user admin 123.58.213.126 port 52398 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 04:34:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<UaLDFKxHCrtCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Jan  6 04:35:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@melanifinefood.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<yqgAGKxHAucvT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan  6 04:35:53 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<pIqxGaxH+OQv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  6 04:36:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<suEdGqxHwqAvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 04:36:01 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<w6kxGqxHBMBm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Jan  6 04:36:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<+tOYG6xH5p9etwuC>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 04:40:46 host2 sshd[1397163]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.175.193.205
country_id: 1269750
description:
Jan  6 04:41:17 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=122.175.193.205, lip=66.85.158.91, session=<fhz9LKxHkuR6r8HN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  6 04:42:41 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<V/UFMqxHirWygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 04:42:51 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<Tg+lMqxHVMsIhpC/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Jan  6 04:45:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<jwxrO6xHOs4FhH+s>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  6 04:48:48 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<nyvpR6xH1MGi8Jp9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.164.107.5
country_id: 6252001
description:
Jan  6 04:48:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=194.164.107.5, lip=66.85.158.92, TLS: Connection closed, session=<h5AeSKxHWNrCpGsF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  6 04:49:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@melanifinefood.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<z0k/S6xHXuwyBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.175.193.205
country_id: 1269750
description:
Jan  6 04:49:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=122.175.193.205, lip=66.85.158.91, session=<3aB2SqxHqux6r8HN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 04:50:34 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<VB84TqxHCsCi8KbF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  6 04:52:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@lankaherbalsolutions.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<ZL+hVKxH3s+ygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 04:56:16 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<ShSbYqxHkMgyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Jan  6 04:56:57 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@sivagnanamfoundation.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<JAkIZaxHsiJetwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Jan  6 04:57:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@rehanseo.online>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<quVzaKxHNLSPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 04:57:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<pLraZ6xHOK6i8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  6 04:58:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<u3wQbKxHSKIvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 05:01:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<a8N7dqxHtqVm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 05:02:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<9uldeqxHroxCdMzo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 207.166.174.63
country_id: 1880251
description:
Jan  6 05:04:27 host2 sshd[1422983]: Disconnected from invalid user claude 207.166.174.63 port 46162 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 05:05:35 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<UZvmg6xHHqQIijoY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 65.38.97.236
country_id: 6252001
description:
Jan  6 05:05:55 host2 sshd[1424518]: Disconnected from invalid user claude 65.38.97.236 port 52188 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  6 05:06:57 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@sobaherbal.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<wmHKiKxHutyygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan  6 05:06:37 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<uvKWh6xHKuAv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.195.53.129
country_id: 6252001
description:
2026-01-06 05:06:42 dovecot_login authenticator failed for H=([74.195.53.129]) [74.195.53.129]:36794: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 65.38.97.236
country_id: 6252001
description:
Jan  6 05:08:01 host2 sshd[1426654]: Disconnected from invalid user steam 65.38.97.236 port 52100 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 05:09:02 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<84A7kKxHrq8ifrCV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 207.166.174.63
country_id: 1880251
description:
Jan  6 05:08:29 host2 sshd[1427109]: Disconnected from invalid user claude 207.166.174.63 port 37974 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 207.166.174.63
country_id: 1880251
description:
Jan  6 05:09:51 host2 sshd[1428399]: Disconnected from invalid user asterisk 207.166.174.63 port 51412 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 05:11:08 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<dei8l6xHeMsz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 05:12:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<ArkpnKxHCOsIijoY>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 47.254.85.115
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[47.254.85.115] [Remote Port]=[58012] [Authentication Database]=[mail] [Username]=[support@seyawin.com] (10/10 failures) (blocked until [Tue Jan  6 23:43:23 2026 UTC/Wed Jan  7 05:13:23 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan  6 05:13:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<lI/un6xHnOIv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 05:14:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<05+hoqxHAt5A46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 05:16:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<pkOGqqxHyOFm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.175.193.205
country_id: 1269750
description:
Jan  6 05:15:49 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=122.175.193.205, lip=66.85.158.91, session=<CbGJqKxHZtx6r8HN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 05:17:14 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<PX2RraxH6kJ100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 05:17:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<pSfBrKxHTu0vWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 05:17:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<9dYarqxHaJ4vWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 05:17:40 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<Og8ir6xHUplA46ZK>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 64.227.166.74
country_id: 1269750
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[64.227.166.74] [Remote Port]=[39250] [Authentication Database]=[mail] [Username]=[contact@bostonlanka.com] (16/10 failures) (blocked until [Tue Jan  6 23:47:38 2026 UTC/Wed Jan  7 05:17:38 2026 LOCAL])


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 50.6.249.92
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[50.6.249.92] [Remote Port]=[45058] [Authentication Database]=[mail] [Username]=[finance@melanifinefood.com] (10/10 failures) (blocked until [Tue Jan  6 23:49:11 2026 UTC/Wed Jan  7 05:19:11 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  6 05:19:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@melanifinefood.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<4YOvtKxHArAyBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 05:19:53 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<CwgVt6xH6J0IhpC/>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 162.240.166.197
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[162.240.166.197] [Remote Port]=[37012] [Authentication Database]=[mail] [Username]=[hr@ceylondigest.com] (10/10 failures) (blocked until [Tue Jan  6 23:50:54 2026 UTC/Wed Jan  7 05:20:54 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 05:20:56 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<IfnTuqxHlJCi8KbF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.175.193.205
country_id: 1269750
description:
Jan  6 05:22:58 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=122.175.193.205, lip=66.85.158.91, session=<im0UwqxHhut6r8HN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.30
country_id: 1269750
description:
2026-01-06 05:23:41 dovecot_login authenticator failed for H=([182.95.119.30]) [182.95.119.30]:48950: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2026-01-06 05:23:59 dovecot_login authenticator failed for H=(138.219.244.10.static.softdados.net) [177.128.209.48]:52406: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.228.17
country_id: 2589581
description:
2026-01-06 05:24:39 dovecot_login authenticator failed for H=(ADMIN) [176.125.228.17]:65180: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 50.6.195.206
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[50.6.195.206] [Remote Port]=[35748] [Authentication Database]=[mail] [Username]=[finance@mathsmotorcysle.xyz] (10/10 failures) (blocked until [Tue Jan  6 23:56:04 2026 UTC/Wed Jan  7 05:26:04 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 05:26:06 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<DJ9IzaxHpIsyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Jan  6 05:26:51 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<+fb4z6xH3swvT1jH>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 162.240.100.50
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[162.240.100.50] [Remote Port]=[60696] [Authentication Database]=[mail] [Username]=[admin@essenceceylontea.com] (10/10 failures) (blocked until [Tue Jan  6 23:58:10 2026 UTC/Wed Jan  7 05:28:10 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Jan  6 05:28:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<5r1k1axHeR9etwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Jan  6 05:27:42 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@rehanseo.online>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<eer90qxHiL+PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 05:28:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<PQvO1KxHGO2i8GQy>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 94.183.11.130
country_id: 130758
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[94.183.11.130] [Remote Port]=[8057] [Authentication Database]=[mail] [Username]=[hr@sivagnanamfoundation.com] (10/10 failures) (blocked until [Tue Jan  6 23:58:20 2026 UTC/Wed Jan  7 05:28:20 2026 LOCAL])


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 207.90.244.14
country_id: 6252001
description:
Jan  6 05:29:02 host2 dovecot[1170291]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=207.90.244.14, lip=66.85.158.91, TLS, session=<mHnp16xHtpXPWvQO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.14
country_id: 6252001
description:
Jan  6 05:29:10 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=207.90.244.14, lip=66.85.158.91, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<Wexe2KxHup/PWvQO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.172.200
country_id: 6252001
description:
Jan  6 05:30:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=165.154.172.200, lip=66.85.158.92, session=<ldKb3qxHWqClmqzI>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 165.154.172.200
country_id: 6252001
description:
Jan  6 05:30:56 host2 dovecot[1170291]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 2 secs): user=<>, rip=165.154.172.200, lip=66.85.158.92, session=<gzis3qxHIKGlmqzI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.46.148.180
country_id: 6252001
description:
2026-01-06 05:33:06 dovecot_plain authenticator failed for H=c-68-46-148-180.hsd1.mi.comcast.net (suria) [68.46.148.180]:60306: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 05:33:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<exvv6KxHiIhCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 05:34:48 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<o3Rm7KxHNtlm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan  6 05:38:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<Vn0J+KxHEJEv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 05:39:17 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<P5lr/KxHcrMIijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 05:40:21 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<zSlGAK1HzcAz0msW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2026-01-06 05:42:23 dovecot_plain authenticator failed for H=(antan) [12.150.243.22]:17581: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.57.141
country_id: 6252001
description:
Jan  6 05:43:21 host2 sshd[1462565]: Disconnected from invalid user adit 198.98.57.141 port 39548 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan  6 05:44:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<tQlvDq1H/uIv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 05:43:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<6881C61HIpgifrCV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  6 05:43:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailer-demo@melanifinefood.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<TkNoDK1H5oIyBvlc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.95.187
country_id: 1643084
description:
Jan  6 05:43:49 host2 sshd[1462968]: Disconnected from invalid user admin 103.59.95.187 port 38756 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.57.141
country_id: 6252001
description:
Jan  6 05:44:30 host2 sshd[1463785]: Disconnected from invalid user fedora 198.98.57.141 port 56950 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 05:44:35 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postmaster@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<2Y9nD61HyOGi8KbF>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.98.57.141
country_id: 6252001
description:
Jan  6 05:45:10 host2 sshd[1464544]: Disconnected from invalid user ubuntu 198.98.57.141 port 41532 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.143.238.173
country_id: 1819730
description:
Jan  6 05:45:16 host2 sshd[1464699]: Disconnected from invalid user claude 103.143.238.173 port 56468 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 216.218.206.67
country_id: 6252001
description:
Jan  6 05:45:23 host2 pure-ftpd[1464869]: (?@216.218.206.67) [INFO] New connection from 216.218.206.67


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.143.238.173
country_id: 1819730
description:
Jan  6 05:46:22 host2 sshd[1466131]: Disconnected from invalid user ubuntu 103.143.238.173 port 46114 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.153
country_id: 3077311
description:
2026-01-06 05:45:24 dovecot_login authenticator failed for H=(ADMIN) [212.102.39.153]:34189: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.15.132
country_id: 1733045
description:
Jan  6 05:45:45 host2 sshd[1465434]: Disconnected from invalid user factorio 202.165.15.132 port 37193 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.143.238.173
country_id: 1819730
description:
Jan  6 05:45:50 host2 sshd[1465581]: Disconnected from invalid user jia 103.143.238.173 port 56648 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 05:47:15 host2 sshd[1466899]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.143.238.173
country_id: 1819730
description:
Jan  6 05:47:25 host2 sshd[1467019]: Disconnected from invalid user adit 103.143.238.173 port 56802 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.68.104.233
country_id: 2921044
description:
Jan  6 05:47:49 host2 sshd[1467513]: Disconnected from invalid user claude 138.68.104.233 port 37626 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.15.132
country_id: 1733045
description:
Jan  6 05:47:58 host2 sshd[1467673]: Disconnected from invalid user test 202.165.15.132 port 49011 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.232.41.236
country_id: 1527747
description:
Jan  6 05:48:15 host2 sshd[1467934]: Disconnected from invalid user ts3server 94.232.41.236 port 33958 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.15.132
country_id: 1733045
description:
Jan  6 05:48:35 host2 sshd[1468239]: Disconnected from invalid user adit 202.165.15.132 port 55520 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.165.15.132
country_id: 1733045
description:
Jan  6 05:49:09 host2 sshd[1468810]: Disconnected from invalid user ts3server 202.165.15.132 port 13740 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.232.41.236
country_id: 1527747
description:
Jan  6 05:49:51 host2 sshd[1469553]: Disconnected from invalid user claude 94.232.41.236 port 37154 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.15.132
country_id: 1733045
description:
Jan  6 05:50:16 host2 sshd[1470177]: Disconnected from invalid user misp 202.165.15.132 port 59182 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 05:50:21 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<OH4CJK1HpJUyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 05:49:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<XdqdIK1HApxm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 05:50:29 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<ORV7JK1HQ+J100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Jan  6 05:51:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postmaster@sivagnanamfoundation.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<xfFUJq1H4gtetwuC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.95.187
country_id: 1643084
description:
Jan  6 05:50:38 host2 sshd[1470545]: Disconnected from invalid user arch 103.59.95.187 port 59030 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 94.232.41.236
country_id: 1527747
description:
Jan  6 05:50:23 host2 sshd[1470300]: Disconnected from invalid user claude 94.232.41.236 port 48290 [preauth]


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 143.110.213.247
country_id: 6251999
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[143.110.213.247] [Remote Port]=[51328] [Authentication Database]=[mail] [Username]=[mailer-demo@rehanseo.online] (10/10 failures) (blocked until [Wed Jan  7 00:21:49 2026 UTC/Wed Jan  7 05:51:49 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 05:51:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postmaster@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<d8oIKa1HOoSi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Jan  6 05:51:51 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailer-demo@rehanseo.online>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<ksZhKa1HgMiPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.175.193.205
country_id: 1269750
description:
Jan  6 05:53:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=122.175.193.205, lip=66.85.158.91, session=<PAl/La1HKtZ6r8HN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.239.41.74
country_id: 3469034
description:
2026-01-06 05:53:12 dovecot_login authenticator failed for H=(201-28-33-49.customer.tdatabrasil.net.br) [186.239.41.74]:47945: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 05:53:34 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<5AeLL61HKL4IhpC/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2026-01-06 05:53:37 dovecot_login authenticator failed for H=([125.19.160.206]) [125.19.160.206]:44296: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2026-01-06 05:55:09 dovecot_plain authenticator failed for H=c-174-169-224-27.hsd1.vt.comcast.net (unomphyle) [174.169.224.27]:34330: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.165
country_id: 6252001
description:
Jan  6 05:55:32 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.165, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<A8asNq1HidTG6xil>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 05:56:56 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailer-demo@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<K0GOO61HxolCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.175.193.205
country_id: 1269750
description:
Jan  6 06:01:05 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@lankaherbalsolutions.com>, method=PLAIN, rip=122.175.193.205, lip=66.85.158.91, session=<fnhuSq1HHqd6r8HN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.252.223.155
country_id: 719819
description:
2026-01-06 06:02:44 dovecot_login authenticator failed for H=(ADMIN) [185.252.223.155]:19176: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.14
country_id: 6252001
description:
Jan  6 06:03:06 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=207.90.244.14, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<hi68Ua1H9pjPWvQO>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 207.90.244.14
country_id: 6252001
description:
Jan  6 06:03:04 host2 dovecot[1170291]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=207.90.244.14, lip=66.85.158.92, TLS, session=<BVqkUa1H8pjPWvQO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 06:05:16 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailer-demo@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<3c9WWa1HE70z0msW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.190
country_id: 1269750
description:
2026-01-06 06:05:33 dovecot_login authenticator failed for H=([27.123.98.190]) [27.123.98.190]:42564: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.76
country_id: 1733045
description:
2026-01-06 06:05:53 dovecot_login authenticator failed for H=([49.124.151.76]) [49.124.151.76]:46418: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.138
country_id: 6252001
description:
Jan  6 06:05:59 host2 pure-ftpd[1486783]: (?@205.210.31.138) [INFO] New connection from 205.210.31.138


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 06:08:14 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postmaster@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<DAn7Y61HnMpA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan  6 06:08:21 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailer-demo@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<gQ1pZK1H0sQv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 06:07:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<BCKtYq1HsINm2gqW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.21
country_id: 798549
description:
Jan  6 06:08:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.21, lip=66.85.158.91, session=<rnH5Y61H/NxV2ZUV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.61.201
country_id: 953987
description:
Jan  6 06:09:36 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=102.129.61.201, lip=66.85.158.91, TLS, session=<l97UZ61HwZhmgT3J>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.67.161.44
country_id: 6252001
description:
Jan  6 06:08:58 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=40.67.161.44, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<zm22Zq1HdtwoQ6Es>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.229.252.203
country_id: 3865483
description:
Jan  6 06:09:58 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<charanaw>, method=PLAIN, rip=200.229.252.203, lip=66.85.158.91, TLS, session=<AiInaa1HRZ/I5fzL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan  6 06:10:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<EQFna61HZtsv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 06:11:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postmaster@lankaherbalsolutions.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<f/aHbq1HkrYvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 06:11:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postmaster@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<j1ptcK1HNIZA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 06:13:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<Xnrsda1HssIIijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  6 06:13:21 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailer-demo@melanifinefood.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<bGJGdq1Hfr0yBvlc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.46.124.0
country_id: 3686110
description:
2026-01-06 06:14:32 dovecot_login authenticator failed for H=(azteca-comunicaciones.com) [201.46.124.0]:1976: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 06:15:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailer-demo@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<ej/efK1HUJyi8KbF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.36.82
country_id: 1210997
description:
2026-01-06 06:14:54 dovecot_login authenticator failed for H=([49.0.36.82]) [49.0.36.82]:47168: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 34.126.176.149
country_id: 1880251
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[34.126.176.149] [Remote Port]=[60334] [Authentication Database]=[mail] [Username]=[finance@melanifinefood.com] (10/10 failures) (blocked until [Wed Jan  7 00:47:51 2026 UTC/Wed Jan  7 06:17:51 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 06:17:53 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<EJ51hq1HrusifrCV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 169.239.118.15
country_id: 2215636
description:
Jan  6 06:20:38 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=169.239.118.15, lip=66.85.158.91, TLS, session=<n2Jyj61H6Lyp73YP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.29.28
country_id: 798544
description:
Jan  6 06:20:40 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=178.216.29.28, lip=66.85.158.91, TLS, session=<ohKDj61H5p6y2B0c>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 06:20:04 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<gKZFjq1HWJsIijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.207.35.213
country_id: 6290252
description:
Jan  6 06:20:20 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@jrdc.lk>, method=PLAIN, rip=109.207.35.213, lip=66.85.158.91, TLS, session=<tgpejq1HWpptzyPV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.41.235.115
country_id: 3865483
description:
Jan  6 06:20:22 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@jrdc.lk>, method=PLAIN, rip=181.41.235.115, lip=66.85.158.91, TLS, session=<+tJrjq1HxrG1Ketz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 155.133.56.74
country_id: 798544
description:
Jan  6 06:20:38 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=155.133.56.74, lip=66.85.158.91, TLS, session=<vgRhj61HogqbhThK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.206.98.135
country_id: 6290252
description:
Jan  6 06:20:38 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=109.206.98.135, lip=66.85.158.91, TLS, session=<jGVuj61HsuFtzmKH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.213.48
country_id: 933860
description:
Jan  6 06:20:43 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=41.216.213.48, lip=66.85.158.91, TLS, session=<mligj61HjYEp2NUw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.140.234.221
country_id: 719819
description:
Jan  6 06:20:19 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@jrdc.lk>, method=PLAIN, rip=45.140.234.221, lip=66.85.158.91, TLS, session=<STVOjq1Hd5AtjOrd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.98.177
country_id: 3469034
description:
Jan  6 06:20:20 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@jrdc.lk>, method=PLAIN, rip=187.120.98.177, lip=66.85.158.91, TLS, session=<+O9Wjq1H6ZG7eGKx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.85.104.155
country_id: 3469034
description:
Jan  6 06:20:22 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@jrdc.lk>, method=PLAIN, rip=187.85.104.155, lip=66.85.158.91, TLS, session=<TEdQjq1HQ9a7VWib>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 06:20:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailer-demo@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<OSfqj61HOLEyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Jan  6 06:21:37 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailer-demo@rehanseo.online>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<GgnWk61HCoyPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 06:22:32 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<i1Mgl61Hsohm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 06:22:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postmaster@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<NZm6la1HdsSi8GQy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 184.174.20.28
country_id: 6252001
description:
Jan  6 06:22:20 host2 sshd[1500121]: Invalid user cloudtourssrilan_travel from 184.174.20.28 port 28054


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Jan  6 06:22:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailer-demo@sivagnanamfoundation.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<UlQpl61HaCBetwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.153.3.94
country_id: 3175395
description:
Jan  6 06:23:11 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=185.153.3.94, lip=66.85.158.91, TLS, session=<QqaSmK1HbMm5mQNe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 06:23:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<zhBDmq1HzVJ100Db>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 117.211.64.219
country_id: 1269750
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[117.211.64.219] [Remote Port]=[21197] [Authentication Database]=[mail] [Username]=[sales@kiriaswanu.com] (10/10 failures) (blocked until [Wed Jan  7 00:53:23 2026 UTC/Wed Jan  7 06:23:23 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.39.178
country_id: 953987
description:
Jan  6 06:23:33 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=102.64.39.178, lip=66.85.158.91, TLS, session=<MgC3ma1H2qxmQCey>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.236.9
country_id: 614540
description:
2026-01-06 06:27:23 dovecot_login authenticator failed for H=(ADMIN) [95.181.236.9]:44538: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 06:27:29 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<wOLLqK1HyqgIhpC/>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 8.134.144.191
country_id: 1814991
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[8.134.144.191] [Remote Port]=[43210] [Authentication Database]=[mail] [Username]=[support@sivagnanamfoundation.com] (10/10 failures) (blocked until [Wed Jan  7 00:57:27 2026 UTC/Wed Jan  7 06:27:27 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 06:27:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailer-demo@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<Va3Uqa1H3MhCdMzo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.108.231.55
country_id: 2077456
description:
Jan  6 06:27:52 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=103.108.231.55, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<5udOqq1HotJnbOc3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 184.174.20.28
country_id: 6252001
description:
Jan  6 06:27:57 host2 sshd[1505164]: Invalid user cloudtourssrilan_travel from 184.174.20.28 port 48023


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2026-01-06 06:29:10 dovecot_plain authenticator failed for H=(plugs) [65.20.160.107]:38128: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.108.231.55
country_id: 2077456
description:
Jan  6 06:30:31 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=103.108.231.55, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<vIHEs61HDvNnbOc3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.117.126
country_id: 6252001
description:
Jan  6 06:30:53 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=40.124.117.126, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<B9Ifta1Hir4ofHV+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.175.193.205
country_id: 1269750
description:
Jan  6 06:33:42 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@sobaherbal.com>, method=PLAIN, rip=122.175.193.205, lip=66.85.158.91, session=<PGYJv61HmOF6r8HN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 06:34:29 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<cJvewa1H+bUz0msW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-06 06:35:08 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:64523: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.212.54
country_id: 99237
description:
2026-01-06 06:35:43 dovecot_login authenticator failed for H=([62.201.212.54]) [62.201.212.54]:43324: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 06:40:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailer-demo@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<6+UZ161HTuJA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 06:40:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<kITd2K1HIqlm2gqW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2026-01-06 06:44:25 dovecot_plain authenticator failed for H=c-71-235-225-181.hsd1.ct.comcast.net (haratom) [71.235.225.181]:55752: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.230.231
country_id: 1861060
description:
Jan  6 06:44:15 host2 sshd[1520781]: Disconnected from invalid user tao 118.194.230.231 port 46822 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 06:44:17 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<cpanel@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<PWDt5K1H2IAIhpC/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2026-01-06 06:45:47 dovecot_plain authenticator failed for H=(bellin) [102.53.15.180]:42445: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.163.123.45
country_id: 1880251
description:
Jan  6 06:44:59 host2 sshd[1521498]: Disconnected from invalid user claude 43.163.123.45 port 48004 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 06:46:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<cpanel@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<dt41661HtNJCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 06:47:16 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contacts@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<OOiN761H0qxA46ZK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.163.123.45
country_id: 1880251
description:
Jan  6 06:47:28 host2 sshd[1524181]: Disconnected from invalid user tester 43.163.123.45 port 33644 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.230.231
country_id: 1861060
description:
Jan  6 06:47:41 host2 sshd[1524338]: Disconnected from invalid user claude 118.194.230.231 port 46928 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.194.230.231
country_id: 1861060
description:
Jan  6 06:48:22 host2 sshd[1524966]: Disconnected from invalid user qw 118.194.230.231 port 46988 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 06:48:16 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<commercial@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<cRgm861Hpu0IijoY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.163.123.45
country_id: 1880251
description:
Jan  6 06:49:50 host2 sshd[1526133]: Disconnected from invalid user ubuntu 43.163.123.45 port 52918 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.32.48.81
country_id: 6251999
description:
2026-01-06 06:50:30 dovecot_login authenticator failed for H=(ADMIN) [212.32.48.81]:19190: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  6 06:51:43 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<rPWc/61H6MADhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2026-01-06 06:51:45 dovecot_login authenticator failed for H=([152.52.234.46]) [182.95.176.194]:42272: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 166.198.103.11
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 166.198.103.11 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.41.251.88
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 73.41.251.88 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.108.117.44
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 74.108.117.44 - tradeceylon "GET /login/?login_only=1&user=tradeceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.123.5.44
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 99.123.5.44 - tradeceylo "GET /login/?login_only=1&user=tradeceylo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceylo (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.175.193.205
country_id: 1269750
description:
Jan  6 06:52:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postmaster@sobaherbal.com>, method=PLAIN, rip=122.175.193.205, lip=66.85.158.91, session=<YbiDAK5H5uZ6r8HN>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.163.123.45
country_id: 1880251
description:
Jan  6 06:52:40 host2 sshd[1528884]: Disconnected from invalid user john 43.163.123.45 port 55826 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.241.61.64
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 108.241.61.64 - tradeceyloncom "GET /login/?login_only=1&user=tradeceyloncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyloncom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.149.79
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 172.58.149.79 - tradece2 "GET /login/?login_only=1&user=tradece2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece2 (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 06:52:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<VOmlAa5H+qIifrCV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  6 06:52:31 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: Connection closed, session=<FKd3Aq5HeLADhBfJ>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 122.175.193.205
country_id: 1269750
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[122.175.193.205] [Remote Port]=[59110] [Authentication Database]=[mail] [Username]=[postmaster@sobaherbal.com] (10/10 failures) (blocked until [Wed Jan  7 01:21:58 2026 UTC/Wed Jan  7 06:51:58 2026 LOCAL])


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.197.36.151
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 107.197.36.151 - tradecey "GET /login/?login_only=1&user=tradecey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradecey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.65.144.107
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 99.65.144.107 - tradece "GET /login/?login_only=1&user=tradece&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.10.0.164
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 68.10.0.164 - trade "GET /login/?login_only=1&user=trade&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trade (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 140.186.244.228
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 140.186.244.228 - tradece1 "GET /login/?login_only=1&user=tradece1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.105.245.48
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 143.105.245.48 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.150.97.94
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 69.150.97.94 - tradec "GET /login/?login_only=1&user=tradec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 147.136.9.237
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 147.136.9.237 - trad "GET /login/?login_only=1&user=trad&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trad (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 199.241.224.114
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 199.241.224.114 - tra "GET /login/?login_only=1&user=tra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tra (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.20.84.55
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 76.20.84.55 - tr "GET /login/?login_only=1&user=tr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tr (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.222
country_id: 1733045
description:
2026-01-06 06:52:12 dovecot_login authenticator failed for H=([49.124.152.222]) [49.124.152.222]:49240: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 06:52:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<client@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<5jUjAa5HlLei8KbF>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.228.114.202
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 68.228.114.202 - tradeceyl "GET /login/?login_only=1&user=tradeceyl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyl (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.49.246.176
country_id: 6252001
description:
Jan  6 06:54:12 host2 sshd[1530322]: Disconnected from invalid user celery 69.49.246.176 port 41242 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  6 06:54:13 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<yeCDCK5HougDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 06:54:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contacts@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<Zj4UCa5H7LMyBsPO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  6 06:55:20 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<hVuJDK5H3KQDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 06:55:37 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notice@sobaherbal.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<mTZoDa5H9uAvWBNS>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 69.49.246.176
country_id: 6252001
description:
Jan  6 06:55:48 host2 sshd[1532137]: Disconnected from invalid user claude 69.49.246.176 port 40308 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  6 06:55:56 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<6MqrDq5HdK8DhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.49.246.176
country_id: 6252001
description:
Jan  6 06:56:17 host2 sshd[1532565]: Disconnected from invalid user testuser 69.49.246.176 port 33384 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  6 06:56:51 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: Connection closed, session=<W+/6Ea5HEsgDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 06:58:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<1S8lFq5HbtVm2gqW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.28.242.198
country_id: 2361809
description:
Jan  6 06:58:12 host2 sshd[1534326]: Disconnected from invalid user luser 196.28.242.198 port 52604 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Jan  6 06:58:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<ni2XGK5HditetwuC>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.16
country_id: 2635167
description:
Jan  6 06:59:04 host2 dovecot[1170291]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.16, lip=66.85.158.92, TLS, session=<2xbgGa5HJ+e594kQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.80
country_id: 2635167
description:
Jan  6 06:59:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.80, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<pIfFGq5H+9O594lQ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.28.242.198
country_id: 2361809
description:
Jan  6 06:59:33 host2 sshd[1535502]: Disconnected from invalid user testuser 196.28.242.198 port 55182 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  6 06:58:54 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<EblRGa5HGOkDhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.28.242.198
country_id: 2361809
description:
Jan  6 07:00:11 host2 sshd[1536263]: Disconnected from invalid user webadm 196.28.242.198 port 44084 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.78
country_id: 2635167
description:
Jan  6 07:00:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.78, lip=66.85.158.92, TLS handshaking: Connection closed, session=<NQq8Hq5Hd+C594lO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.76
country_id: 2635167
description:
Jan  6 06:59:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.76, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<C8zAHK5HXbG594lM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.100
country_id: 2635167
description:
Jan  6 07:00:59 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=185.247.137.100, lip=66.85.158.92, TLS handshaking: Connection closed, session=<B223IK5Hc6K594lk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.89
country_id: 2635167
description:
Jan  6 07:01:32 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.89, lip=66.85.158.92, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<BNeyIq5Hv6FX7LBZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.100
country_id: 2635167
description:
Jan  6 07:02:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.100, lip=66.85.158.92, TLS handshaking: Connection closed, session=<+3qpJq5Hb5e594lk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.106
country_id: 2635167
description:
Jan  6 07:02:05 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.106, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<hy+sJK5H+55X7LBq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 07:02:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<h3HuJa5HqqV100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 07:02:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<commercial@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<PrsVJq5HKNQIijoY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.81
country_id: 2635167
description:
Jan  6 07:03:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=87.236.176.81, lip=66.85.158.92, TLS handshaking: Connection closed, session=<+tqkKK5HQ61X7LBR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  6 07:03:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@melanifinefood.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<Dwl3Kq5H7NEyBvlc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.91
country_id: 2635167
description:
Jan  6 07:03:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<yCyeKq5HLdpX7LBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.93
country_id: 2635167
description:
Jan  6 07:04:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.93, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<5ZWZLK5HJZJX7LBd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 07:06:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<L9hxM65HLJii8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 07:08:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notice@lankaherbalsolutions.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<miz9PK5HKoovWBNS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.133.47.11
country_id: 1522867
description:
2026-01-06 07:09:29 dovecot_login authenticator failed for H=(ADMIN) [62.133.47.11]:14428: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 07:10:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<L8zgQK5HSecz0msW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.184.83.17
country_id: 6252001
description:
2026-01-06 07:10:22 dovecot_login authenticator failed for H=h17.83.184.173.dynamic.ip.windstream.net [173.184.83.17]:54732: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.103.120.150
country_id: 1819730
description:
2026-01-06 07:10:43 dovecot_login authenticator failed for H=150.120.103.218.static.netvigator.com [218.103.120.150]:52636: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 07:12:37 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contacts@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<TCk1Sq5H6JVA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 07:14:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<l2fFT65HyOlm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 07:16:48 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sale@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<gTUuWa5H/p1CdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  6 07:17:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<cpanel@melanifinefood.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<BAgMW65H/LUyBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 07:18:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<panel@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<Z0wNXq5HJuUIhpC/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 07:19:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<43ldYq5H/KVA46ZK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.39.58.191
country_id: 2635167
description:
Jan  6 07:19:30 host2 sshd[1555464]: Disconnected from invalid user logger 34.39.58.191 port 33962 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.39.58.191
country_id: 2635167
description:
Jan  6 07:20:02 host2 sshd[1555854]: Disconnected from invalid user csczserver 34.39.58.191 port 32908 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.39.58.191
country_id: 2635167
description:
Jan  6 07:21:04 host2 sshd[1556934]: Disconnected from invalid user m1 34.39.58.191 port 41638 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.190.155.43
country_id: 6252001
description:
2026-01-06 07:21:35 dovecot_plain authenticator failed for H=(hienests) [76.190.155.43]:35085: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 07:22:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<nEjxbK5HsI4IijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 07:22:53 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<q+z1bq5HdpKi8KbF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 07:24:42 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<dg1xda5HzL0yBsPO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.250.81.123
country_id: 1733045
description:
Jan  6 07:24:22 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=783) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=47.250.81.123, lip=66.85.158.91, TLS handshaking: read(size=783) failed: Connection reset by peer, session=<DyBjdK5HOKAv+lF7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.175.193.205
country_id: 1269750
description:
Jan  6 07:24:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shop@lankaherbalsolutions.com>, method=PLAIN, rip=122.175.193.205, lip=66.85.158.91, session=<+sm4dK5HruF6r8HN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.250.81.123
country_id: 1733045
description:
Jan  6 07:24:53 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=47.250.81.123, lip=66.85.158.91, TLS, session=<h00wdq5HPKAv+lF7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 07:26:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mail@sobaherbal.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<zlLxe65HvK8vWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 07:26:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<0QAsfa5H5LYifrCV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-06 07:34:35 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:49591: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.232.44
country_id: 2542007
description:
2026-01-06 07:35:47 dovecot_login authenticator failed for H=(ADMIN) [95.181.232.44]:17988: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.248.129.252
country_id: 2921044
description:
Jan  6 07:43:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=104.248.129.252, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<DWmiua5H05Bo+IH8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2026-01-06 07:43:13 dovecot_login authenticator failed for H=([196.191.212.236]) [213.55.85.202]:4086: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.217.204.91
country_id: 2658434
description:
2026-01-06 07:43:26 dovecot_login authenticator failed for H=adsl-89-217-204-91.adslplus.ch [89.217.204.91]:33370: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.123
country_id: 6252001
description:
Jan  6 07:43:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 16 secs): user=<>, rip=66.132.153.123, lip=66.85.158.91, TLS handshaking: Connection closed, session=<7Zuoua5HDghChJl7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.122.80
country_id: 2921044
description:
Jan  6 07:44:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=46.101.122.80, lip=66.85.158.91, TLS handshaking: Connection closed, session=<oJC8u65HdMcuZXpQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.248.129.252
country_id: 2921044
description:
Jan  6 07:43:56 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=104.248.129.252, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<Nhleuq5HuTNo+IH8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.143
country_id: 6252001
description:
Jan  6 07:45:21 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.143, lip=66.85.158.91, TLS: Connection closed, session=<IGZpv65HBjJChJmP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 161.35.79.234
country_id: 2921044
description:
Jan  6 07:44:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=161.35.79.234, lip=66.85.158.91, TLS handshaking: Connection closed, session=<3DHNva5HbrWhI0/q>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 212.154.234.9
country_id: 1522867
description:
Jan  6 07:46:46 host2 sshd[1581515]: Disconnected from invalid user nc 212.154.234.9 port 58881 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.154.234.9
country_id: 1522867
description:
Jan  6 07:47:33 host2 sshd[1582183]: Disconnected from invalid user bodega 212.154.234.9 port 11399 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.154.234.9
country_id: 1522867
description:
Jan  6 07:48:07 host2 sshd[1582682]: Disconnected from invalid user minecraft 212.154.234.9 port 41920 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.106.76
country_id: 3469034
description:
Jan  6 07:49:36 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=187.120.106.76, lip=66.85.158.91, TLS, session=<eG51za5HV4G7eGpM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.87.201.135
country_id: 3469034
description:
Jan  6 07:49:57 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=177.87.201.135, lip=66.85.158.91, TLS, session=<Cai4zq5H8tGxV8mH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.47.53.19
country_id: 798549
description:
Jan  6 07:53:39 host2 sshd[1588195]: Disconnected from invalid user admin 89.47.53.19 port 32794 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.121.61.198
country_id: 3017382
description:
2026-01-06 07:55:07 dovecot_login authenticator failed for H=ip198.ip-91-121-61.eu (ADMIN) [91.121.61.198]:57084: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.47.53.19
country_id: 798549
description:
Jan  6 07:55:18 host2 sshd[1590429]: Disconnected from invalid user admin 89.47.53.19 port 40382 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.156.128.122
country_id: 2264397
description:
Jan  6 07:56:35 host2 pure-ftpd[1591787]: (?@45.156.128.122) [INFO] New connection from 45.156.128.122


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 89.47.53.19
country_id: 798549
description:
Jan  6 07:56:48 host2 sshd[1592006]: Disconnected from invalid user claude 89.47.53.19 port 47382 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.47.53.19
country_id: 798549
description:
Jan  6 07:57:19 host2 sshd[1592496]: Disconnected from invalid user claude 89.47.53.19 port 59122 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.154.77.48
country_id: 1643084
description:
Jan  6 07:57:42 host2 sshd[1592882]: Disconnected from invalid user claude 103.154.77.48 port 48830 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.89.28.139
country_id: 1643084
description:
Jan  6 07:58:49 host2 sshd[1593869]: Disconnected from invalid user ghost 36.89.28.139 port 42994 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.89.28.139
country_id: 1643084
description:
Jan  6 07:59:26 host2 sshd[1594426]: Disconnected from invalid user sun 36.89.28.139 port 39444 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.154.77.48
country_id: 1643084
description:
Jan  6 07:59:46 host2 sshd[1594677]: Disconnected from invalid user admin 103.154.77.48 port 55714 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.154.77.48
country_id: 1643084
description:
Jan  6 08:00:54 host2 sshd[1595925]: Disconnected from invalid user claude 103.154.77.48 port 49576 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.97.24.41
country_id: 732800
description:
Jan  6 08:01:44 host2 sshd[1596699]: Disconnected from invalid user xuhao 83.97.24.41 port 60332 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 08:01:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<btX8+a5HMtgifrCV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.218.149
country_id: 1880251
description:
Jan  6 08:02:03 host2 sshd[1597177]: Disconnected from invalid user admin 152.32.218.149 port 40174 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 83.97.24.41
country_id: 732800
description:
Jan  6 08:02:14 host2 sshd[1597331]: Disconnected from invalid user tung 83.97.24.41 port 44104 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.64.27.145
country_id: 3932488
description:
Jan  6 08:02:42 host2 sshd[1597765]: Disconnected from invalid user tung 181.64.27.145 port 52936 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.89.28.139
country_id: 1643084
description:
Jan  6 08:01:59 host2 sshd[1597080]: Disconnected from invalid user claude 36.89.28.139 port 49468 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.164.107.6
country_id: 6252001
description:
Jan  6 08:03:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=194.164.107.6, lip=66.85.158.92, session=<I85T/65HEKPCpGsG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.89.28.139
country_id: 1643084
description:
Jan  6 08:03:17 host2 sshd[1598441]: Disconnected from invalid user testuser 36.89.28.139 port 55588 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.64.27.145
country_id: 3932488
description:
Jan  6 08:03:21 host2 sshd[1598569]: Disconnected from invalid user terry 181.64.27.145 port 43070 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.218.149
country_id: 1880251
description:
Jan  6 08:04:00 host2 sshd[1599154]: Disconnected from invalid user claude 152.32.218.149 port 35468 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.64.27.145
country_id: 3932488
description:
Jan  6 08:05:26 host2 sshd[1600838]: Disconnected from invalid user adminuser 181.64.27.145 port 36612 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.64.27.145
country_id: 3932488
description:
Jan  6 08:06:06 host2 sshd[1601402]: Disconnected from invalid user claude 181.64.27.145 port 52370 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.203.22
country_id: 1880251
description:
Jan  6 08:06:12 host2 sshd[1601490]: Disconnected from invalid user test 45.78.203.22 port 43018 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.64.27.145
country_id: 3932488
description:
Jan  6 08:06:46 host2 sshd[1601935]: Disconnected from invalid user ashok 181.64.27.145 port 56512 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 166.170.48.43
country_id: 6252001
description:
Jan  6 08:07:03 host2 sshd[1602204]: Disconnected from invalid user proxyuser 166.170.48.43 port 63401 [preauth]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 195.178.110.132
country_id: 732800
description:
Denial of Service (DoS) attack was discovered from 195.178.110.132: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 166.170.48.43
country_id: 6252001
description:
Jan  6 08:07:47 host2 sshd[1602839]: Disconnected from invalid user dk 166.170.48.43 port 2174 [preauth]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 195.178.110.132
country_id: 732800
description:
Denial of Service (DoS) attack was discovered from 195.178.110.132: 445 connections per 30 seconds to 443 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.188.130
country_id: 3144096
description:
2026-01-06 08:08:33 dovecot_login authenticator failed for H=(cm-84.213.188.130.get.no) [84.213.188.130]:50226: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.50.154
country_id: 1269750
description:
2026-01-06 08:08:45 dovecot_login authenticator failed for H=([125.19.93.105]) [182.95.50.154]:45708: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 166.170.48.43
country_id: 6252001
description:
Jan  6 08:08:59 host2 sshd[1604324]: Disconnected from invalid user alice 166.170.48.43 port 24219 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.142
country_id: 1269750
description:
2026-01-06 08:09:04 dovecot_login authenticator failed for H=([128.185.227.142]) [128.185.227.142]:39444: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.84
country_id: 1210997
description:
2026-01-06 08:09:15 dovecot_login authenticator failed for H=([103.115.252.60]) [103.115.252.84]:44304: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.142
country_id: 1269750
description:
2026-01-06 08:09:50 dovecot_login authenticator failed for H=([182.79.202.89]) [182.95.230.142]:37414: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.203.22
country_id: 1880251
description:
Jan  6 08:10:25 host2 sshd[1605774]: Disconnected from invalid user bitrix 45.78.203.22 port 51104 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.32.122.72
country_id: 597427
description:
2026-01-06 08:13:15 dovecot_login authenticator failed for H=(ADMIN) [194.32.122.72]:1325: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2026-01-06 08:17:36 dovecot_plain authenticator failed for H=(genear) [65.20.205.197]:52239: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2026-01-06 08:18:23 dovecot_plain authenticator failed for H=c-73-137-7-97.hsd1.ga.comcast.net (eltessal) [73.137.7.97]:32984: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2026-01-06 08:18:21 dovecot_plain authenticator failed for H=(heratrid) [23.30.11.253]:38754: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-01-06 08:22:32 dovecot_plain authenticator failed for H=host-196-47-172-253.afnet.net (ocyper) [196.47.172.253]:43493: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.62.238
country_id: 953987
description:
Jan  6 08:27:39 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<charanaw>, method=PLAIN, rip=102.129.62.238, lip=66.85.158.91, TLS, session=<C6B0Va9HwcZmgT7u>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 93.174.180.151
country_id: 3057568
description:
Jan  6 08:27:16 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=93.174.180.151, lip=66.85.158.91, TLS, session=<ql1NVK9H8JRdrrSX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.210
country_id: 1269750
description:
2026-01-06 08:31:07 dovecot_login authenticator failed for H=(nsg-corporate-49.218.186.122.airtel.in) [103.251.31.210]:60992: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
country_id: 99237
description:
2026-01-06 08:30:20 dovecot_login authenticator failed for H=([65.20.191.12]) [65.20.191.12]:40448: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.124.25
country_id: 3042225
description:
2026-01-06 08:30:35 dovecot_login authenticator failed for H=(ADMIN) [91.90.124.25]:45521: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.146
country_id: 1819730
description:
2026-01-06 08:30:45 dovecot_login authenticator failed for H=146.47.246.220.static.netvigator.com [220.246.47.146]:57691: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.5.135
country_id: 798544
description:
2026-01-06 08:30:50 dovecot_login authenticator failed for H=89-67-5-135.dynamic.play.pl [89.67.5.135]:60289: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.165.219
country_id: 1605651
description:
2026-01-06 08:31:04 dovecot_login authenticator failed for H=([106.0.165.219]) [106.0.165.219]:60310: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.205
country_id: 6252001
description:
Jan  6 08:32:37 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.205, lip=66.85.158.91, session=<VVZtaK9HuOHN0h/N>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.185
country_id: 6252001
description:
Jan  6 08:33:53 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.185, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<QaP2bK9HgN7N0h+5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 08:36:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<LzUdd69HxIAifrCV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.212.241.39
country_id: 1880251
description:
Jan  6 08:37:43 host2 sshd[1638067]: Disconnected from invalid user es 20.212.241.39 port 59308 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.126.105.42
country_id: 3469034
description:
2026-01-06 08:47:02 dovecot_login authenticator failed for H=187-126-105-42.user.vtal.net.br (187-126-105-145.user.vtal.net.br) [187.126.105.42]:48599: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2026-01-06 08:47:26 dovecot_login authenticator failed for H=([193.46.192.20]) [193.46.192.20]:41385: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  6 08:49:47 host2 sshd[1652717]: Disconnected from invalid user admin 2.57.121.112 port 20277 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.149.52.111
country_id: 6251999
description:
2026-01-06 08:51:37 dovecot_login authenticator failed for H=(ADMIN) [89.149.52.111]:56953: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 102.204.223.185
country_id: 2328926
description:
Jan  6 08:51:30 host2 pure-ftpd[1654994]: (?@102.204.223.185) [INFO] New connection from 102.204.223.185


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 08:52:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mail@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<tTw5sK9HRI6i8GQy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.212.241.39
country_id: 1880251
description:
Jan  6 08:53:00 host2 sshd[1656454]: Disconnected from invalid user claude 20.212.241.39 port 50704 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 08:52:32 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<iFWUr69HatUIhpC/>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 08:54:16 host2 sshd[1658251]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 08:54:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@lankaherbalsolutions.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<woC0ta9H1NwvWBNS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.21.104
country_id: 1269750
description:
2026-01-06 08:56:08 dovecot_login authenticator failed for H=(abts-north-static-104.21.176.122.airtelbroadband.in) [122.176.21.104]:35665: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.191.70.126
country_id: 6252001
description:
2026-01-06 08:56:56 dovecot_login authenticator failed for H=pool-71-191-70-126.washdc.fios.verizon.net [71.191.70.126]:56490: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 08:56:14 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<panel@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<OsTOvK9HYq4z0msW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.238.2.56
country_id: 3469034
description:
2026-01-06 08:56:30 dovecot_login authenticator failed for H=45-238-2-56.netmaisfibra.net.br [45.238.2.56]:46736: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 08:56:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postmaster@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<vlSQvq9HeLlA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 08:57:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<commercial@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<Dqe8wK9Hwumi8KbF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 08:58:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<tccPxa9H58l100Db>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.212.241.39
country_id: 1880251
description:
Jan  6 08:58:34 host2 sshd[1662829]: Disconnected from invalid user ubuntu 20.212.241.39 port 57598 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.24
country_id: 241170
description:
Jan  6 09:01:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.24, lip=66.85.158.91, session=<LEyez69HjrvE+2YY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2026-01-06 09:04:02 dovecot_plain authenticator failed for H=c-24-1-200-187.hsd1.il.comcast.net (chark) [24.1.200.187]:33478: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 09:07:19 host2 sshd[1671493]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 09:07:41 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<Tlu35a9H1KxCdMzo>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 09:09:12 host2 sshd[1673019]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 09:10:26 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postmaster@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<+huX769HcqlA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 09:11:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<invoice@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<L7lk8q9HquwIijoY>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.64.215.64
country_id: 298795
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 212.64.215.64 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 09:11:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<fSQW869HcOpm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 09:11:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<kywU869HbL0yBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 09:11:27 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<Q9Iv869HjJIifrCV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.233.17
country_id: 2993457
description:
2026-01-06 09:13:09 dovecot_login authenticator failed for H=(ADMIN) [95.181.233.17]:7683: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 09:12:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<invoice@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<PJ+H9q9HktUIijoY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.224.242.137
country_id: 2635167
description:
2026-01-06 09:13:41 dovecot_login authenticator failed for H=([109.224.242.137]) [109.224.242.137]:55022: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.102.149.135
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 191.102.149.135 - lezzarotech@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.179.59.108
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 186.179.59.108 - marketing@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2026-01-06 09:14:22 dovecot_login authenticator failed for H=(netcomafrica.com) [41.219.149.74]:65472: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.3
country_id: 1668284
description:
Jan  6 09:15:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.3, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<IdrhAbBHEcDG6xgD>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.49.50.6
country_id: 3686110
description:
Jan  6 09:18:19 host2 sshd[1681502]: Disconnected from invalid user bitrix 181.49.50.6 port 40728 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 09:18:59 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<k6cfDrBHgrRm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Jan  6 09:19:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notice@sivagnanamfoundation.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<20W8DrBH9oxetwuC>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.49.50.6
country_id: 3686110
description:
Jan  6 09:20:08 host2 sshd[1683077]: Disconnected from invalid user damian 181.49.50.6 port 52408 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.165.121.195
country_id: 1269750
description:
Jan  6 09:21:44 host2 sshd[1684587]: Disconnected from invalid user admin 122.165.121.195 port 37710 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 09:21:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@sobaherbal.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<yUW9FrBHqL8vWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 09:23:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<Pig8HbBHRM2i8GQy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.165.121.195
country_id: 1269750
description:
Jan  6 09:23:28 host2 sshd[1686226]: Disconnected from invalid user damian 122.165.121.195 port 45540 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.107.103
country_id: 1819730
description:
Jan  6 09:23:37 host2 sshd[1686351]: Disconnected from invalid user claude 101.36.107.103 port 51806 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 09:25:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<account@lankaherbalsolutions.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<KXMSJLBHfKsvWBNS>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.107.103
country_id: 1819730
description:
Jan  6 09:24:17 host2 sshd[1687030]: Disconnected from invalid user sergey 101.36.107.103 port 57816 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.165.121.195
country_id: 1269750
description:
Jan  6 09:24:18 host2 sshd[1687080]: Disconnected from invalid user claude 122.165.121.195 port 54592 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.174
country_id: 6252001
description:
Jan  6 09:24:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=205.210.31.174, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<EY+5IbBHtsPN0h+u>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.165.121.195
country_id: 1269750
description:
Jan  6 09:26:04 host2 sshd[1688729]: Disconnected from invalid user bitrix 122.165.121.195 port 55694 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 09:25:49 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<GLOQJrBHc6kz0msW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.165.121.195
country_id: 1269750
description:
Jan  6 09:26:55 host2 sshd[1689541]: Disconnected from invalid user admin 122.165.121.195 port 49264 [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 95.178.85.71
country_id: 102358
description:
Jan  6 09:27:03 host2 sshd[1689619]: Disconnecting authenticating user root 95.178.85.71 port 40984: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 95.178.85.71
country_id: 102358
description:
Jan  6 09:27:03 host2 sshd[1689619]: error: maximum authentication attempts exceeded for root from 95.178.85.71 port 40984 ssh2 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 09:26:47 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postmaster@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<QjETKrBH/IgIhpC/>


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 95.178.85.71
country_id: 102358
description:
Jan  6 09:27:13 host2 sshd[1689781]: error: maximum authentication attempts exceeded for root from 95.178.85.71 port 42184 ssh2 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2026-01-06 09:28:00 dovecot_plain authenticator failed for H=(doweged) [50.217.40.11]:40016: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 09:28:08 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<sZ/eLrBHFOui8KbF>


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 95.178.85.71
country_id: 102358
description:
Jan  6 09:27:13 host2 sshd[1689781]: Disconnecting authenticating user root 95.178.85.71 port 42184: Too many authentication failures [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.112.186.122
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 71.112.186.122 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.105.173
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 172.56.105.173 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 15.218.145.174
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 15.218.145.174 - tradece "GET /login/?login_only=1&user=tradece&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.218.190.116
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 47.218.190.116 - trade "GET /login/?login_only=1&user=trade&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trade (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.218.110.160
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 47.218.110.160 - tradeceyloncom "GET /login/?login_only=1&user=tradeceyloncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyloncom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.56.1.207
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 99.56.1.207 - tradeceylo "GET /login/?login_only=1&user=tradeceylo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceylo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.49.6.29
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 99.49.6.29 - tradeceyl "GET /login/?login_only=1&user=tradeceyl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 142.79.112.144
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 142.79.112.144 - tradec "GET /login/?login_only=1&user=tradec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.129.245.242
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 68.129.245.242 - tradece2 "GET /login/?login_only=1&user=tradece2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.138.100.159
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 69.138.100.159 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.217.47.250
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 107.217.47.250 - tradece1 "GET /login/?login_only=1&user=tradece1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.60.51.72
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 73.60.51.72 - tradeceylon "GET /login/?login_only=1&user=tradeceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.129.68
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 172.59.129.68 - tradecey "GET /login/?login_only=1&user=tradecey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradecey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.131.45.200
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 70.131.45.200 - trad "GET /login/?login_only=1&user=trad&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trad (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.23.23.146
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 184.23.23.146 - tr "GET /login/?login_only=1&user=tr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.161.249.112
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 107.161.249.112 - tra "GET /login/?login_only=1&user=tra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tra (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 09:30:34 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<account@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<s8iRN7BH6KJA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 09:31:27 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<Wh+4OrBHMPl100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.214.122.105
country_id: 357994
description:
2026-01-06 09:36:08 dovecot_login authenticator failed for H=(ADMIN) [188.214.122.105]:35038: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2026-01-06 09:38:28 dovecot_plain authenticator failed for H=c-174-169-224-27.hsd1.vt.comcast.net (meraters) [174.169.224.27]:42518: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 09:38:26 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<wrGwU7BHyrBCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 09:41:57 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<5FRHYLBHgNwyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 09:44:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<0pbiabBHluVm2gqW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.143
country_id: 6252001
description:
Jan  6 09:45:26 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.143, lip=66.85.158.91, TLS: Connection closed, session=<ypDdbLBHSLVChJmP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 09:46:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<cpanel@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<KBjBbrBHwo0IijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 09:45:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<account@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<aqudbLBH0KRA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 09:46:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<+N75b7BHdpEifrCV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 09:47:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<cpanel@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<bFMHc7BH8OQIijoY>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.122.139
country_id: 1819730
description:
Jan  6 09:48:39 host2 sshd[1709706]: Disconnected from invalid user vivek 101.36.122.139 port 39972 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Jan  6 09:51:02 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<cpanel@sivagnanamfoundation.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<NePAgLBHy49etwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 09:52:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=</4MjhbBHNO5m2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 09:52:36 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<account@sobaherbal.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<pg1lhrBH+o4vWBNS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.25.59.5
country_id: 3469034
description:
2026-01-06 09:53:56 dovecot_login authenticator failed for H=(ip-177-25-59-5.user.vivozap.com.br) [177.25.59.5]:59893: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 09:54:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<NIsqjLBHcp+i8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.224.242.137
country_id: 2635167
description:
2026-01-06 09:54:20 dovecot_login authenticator failed for H=([109.224.242.137]) [109.224.242.137]:37614: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 09:55:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<tpv1kbBH66Yz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 09:56:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@lankaherbalsolutions.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<2k/0k7BHKukvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 09:59:14 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<invoice@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<SQkXnrBHeNmi8KbF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  6 10:01:06 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<lJnkpLBHwNcDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.126
country_id: 6252001
description:
Jan  6 10:02:06 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.126, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<WnJ2qLBHgNTG6xh+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.10
country_id: 6252001
description:
Jan  6 10:01:20 host2 pure-ftpd[1720671]: (?@147.185.132.10) [INFO] New connection from 147.185.132.10


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 10:01:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<PZ1jprBHkpkIhpC/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  6 10:01:53 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<p9usp7BHhMMDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  6 10:02:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<EXndqLBH1M8DgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 10:03:41 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<aRT+rbBHzoZA46ZK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.57.148
country_id: 2921044
description:
2026-01-06 10:03:19 dovecot_login authenticator failed for H=(ADMIN) [212.102.57.148]:54968: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.106.136
country_id: 3865483
description:
Jan  6 10:04:50 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw>, method=PLAIN, rip=45.238.106.136, lip=66.85.158.91, TLS, session=<I5EnsbBHZ6Qt7mqI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.122.162
country_id: 226074
description:
Jan  6 10:04:30 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=196.0.122.162, lip=66.85.158.91, TLS, session=<tTHYr7BH88nEAHqi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 10:04:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postmaster@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<FEFnsbBH6Td100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2026-01-06 10:04:51 dovecot_plain authenticator failed for H=(stiones) [91.73.188.251]:33059: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  6 10:05:36 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<6o37tLBHSq0DgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  6 10:06:32 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS, session=<ZE5UuLBHwpADgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.107.155.206
country_id: 798544
description:
Jan  6 10:07:26 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=89.107.155.206, lip=66.85.158.91, TLS, session=<6SSQurBH8axZa5vO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.154.227.101
country_id: 3469034
description:
Jan  6 10:07:49 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<charanaw>, method=PLAIN, rip=177.154.227.101, lip=66.85.158.91, TLS, session=<yYOqu7BHKoaxmuNl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  6 10:08:48 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: Connection closed, session=<QsFrwLBHyMwDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 10:09:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<cpanel@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<8zAlwrBHgJJCdMzo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  6 10:10:59 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<sBw8yLBHKKoDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.179.18
country_id: 2921044
description:
Jan  6 10:11:35 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=164.92.179.18, lip=66.85.158.91, session=<+RppyrBH9U2kXLMS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.111.59
country_id: 2921044
description:
Jan  6 10:11:36 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=157.230.111.59, lip=66.85.158.91, session=<FPVwyrBHoIad5m87>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  6 10:11:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS, session=<kPAPy7BHiNMDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.135
country_id: 6252001
description:
Jan  6 10:14:40 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.135, lip=66.85.158.91, session=<9rpr1bBHzdnDuEyH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.130
country_id: 6252001
description:
Jan  6 10:14:50 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=195.184.76.130, lip=66.85.158.91, session=<zb0G1rBH65HDuEyC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.131
country_id: 6252001
description:
Jan  6 10:15:02 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=195.184.76.131, lip=66.85.158.91, session=<lIO81rBHudTDuEyD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.213
country_id: 6252001
description:
Jan  6 10:15:42 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.213, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<AGYZ2bBHwcvN0h/V>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-01-06 10:16:10 dovecot_plain authenticator failed for H=(matitarize) [24.187.213.29]:50640: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 10:17:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<O5Zl37BHjrJA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 10:17:56 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<Iznm4LBHestm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 10:21:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<dSYG7bBHFp0IijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 10:21:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<uiYG7bBHUu0ifrCV>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 10:23:04 host2 sshd[1740393]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Jan  6 10:23:01 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notice@sivagnanamfoundation.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<PZQj87BHN7RetwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 10:22:29 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<Nzs68bBH+oUIijoY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.81.142.53
country_id: 3996063
description:
2026-01-06 10:23:15 dovecot_login authenticator failed for H=(ADMIN) [77.81.142.53]:42916: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 10:24:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@sobaherbal.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<O31m97BHPs0vWBNS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.217
country_id: 6252001
description:
Jan  6 10:24:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 17 secs): user=<>, rip=147.185.133.217, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<Fz9o+bBHE8CTuYXZ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 10:25:49 host2 sshd[1742774]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 10:25:14 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mail@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<BKkT+7BHfOKi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 10:25:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<iRYD/LBHTpRm2gqW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.217
country_id: 6252001
description:
Jan  6 10:25:47 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=147.185.133.217, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<NcQq/bBHavaTuYXZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 10:26:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<yyLP/bBHEqUz0msW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.217
country_id: 6252001
description:
Jan  6 10:26:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=147.185.133.217, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<oGCR/rBHTuKTuYXZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.12
country_id: 6252001
description:
Jan  6 10:26:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=162.216.149.12, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<CRjX/rBHTsei2JUM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.12
country_id: 6252001
description:
Jan  6 10:27:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 12 secs): user=<>, rip=162.216.149.12, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<fAYdArFHqOGi2JUM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 10:28:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<6KL4BLFHILkvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 10:30:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<Ct4KDbFHINWi8KbF>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.94.210.79
country_id: 2750405
description:
Jan  6 10:31:09 host2 pure-ftpd[1747696]: (?@158.94.210.79) [INFO] New connection from 158.94.210.79


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 10:33:09 host2 sshd[1749072]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.209.245.114
country_id: 2921044
description:
Jan  6 10:34:04 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=134.209.245.114, lip=66.85.158.91, TLS, session=<GD7LGrFHhJyG0fVy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.12
country_id: 6252001
description:
Jan  6 10:34:04 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.12, lip=66.85.158.91, TLS, session=<b3fHGrFHRP6i2JUM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.217
country_id: 6252001
description:
Jan  6 10:33:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.217, lip=66.85.158.92, TLS, session=<4WLjF7FHVuWTuYXZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.217
country_id: 6252001
description:
Jan  6 10:34:21 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.133.217, lip=66.85.158.92, TLS, session=<Ao/GG7FHxPWTuYXZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.195.138.52
country_id: 6252001
description:
2026-01-06 10:34:31 dovecot_plain authenticator failed for H=c-98-195-138-52.hsd1.tx.comcast.net (riginia) [98.195.138.52]:53066: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.209.245.114
country_id: 2921044
description:
Jan  6 10:34:15 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=134.209.245.114, lip=66.85.158.91, session=<jF13G7FHQl+G0fVy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 10:35:42 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<UIqAILFHzs9A46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 10:36:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postmaster@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<bSpNJLFHgqgIhpC/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 10:37:47 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<account@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<jdz2J7FHRZ5100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 10:40:06 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<g6E+MLFH+t5CdMzo>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.253.162.162
country_id: 146669
description:
Jan  6 10:41:04 host2 pure-ftpd[1756290]: (?@185.253.162.162) [INFO] New connection from 185.253.162.162


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.134.212.206
country_id: 798544
description:
Jan  6 10:41:05 host2 pure-ftpd[1756295]: (?@45.134.212.206) [INFO] New connection from 45.134.212.206


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 10:41:53 host2 sshd[1757008]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.34.242.231
country_id: 2963597
description:
Jan  6 10:41:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=149.34.242.231, lip=66.85.158.91, TLS handshaking: Connection closed, session=<pvsBNLFHEoOVIvLn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.232.51
country_id: 2542007
description:
2026-01-06 10:41:21 dovecot_login authenticator failed for H=(ADMIN) [95.181.232.51]:6591: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 154.47.16.230
country_id: 3686110
description:
Jan  6 10:41:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=154.47.16.230, lip=66.85.158.91, TLS, session=<gQQDNLFHesCaLxDm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.64.98.5
country_id: 1655842
description:
Jan  6 10:41:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=64.64.98.5, lip=66.85.158.91, TLS, session=<ZcfuNLFHjrJAQGIF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.154.155.6
country_id: 3932488
description:
Jan  6 10:41:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=45.154.155.6, lip=66.85.158.91, TLS handshaking: Connection closed, session=<VK3tNLFHgrItmpsG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.231.243.28
country_id: 6252001
description:
2026-01-06 10:41:54 dovecot_plain authenticator failed for H=(preuddylas) [50.231.243.28]:40846: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2026-01-06 10:42:41 dovecot_plain authenticator failed for H=(amatably) [65.20.233.110]:38931: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 10:43:36 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<Lj3HPLFHaOoyBsPO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.14
country_id: 1814991
description:
Jan  6 10:43:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=94.231.206.14, lip=66.85.158.91, session=<3z35PLFHPcxe584O>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.4
country_id: 1814991
description:
Jan  6 10:43:48 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=94.231.206.4, lip=66.85.158.91, session=<ZgeZPbFHT+Be584E>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.4
country_id: 1814991
description:
Jan  6 10:44:08 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=94.231.206.4, lip=66.85.158.91, session=<plfIPrFHKexe584E>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.7
country_id: 1814991
description:
Jan  6 10:44:04 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=94.231.206.7, lip=66.85.158.91, session=<aAOQPrFHRb9e584H>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.212.198
country_id: 732800
description:
Jan  6 10:46:52 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=185.255.212.198, lip=66.85.158.91, TLS, session=<4ZWLR7FHnq+5/9TG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.222.8.179
country_id: 3077311
description:
Jan  6 10:47:10 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=31.222.8.179, lip=66.85.158.91, TLS, session=<vPGnSLFHBbcf3giz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-06 10:48:31 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:65326: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 10:49:32 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<Ja//UbFHfIVA46ZK>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.169.66.57
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 209.169.66.57 - tradecey "GET /login/?login_only=1&user=tradecey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradecey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.93.200.199
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 73.93.200.199 - tradece "GET /login/?login_only=1&user=tradece&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.38.184.120
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 99.38.184.120 - trad "GET /login/?login_only=1&user=trad&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trad (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.132.118.224
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 68.132.118.224 - tradece1 "GET /login/?login_only=1&user=tradece1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.85.250
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 172.56.85.250 - tradece2 "GET /login/?login_only=1&user=tradece2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.105.111.208
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 143.105.111.208 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.166.247
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 172.58.166.247 - tradeceylo "GET /login/?login_only=1&user=tradeceylo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceylo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 142.79.83.133
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 142.79.83.133 - tradec "GET /login/?login_only=1&user=tradec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.230.233.173
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 68.230.233.173 - tr "GET /login/?login_only=1&user=tr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.5.232.224
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 68.5.232.224 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.187.58.146
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 71.187.58.146 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.238.19.162
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 96.238.19.162 - tradeceylon "GET /login/?login_only=1&user=tradeceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 206.85.120.81
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 206.85.120.81 - tradeceyloncom "GET /login/?login_only=1&user=tradeceyloncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyloncom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.43.84.240
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 99.43.84.240 - tradeceyl "GET /login/?login_only=1&user=tradeceyl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.113.242.141
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 98.113.242.141 - trade "GET /login/?login_only=1&user=trade&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trade (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.110.3.89
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 46.110.3.89 - tra "GET /login/?login_only=1&user=tra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tra (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 10:51:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<panel@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<GK0eWLFHJulm2gqW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.194
country_id: 6252001
description:
Jan  6 10:51:17 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.247.194, lip=66.85.158.91, TLS handshaking: Connection closed, session=<o4FfWLFHKt+4affC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.11.181.236
country_id: 6252001
description:
Jan  6 10:51:58 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 3 secs): user=<>, rip=198.11.181.236, lip=66.85.158.92, session=<WNDOWrFH8JrGC7Xs>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 10:54:50 host2 sshd[1769768]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.129.57.71
country_id: 6252001
description:
2026-01-06 10:55:14 dovecot_plain authenticator failed for H=c-73-129-57-71.hsd1.md.comcast.net (throd) [73.129.57.71]:48498: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Jan  6 10:55:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mail@sivagnanamfoundation.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<X4vlZrFHPSdetwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 10:56:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<ijKQarFHSL0ifrCV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 10:56:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sale@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<3WGKarFHQLWi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 10:56:14 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<rezzabFHqqMz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 10:56:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<oArfabFHVJ0vWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 10:57:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<client@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<NM0VbrFHSqwIijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Jan  6 10:57:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@melanifinefood.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<+St8brFHTuwvT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 10:58:36 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<client@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<JztlcrFHNJUIijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 10:58:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<panel@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<sZp6c7FHnuJm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 11:00:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@lankaherbalsolutions.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<KbjOd7FHdIkvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 11:01:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<II7afLFHxKai8KbF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.88.103.70
country_id: 1861060
description:
2026-01-06 11:02:51 dovecot_login authenticator failed for H=(ADMIN) [149.88.103.70]:57042: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 11:07:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<cpanel@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<5e9ok7FHpsJA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 11:11:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<panel@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<By9pn7FHOJdCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 11:11:26 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<invoice@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=</QVLoLFHJt9100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 11:12:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<MDUjpLFHOK8IhpC/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 11:14:59 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailer-demo@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<NrT+rLFHxpgyBsPO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.235.204.218
country_id: 2017370
description:
2026-01-06 11:15:30 dovecot_login authenticator failed for H=(37-235-204-218.dynamic.customer.lanta.me) [37.235.204.218]:48250: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2026-01-06 11:15:17 dovecot_plain authenticator failed for H=(coalmolly) [75.97.190.237]:39220: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-01-06 11:16:10 dovecot_login authenticator failed for H=([200.106.49.149]) [200.106.49.149]:58164: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.40.31.154
country_id: 3865483
description:
Jan  6 11:17:36 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=179.40.31.154, lip=66.85.158.91, TLS, session=<czRNtbFHp7mzKB+a>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.26.42
country_id: 1269750
description:
Jan  6 11:17:58 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<charanaw>, method=PLAIN, rip=103.164.26.42, lip=66.85.158.91, TLS, session=<CMictrFHzLNnpBoq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2026-01-06 11:21:02 dovecot_plain authenticator failed for H=c-73-183-74-177.hsd1.pa.comcast.net (aster) [73.183.74.177]:34046: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.228.21.109
country_id: 6251999
description:
2026-01-06 11:22:00 dovecot_login authenticator failed for H=(ADMIN) [140.228.21.109]:30475: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 11:21:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<cpanel@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<TTgUxbFHKqJA46ZK>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.94.210.79
country_id: 2750405
description:
Jan  6 11:23:03 host2 pure-ftpd[1795757]: (?@158.94.210.79) [INFO] New connection from 158.94.210.79


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 11:24:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<Fr50z7FHGOFm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 11:26:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<cToj1rFHUqIz0msW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.116
country_id: 6252001
description:
Jan  6 11:27:09 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=66.132.153.116, lip=66.85.158.92, TLS: Connection closed, session=<YqOc2LFH0vdChJl0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 11:27:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<CJwr27FHhoai8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 11:28:16 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<notify@sobaherbal.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<IWh03LFHBtwvWBNS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.247
country_id: 1733045
description:
2026-01-06 11:30:16 dovecot_login authenticator failed for H=([49.124.152.247]) [49.124.152.247]:44996: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.220
country_id: 2186224
description:
2026-01-06 11:31:04 dovecot_login authenticator failed for H=([121.73.162.220]) [121.73.162.220]:53300: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2026-01-06 11:31:17 dovecot_plain authenticator failed for H=c-68-40-189-43.hsd1.mi.comcast.net (sterwhed) [68.40.189.43]:43474: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 11:31:26 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<fjDb57FHcqQifrCV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 11:32:05 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<panel@lankaherbalsolutions.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<NMAn6rFH/McvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 11:32:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<r7ta67FHkN1m2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 11:32:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sale@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<UQFv7LFHIoCi8KbF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 11:32:58 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<dtVW7bFHlrsIijoY>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 11:34:01 host2 sshd[1805339]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 11:34:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<j9eh8bFHfqQIijoY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.137.230
country_id: 1269750
description:
2026-01-06 11:37:30 dovecot_login authenticator failed for H=(abts-north-static-230.137.160.122.airtelbroadband.in) [122.160.137.230]:45874: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
country_id: 1269750
description:
2026-01-06 11:38:08 dovecot_login authenticator failed for H=(nsg-static-82.71.76.182-airtel.com) [182.76.71.82]:56990: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 11:39:58 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<vip@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<J3ZWBrJH9NJA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 11:42:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<webmaster@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<b+x/DrJHoJlCdMzo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.65.138
country_id: 2328926
description:
2026-01-06 11:44:13 dovecot_login authenticator failed for H=(ADMIN) [146.70.65.138]:31794: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 11:45:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<XEAHGbJH1l1100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 11:46:27 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contacts@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<JrCFHbJH/q8yBsPO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2026-01-06 11:47:41 dovecot_plain authenticator failed for H=c-73-213-237-28.hsd1.va.comcast.net (bilia) [73.213.237.28]:59748: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.116.165
country_id: 3144096
description:
2026-01-06 11:47:47 dovecot_login authenticator failed for H=(cm-178.232.116.165.get.no) [178.232.116.165]:53013: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.72.202.86
country_id: 192950
description:
2026-01-06 11:48:00 dovecot_login authenticator failed for H=([41.72.201.170]) [41.72.202.86]:48768: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 11:48:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<rPmjI7JHOukIhpC/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 11:53:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<vip@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<ovYkOLJHLqFA46ZK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.25
country_id: 6252001
description:
Jan  6 11:56:04 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.25, lip=66.85.158.92, TLS, session=<HjcOQLJHOufN0h8Z>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.218.50
country_id: 1269750
description:
2026-01-06 11:56:07 dovecot_login authenticator failed for H=([125.19.218.50]) [125.19.218.50]:43236: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 11:56:34 host2 sshd[1826500]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.51.135
country_id: 3144096
description:
2026-01-06 11:56:30 dovecot_login authenticator failed for H=(cm-178.232.51.135.get.no) [178.232.51.135]:50581: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 11:57:05 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<account@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<3oqCQ7JHV6Iz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 11:58:37 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shop@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<NtIKSbJHqr1m2gqW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2026-01-06 11:58:10 dovecot_plain authenticator failed for H=c-174-169-224-27.hsd1.vt.comcast.net (veles) [174.169.224.27]:56036: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 11:59:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<midoTbJHTsqi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 12:00:35 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<panel@sobaherbal.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<rBQQULJHnqwvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 12:04:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<lQtzXLJHPKai8KbF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 12:04:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<client@lankaherbalsolutions.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<4Y35XbJHvJgvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 12:05:39 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<buUsYrJHvLEifrCV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 12:06:16 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shop@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<hLthZLJHBNxm2gqW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.235.147
country_id: 102358
description:
2026-01-06 12:08:41 dovecot_login authenticator failed for H=(ADMIN) [95.181.235.147]:34081: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 12:09:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<jED6brJH4soIijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 12:10:26 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<5ORUc7JHxrMIijoY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2026-01-06 12:12:02 dovecot_plain authenticator failed for H=c-73-137-7-97.hsd1.ga.comcast.net (thelitione) [73.137.7.97]:45984: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 12:12:48 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<Lxe/e7JHbI9A46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Jan  6 12:13:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<shop@melanifinefood.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<ooWgfLJHwKwvT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 12:13:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<vip@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<B34/frJH8JhCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 12:18:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<s3DGjrJH4pkyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 12:18:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mail@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<QXt5kbJHE2F100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.118.215.229
country_id: 1880251
description:
Jan  6 12:20:07 host2 sshd[1848324]: Disconnected from invalid user gov 161.118.215.229 port 44894 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.118.215.229
country_id: 1880251
description:
Jan  6 12:20:10 host2 sshd[1848398]: Disconnected from invalid user gov 161.118.215.229 port 47522 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.10.86.130
country_id: 3895114
description:
Jan  6 12:23:45 host2 sshd[1851942]: Disconnected from invalid user rajesh 186.10.86.130 port 50214 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 12:23:57 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<Pcioo7JHcOgIhpC/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.10.86.130
country_id: 3895114
description:
Jan  6 12:26:10 host2 sshd[1854141]: Disconnected from invalid user ec2-user 186.10.86.130 port 43974 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.248.245.89
country_id: 2921044
description:
Jan  6 12:25:47 host2 sshd[1853829]: Disconnected from invalid user apollo 104.248.245.89 port 35704 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.248.245.89
country_id: 2921044
description:
Jan  6 12:26:20 host2 sshd[1854285]: Disconnected from invalid user tester 104.248.245.89 port 56728 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 12:26:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<cikRrrJHoqFA46ZK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.10
country_id: 1269750
description:
2026-01-06 12:27:24 dovecot_login authenticator failed for H=(aes-static-137.135.17.125.airtel.in) [182.95.228.10]:46814: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.242.112.200
country_id: 1269750
description:
2026-01-06 12:27:42 dovecot_login authenticator failed for H=(121.242.112.200.static-hyderabad.vsnl.net.in) [121.242.112.200]:41930: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 12:27:57 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<A434sbJHTKQz0msW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.10.86.130
country_id: 3895114
description:
Jan  6 12:28:15 host2 sshd[1855955]: Disconnected from invalid user james 186.10.86.130 port 45450 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.248.245.89
country_id: 2921044
description:
Jan  6 12:28:19 host2 sshd[1856013]: Disconnected from invalid user josh 104.248.245.89 port 39210 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.137.144
country_id: 1605651
description:
Jan  6 12:28:21 host2 sshd[1856055]: Disconnected from invalid user mongodb 27.254.137.144 port 35756 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 12:29:46 host2 sshd[1857262]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  6 12:30:09 host2 sshd[1857359]: Disconnected from invalid user user 2.57.121.25 port 51808 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2026-01-06 12:29:40 dovecot_plain authenticator failed for H=c-73-196-144-25.hsd1.nj.comcast.net (sness) [73.196.144.25]:57044: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.55.189.211
country_id: 6252001
description:
2026-01-06 12:30:38 dovecot_login authenticator failed for H=(wllk99-129-211.dsl.netins.net) [67.55.189.211]:50237: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.188.140
country_id: 3996063
description:
2026-01-06 12:31:00 dovecot_login authenticator failed for H=([140.84.188.140]) [140.84.188.140]:39460: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.209.108.42
country_id: 6254930
description:
2026-01-06 12:31:12 dovecot_plain authenticator failed for H=(nonon) [185.209.108.42]:35096: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.254.137.144
country_id: 1605651
description:
Jan  6 12:30:21 host2 sshd[1857955]: Disconnected from invalid user arjun 27.254.137.144 port 46174 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 12:31:34 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sale@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<RJ7fvrJHUJ2i8GQy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.52.88
country_id: 6252001
description:
Jan  6 12:31:49 host2 sshd[1859101]: Disconnected from invalid user claude 209.141.52.88 port 48920 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 12:32:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<dPYww7JHOLpm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 12:32:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<client@sobaherbal.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<zuOww7JHwusvWBNS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.156
country_id: 3703430
description:
Jan  6 12:32:56 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (disconnected before auth was ready, waited 0 secs): user=<>, rip=45.227.254.156, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<LfDmw7JHHv8t4/6c>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.215.235.115
country_id: 1831722
description:
2026-01-06 12:35:54 dovecot_login authenticator failed for H=(ADMIN) [188.215.235.115]:63592: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.203.49.121
country_id: 2963597
description:
Jan  6 12:36:05 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=37.203.49.121, lip=66.85.158.91, TLS, session=<hfc0zrJHcLglyzF5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 12:35:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<vip@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<6yxszbJHLr+i8KbF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.186.12.17
country_id: 798544
description:
Jan  6 12:35:48 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=89.186.12.17, lip=66.85.158.91, TLS, session=<uwclzbJH5blZugwR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 12:36:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<D4Gx0bJH3tcvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.17.125.224
country_id: 690791
description:
Jan  6 12:36:53 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=185.17.125.224, lip=66.85.158.91, TLS, session=<kwYI0bJH1da5EX3g>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.124.182.140
country_id: 3175395
description:
Jan  6 12:37:16 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=185.124.182.140, lip=66.85.158.91, TLS, session=<z3lC0rJHsJq5fLaM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 12:39:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<LZ4p27JHcroifrCV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 12:40:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<jDKP3rJH8qZm2gqW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.83.151.102
country_id: 6252001
description:
Jan  6 12:41:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.83.151.102, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<LMOt4rJHxt0UU5dm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.170.26.169
country_id: 2077456
description:
2026-01-06 12:41:52 dovecot_login authenticator failed for H=(124-170-26-169.tpgi.com.au) [124.170.26.169]:52690: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 12:42:43 host2 sshd[1869774]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.122
country_id: 1269750
description:
2026-01-06 12:42:27 dovecot_login authenticator failed for H=([182.95.230.122]) [182.95.230.122]:49084: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 12:45:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<uL/K77JHONoIijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 12:44:51 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<yYZa7rJH0oVCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 12:46:41 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<9sbq9LJHcONA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 12:46:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<M0Am9LJHJMMIijoY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.126
country_id: 6252001
description:
Jan  6 12:51:23 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.126, lip=66.85.158.92, session=<PlndBbNHTOmTuYR+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 12:52:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<kt6vCrNHtUh100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.102.232.38
country_id: 3057568
description:
2026-01-06 12:57:49 dovecot_login authenticator failed for H=(ADMIN) [149.102.232.38]:64020: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 12:58:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<zrZaH7NHXpkIhpC/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 12:58:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<o8QJILNHKuGi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 13:00:17 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<doCPJbNHXNIvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 13:02:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<HsFhLLNHjtwz0msW>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 13:02:37 host2 sshd[1890564]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 13:02:41 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<4zImLrNHWtFA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 13:03:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<DEB8MLNHiuCi8KbF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2026-01-06 13:04:20 dovecot_login authenticator failed for H=([152.52.218.233]) [182.78.79.134]:59582: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 13:04:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<1HgdNrNHDzB100Db>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 138.197.42.221
country_id: 6252001
description:
Jan  6 13:05:04 host2 pure-ftpd[1893245]: (?@138.197.42.221) [INFO] New connection from 138.197.42.221


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.199.197.102
country_id: 6252001
description:
Jan  6 13:06:16 host2 pure-ftpd[1894351]: (?@134.199.197.102) [INFO] New connection from 134.199.197.102


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Jan  6 13:08:39 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@melanifinefood.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<062FQ7NHwLYvT1jH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.16.157.39
country_id: 6252001
description:
2026-01-06 13:09:14 dovecot_plain authenticator failed for H=([10.5.0.2]) [154.16.157.39]:17007: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.16.157.39
country_id: 6252001
description:
2026-01-06 13:09:20 dovecot_login authenticator failed for H=([10.5.0.2]) [154.16.157.39]:17007: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.27.92.31
country_id: 6252001
description:
[2026-01-06 13:11:12 +0530] info [cpaneld] 45.27.92.31 - tradece "GET /login/?login_only=1&user=tradece&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.91.157.162
country_id: 6252001
description:
[2026-01-06 13:11:15 +0530] info [cpaneld] 68.91.157.162 - tradec "GET /login/?login_only=1&user=tradec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 132.147.156.194
country_id: 6252001
description:
[2026-01-06 13:11:02 +0530] info [cpaneld] 132.147.156.194 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.72.244.154
country_id: 6252001
description:
[2026-01-06 13:11:00 +0530] info [cpaneld] 108.72.244.154 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.192.138.188
country_id: 6252001
description:
[2026-01-06 13:11:05 +0530] info [whostmgrd] 72.192.138.188 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.244.84.239
country_id: 6252001
description:
[2026-01-06 13:11:07 +0530] info [cpaneld] 108.244.84.239 - tradeceylo "GET /login/?login_only=1&user=tradeceylo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceylo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.111.238.115
country_id: 6252001
description:
[2026-01-06 13:11:17 +0530] info [cpaneld] 68.111.238.115 - trade "GET /login/?login_only=1&user=trade&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trade (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.66.91.165
country_id: 6252001
description:
[2026-01-06 13:11:10 +0530] info [cpaneld] 108.66.91.165 - tradecey "GET /login/?login_only=1&user=tradecey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradecey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.86.225.0
country_id: 6252001
description:
[2026-01-06 13:11:06 +0530] info [cpaneld] 67.86.225.0 - tradeceyloncom "GET /login/?login_only=1&user=tradeceyloncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyloncom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.248.148.21
country_id: 6252001
description:
[2026-01-06 13:11:03 +0530] info [cpaneld] 167.248.148.21 - tradeceylon "GET /login/?login_only=1&user=tradeceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.188.215
country_id: 6252001
description:
[2026-01-06 13:11:09 +0530] info [cpaneld] 172.59.188.215 - tradeceyl "GET /login/?login_only=1&user=tradeceyl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.61.160.224
country_id: 6252001
description:
[2026-01-06 13:11:23 +0530] info [cpaneld] 24.61.160.224 - tradece1 "GET /login/?login_only=1&user=tradece1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.56.75.94
country_id: 6252001
description:
[2026-01-06 13:11:24 +0530] info [cpaneld] 98.56.75.94 - tradece2 "GET /login/?login_only=1&user=tradece2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece2 (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.169.105.48
country_id: 6252001
description:
Jan  6 13:11:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.169.105.48, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<vVu1TrNHRoAUqWkw>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.18.83.250
country_id: 6252001
description:
[2026-01-06 13:11:18 +0530] info [cpaneld] 47.18.83.250 - trad "GET /login/?login_only=1&user=trad&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trad (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.67.83.28
country_id: 6252001
description:
[2026-01-06 13:11:20 +0530] info [cpaneld] 97.67.83.28 - tra "GET /login/?login_only=1&user=tra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tra (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.117.36.181
country_id: 6252001
description:
[2026-01-06 13:11:21 +0530] info [cpaneld] 24.117.36.181 - tr "GET /login/?login_only=1&user=tr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tr (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 13:13:02 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<PcIzU7NHFqEifrCV>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 66.116.204.232
country_id: 1269750
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[66.116.204.232] [Remote Port]=[49944] [Authentication Database]=[mail] [Username]=[sales@kiriaswanu.com] (10/10 failures) (blocked until [Wed Jan  7 07:43:36 2026 UTC/Wed Jan  7 13:13:36 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 13:13:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<IodMVbNHGMNCdMzo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 144.126.237.13
country_id: 2635167
description:
Jan  6 13:15:11 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=144.126.237.13, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<VVb3WrNHcqGQfu0N>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 13:15:24 host2 sshd[1903633]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.244.52.64
country_id: 798549
description:
2026-01-06 13:15:46 dovecot_login authenticator failed for H=(ADMIN) [143.244.52.64]:44959: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 13:16:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<vtQwX7NHZI9A46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 13:17:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<hmohY7NHlNAIijoY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.94.66
country_id: 1269750
description:
2026-01-06 13:17:49 dovecot_login authenticator failed for H=([27.123.94.66]) [27.123.94.66]:39428: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.67.22
country_id: 1269750
description:
2026-01-06 13:18:07 dovecot_login authenticator failed for H=(nsg-corporate-246.50.185.122.airtel.in) [182.78.67.22]:51952: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 13:17:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=</JqRYrNHTr1m2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 13:17:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<Bbu8YrNHhpMyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 13:18:39 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<xYxKZ7NHfLkIijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.18.235
country_id: 2300660
description:
Jan  6 13:18:50 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=41.139.18.235, lip=66.85.158.91, TLS, session=<oMnMZrNH8bEpixLr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.62.192
country_id: 953987
description:
Jan  6 13:19:25 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=102.129.62.192, lip=66.85.158.91, TLS, session=<yeL4aLNHKOlmgT7A>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 188.241.177.36
country_id: 3469034
description:
Jan  6 13:23:51 host2 dovecot[1170291]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=188.241.177.36, lip=66.85.158.91, session=<Fd31ebNHpMe88bEk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 154.47.29.203
country_id: 3202326
description:
Jan  6 13:23:51 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=154.47.29.203, lip=66.85.158.91, TLS handshaking: Connection closed, session=<nJf4ebNHptyaLx3L>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.78.54.111
country_id: 2750405
description:
Jan  6 13:23:48 host2 pure-ftpd[1910911]: (?@195.78.54.111) [INFO] New connection from 195.78.54.111


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.70.11.62
country_id: 3895114
description:
Jan  6 13:23:51 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=146.70.11.62, lip=66.85.158.91, TLS, session=<uGv4ebNHrtySRgs+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.78.138.227
country_id: 2802361
description:
Jan  6 13:24:57 host2 pure-ftpd[1911995]: (?@34.78.138.227) [INFO] New connection from 34.78.138.227


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 13:24:56 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<nzGrfbNHyMZm2gqW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.85.196
country_id: 294640
description:
2026-01-06 13:25:57 dovecot_login authenticator failed for H=(31-154-85-196.orange.net.il) [2.55.85.196]:57429: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.220.168
country_id: 337996
description:
2026-01-06 13:26:20 dovecot_login authenticator failed for H=([196.190.220.168]) [196.190.220.168]:48050: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 13:29:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<yHrBjbNHtLOi8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2026-01-06 13:31:44 dovecot_plain authenticator failed for H=(alibis) [75.97.190.237]:37854: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 13:31:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<glUvlrNHntcz0msW>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 51.210.107.22
country_id: 3017382
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[51.210.107.22] [Remote Port]=[55198] [Authentication Database]=[mail] [Username]=[info@mathsmotorcysle.xyz] (10/10 failures) (blocked until [Wed Jan  7 08:01:44 2026 UTC/Wed Jan  7 13:31:44 2026 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.210.105.202
country_id: 3175395
description:
2026-01-06 13:32:46 dovecot_login authenticator failed for H=95-210-105-202.ip.skylogicnet.com [95.210.105.202]:65042: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.133.161.162
country_id: 130758
description:
2026-01-06 13:33:01 dovecot_login authenticator failed for H=([85.133.161.162]) [85.133.161.162]:36448: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 13:33:37 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<ro3LnLNHCLAIhpC/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 13:34:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<OpC2nrNHipei8KbF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 13:35:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=</hyCorNHYuNA46ZK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.152.42
country_id: 2658434
description:
2026-01-06 13:35:53 dovecot_login authenticator failed for H=(ADMIN) [158.173.152.42]:26134: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.237.107
country_id: 3144096
description:
2026-01-06 13:36:13 dovecot_login authenticator failed for H=(cm-178.232.237.107.get.no) [178.232.237.107]:53676: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.138
country_id: 1269750
description:
2026-01-06 13:36:29 dovecot_login authenticator failed for H=([128.185.201.138]) [128.185.201.138]:52342: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.98.91
country_id: 6252001
description:
Jan  6 13:38:18 host2 sshd[1924574]: Disconnected from invalid user ubuntu 101.36.98.91 port 47952 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 13:38:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<dMQ9rrNHL+B100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.199.224.52
country_id: 357994
description:
Jan  6 13:40:11 host2 sshd[1926395]: Disconnected from invalid user vpn 197.199.224.52 port 51678 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.199.224.52
country_id: 357994
description:
Jan  6 13:41:25 host2 sshd[1927646]: Disconnected from invalid user claude 197.199.224.52 port 50814 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.199.224.52
country_id: 357994
description:
Jan  6 13:42:37 host2 sshd[1928721]: Disconnected from invalid user joaquin 197.199.224.52 port 49966 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.98.91
country_id: 6252001
description:
Jan  6 13:43:13 host2 sshd[1929403]: Disconnected from invalid user usuario1 101.36.98.91 port 38796 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.98.91
country_id: 6252001
description:
Jan  6 13:43:46 host2 sshd[1929813]: Disconnected from invalid user vpn 101.36.98.91 port 55462 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.98.91
country_id: 6252001
description:
Jan  6 13:44:17 host2 sshd[1930250]: Disconnected from invalid user claude 101.36.98.91 port 51478 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 13:44:58 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<wWNexbNHFppCdMzo>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 57.128.239.181
country_id: 798544
description:
Jan  6 13:45:25 host2 sshd[1931469]: Disconnected from invalid user claude 57.128.239.181 port 54822 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Jan  6 13:46:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<LerHybNHltAvT1jH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.128.239.181
country_id: 798544
description:
Jan  6 13:46:29 host2 sshd[1932698]: Disconnected from invalid user vpn 57.128.239.181 port 56636 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 13:46:58 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<87uBzLNHeMcifrCV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 13:48:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<Xt/S0LNHOrAyBsPO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  6 13:47:21 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<QPAFzrNHBowDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 13:49:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<fZK31LNHjrtA46ZK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  6 13:48:43 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<uXrv0rNHetUDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  6 13:50:27 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<d28Z2bNH/JsDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 13:50:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<W7GV2rNHZuVm2gqW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  6 13:51:30 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<t7fW3LNHZJ0DhBfJ>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  6 13:52:12 host2 dovecot[1170291]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=</vNY37NHOo8DhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 13:52:47 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<5sBP4bNH8t8IijoY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  6 13:53:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<LQK94rNHFt4DhBfJ>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  6 13:53:15 host2 dovecot[1170291]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<r5Eh47NHxsoDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  6 13:53:28 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<jmLq47NHAosDhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  6 13:53:36 host2 sshd[1939539]: Disconnected from invalid user admin 2.57.121.112 port 52724 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.56.52.106
country_id: 6251999
description:
2026-01-06 13:53:40 dovecot_login authenticator failed for H=(ADMIN) [212.56.52.106]:50851: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 13:54:02 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<IazE5bNH1sgIijoY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.23.199.49
country_id: 1643084
description:
Jan  6 13:54:19 host2 sshd[1940445]: Disconnected from invalid user claude 103.23.199.49 port 45292 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  6 13:54:28 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<Izt957NH8qEDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.241.132.152
country_id: 1269750
description:
2026-01-06 13:54:31 dovecot_login authenticator failed for H=(static.ill.117.248.107.130.bsnl.co.in) [43.241.132.152]:43080: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2026-01-06 13:54:48 dovecot_login authenticator failed for H=([83.136.176.12]) [83.136.176.12]:53365: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.43.123
country_id: 6252001
description:
2026-01-06 13:55:25 dovecot_plain authenticator failed for H=c-71-229-43-123.hsd1.ga.comcast.net (baren) [71.229.43.123]:50658: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.77.137.236
country_id: 1605651
description:
2026-01-06 13:55:42 dovecot_login authenticator failed for H=([110.77.137.236]) [110.77.137.236]:37450: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 13:58:37 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<Ylos9rNHDq5m2gqW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.216.211.19
country_id: 1269750
description:
Jan  6 13:59:06 host2 sshd[1944794]: Disconnected from invalid user guest 117.216.211.19 port 37284 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.100
country_id: 3469034
description:
Jan  6 13:59:45 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=190.89.137.100, lip=66.85.158.91, TLS, session=<HwkN+bNHUu2+WYlk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.60.190
country_id: 953987
description:
Jan  6 14:00:06 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw>, method=PLAIN, rip=102.129.60.190, lip=66.85.158.91, TLS, session=<7TSG+rNH3rBmgTy+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.227.147.163
country_id: 6252001
description:
Jan  6 13:59:36 host2 sshd[1945249]: Disconnected from invalid user console 23.227.147.163 port 46802 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 189.202.206.163
country_id: 3996063
description:
Jan  6 14:00:56 host2 dovecot[1170291]: imap-login: Disconnected: Aborted login by logging out (auth failed, 1 attempts in 3 secs): user=<training@v-deploy.com>, method=PLAIN, rip=189.202.206.163, lip=66.85.158.91, TLS, session=<Dvdz/rNH3Ie9ys6j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.216.211.19
country_id: 1269750
description:
Jan  6 14:01:01 host2 sshd[1946715]: Disconnected from invalid user postgres 117.216.211.19 port 35698 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 23.227.147.163
country_id: 6252001
description:
Jan  6 14:00:41 host2 sshd[1946466]: Disconnected from invalid user claude 23.227.147.163 port 34720 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.253.226
country_id: 1269750
description:
2026-01-06 14:01:07 dovecot_login authenticator failed for H=(abts-kk-static-226.253.166.122.airtelbroadband.in) [122.166.253.226]:39599: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-06 14:01:14 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:64755: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.69.161.214
country_id: 6252001
description:
2026-01-06 14:01:17 dovecot_login authenticator failed for H=([208.69.161.214]) [208.69.161.214]:39768: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 14:00:29 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<uFvg/LNHXIai8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.205.135
country_id: 298795
description:
2026-01-06 14:01:08 dovecot_login authenticator failed for H=([5.11.205.135]) [5.11.205.135]:47513: 535 Incorrect authentication data


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.227.147.163
country_id: 6252001
description:
Jan  6 14:02:17 host2 sshd[1947987]: Disconnected from invalid user guest 23.227.147.163 port 47700 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 14:01:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<9BU6ALRHTNMz0msW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.233.118.22
country_id: 3469034
description:
Jan  6 14:03:30 host2 sshd[1949396]: Disconnected from invalid user friend 186.233.118.22 port 39470 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 117.216.211.19
country_id: 1269750
description:
Jan  6 14:03:26 host2 sshd[1949316]: Disconnected from invalid user zhangbin 117.216.211.19 port 43736 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 37.46.115.45
country_id: 6290252
description:
Jan  6 14:04:26 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=37.46.115.45, lip=66.85.158.91, TLS, session=<X6MXC7RHQJklLnMt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 102.129.145.92
country_id: 6252001
description:
Jan  6 14:04:26 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=102.129.145.92, lip=66.85.158.91, TLS handshaking: Connection closed, session=<vUcXC7RHNJlmgZFc>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.108.174.163
country_id: 1269750
description:
Jan  6 14:04:25 host2 pure-ftpd[1950390]: (?@103.108.174.163) [INFO] New connection from 103.108.174.163


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 93.62.72.229
country_id: 3175395
description:
Jan  6 14:04:17 host2 sshd[1950208]: Disconnecting authenticating user root 93.62.72.229 port 14286: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 93.62.72.229
country_id: 3175395
description:
Jan  6 14:04:17 host2 sshd[1950208]: error: maximum authentication attempts exceeded for root from 93.62.72.229 port 14286 ssh2 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 14:05:21 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<S5tNDrRHhLGi8KbF>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.203.58.203
country_id: 6252001
description:
Jan  6 14:05:40 host2 sshd[1951809]: Disconnected from invalid user claude 172.203.58.203 port 59590 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.233.118.22
country_id: 3469034
description:
Jan  6 14:06:48 host2 sshd[1953023]: Disconnected from invalid user smbuser 186.233.118.22 port 56600 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.233.118.22
country_id: 3469034
description:
Jan  6 14:07:26 host2 sshd[1953675]: Disconnected from invalid user book 186.233.118.22 port 50408 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 14:08:05 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<1FsKGLRHOshA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 14:09:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<4Iz4HLRHrJIIhpC/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.203.58.203
country_id: 6252001
description:
Jan  6 14:09:42 host2 sshd[1956178]: Disconnected from invalid user magento 172.203.58.203 port 54468 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 14:11:39 host2 sshd[1958503]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 14:12:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<wQwmJ7RHC0Z100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.18.140
country_id: 2921044
description:
2026-01-06 14:14:02 dovecot_login authenticator failed for H=(ADMIN) [138.199.18.140]:60533: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 14:16:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<mXwXN7RH7MVCdMzo>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 14:17:31 host2 sshd[1965303]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.252.229.25
country_id: 1819730
description:
Jan  6 14:18:50 host2 sshd[1966705]: Disconnected from invalid user socks 43.252.229.25 port 45560 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 14:19:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<Klk5QLRH3rYyBsPO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.211.55.20
country_id: 2328926
description:
Jan  6 14:19:25 host2 sshd[1967529]: Disconnected from invalid user sysadmin 197.211.55.20 port 49252 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2026-01-06 14:20:36 dovecot_plain authenticator failed for H=c-73-195-211-98.hsd1.nj.comcast.net (cologion) [73.195.211.98]:32890: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 14:21:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<RpooR7RHSq0ifrCV>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.211.55.20
country_id: 2328926
description:
Jan  6 14:22:06 host2 sshd[1971208]: Disconnected from invalid user claude 197.211.55.20 port 34138 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 14:22:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<k3YDS7RHgrlA46ZK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.252.229.25
country_id: 1819730
description:
Jan  6 14:22:27 host2 sshd[1971558]: Disconnected from invalid user webmaster 43.252.229.25 port 33080 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.211.55.20
country_id: 2328926
description:
Jan  6 14:22:44 host2 sshd[1971853]: Disconnected from invalid user tushar 197.211.55.20 port 35634 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 14:24:40 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<MKteU7RHkLBm2gqW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.211.55.20
country_id: 2328926
description:
Jan  6 14:26:00 host2 sshd[1975778]: Disconnected from invalid user ais 197.211.55.20 port 52808 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Jan  6 14:26:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<732/WbRHNtYvT1jH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.53.32.129
country_id: 2921044
description:
Jan  6 14:26:32 host2 sshd[1976384]: Disconnected from invalid user agent 152.53.32.129 port 52334 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 14:28:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<5vDaX7RHFIEIijoY>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.252.229.25
country_id: 1819730
description:
Jan  6 14:28:30 host2 sshd[1978516]: Disconnected from invalid user system 43.252.229.25 port 40322 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.53.32.129
country_id: 2921044
description:
Jan  6 14:28:35 host2 sshd[1978732]: Disconnected from invalid user ubuntu 152.53.32.129 port 55732 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.118
country_id: 3017382
description:
Jan  6 14:30:03 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.196.152.118, lip=66.85.158.92, TLS: Connection closed, session=<mg/BZrRHqc1bxJh2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 14:29:21 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<VsAfZLRHUNgIijoY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.191
country_id: 3017382
description:
Jan  6 14:29:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=91.231.89.191, lip=66.85.158.92, TLS handshaking: Connection closed, session=<NWRCZLRHU+lb51m/>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.53.32.129
country_id: 2921044
description:
Jan  6 14:29:41 host2 sshd[1979932]: Disconnected from invalid user navid 152.53.32.129 port 58888 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.41
country_id: 3017382
description:
Jan  6 14:29:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.231.89.41, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<OQe+ZbRHlcZb51kp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.45
country_id: 3017382
description:
Jan  6 14:29:32 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.231.89.45, lip=66.85.158.92, TLS: Connection closed, session=<AdHpZLRHQ9Bb51kt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.27
country_id: 3017382
description:
Jan  6 14:29:53 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.196.152.27, lip=66.85.158.92, TLS handshaking: Connection closed, session=<800hZrRHibFbxJgb>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 14:30:33 host2 sshd[1981057]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.40
country_id: 6252001
description:
Jan  6 14:30:53 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.40, lip=66.85.158.91, TLS, session=<FL68abRHguLN0h8o>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.188.183.95
country_id: 3017382
description:
2026-01-06 14:30:55 dovecot_login authenticator failed for H=(ADMIN) [203.188.183.95]:54609: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.118
country_id: 3017382
description:
Jan  6 14:30:20 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.118, lip=66.85.158.92, TLS: Connection closed, session=<QgO5Z7RHqaZbxJh2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.176.157.57
country_id: 6252001
description:
2026-01-06 14:30:40 dovecot_plain authenticator failed for H=c-73-176-157-57.hsd1.il.comcast.net (crocal) [73.176.157.57]:55188: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 14:31:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<xNHRa7RHXNEz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 14:31:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<pwfCbLRH5sai8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 14:32:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<g2/1brRH7Llm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 14:36:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<fCMpf7RHqoSi8KbF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.5
country_id: 130758
description:
2026-01-06 14:38:17 dovecot_login authenticator failed for H=(localhost) [62.60.130.5]:16366: 535 Incorrect authentication data (set_id=rqwrqwrqw)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.21
country_id: 798549
description:
Jan  6 14:38:51 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=85.217.149.21, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<dSA3hrRHvLBV2ZUV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.12
country_id: 798549
description:
Jan  6 14:40:03 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=85.217.149.12, lip=66.85.158.91, session=<G0l/irRHUpxV2ZUM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 14:41:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<5+cvjrRHQsdA46ZK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.14
country_id: 798549
description:
Jan  6 14:43:22 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.14, lip=66.85.158.91, TLS: Connection closed, session=<4JlXlrRHrotV2ZUO>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 14:44:24 host2 sshd[1994047]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 14:45:05 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<pYFlnLRHAoUIhpC/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.129.75
country_id: 2264397
description:
Jan  6 14:44:27 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_read failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=45.156.129.75, lip=66.85.158.92, TLS: SSL_read failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<BVg0mrRHltEtnIFL>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 45.156.129.75
country_id: 2264397
description:
Jan  6 14:44:26 host2 dovecot[1170291]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=45.156.129.75, lip=66.85.158.92, TLS, session=<0jUxmrRHo6YtnIFL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.129.78
country_id: 2264397
description:
Jan  6 14:44:27 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.156.129.78, lip=66.85.158.92, TLS, session=<7eU2mrRHNZAtnIFO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.129.76
country_id: 2264397
description:
Jan  6 14:44:27 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=45.156.129.76, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<k6U3mrRHYcotnIFM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.157.158
country_id: 1269750
description:
2026-01-06 14:45:44 dovecot_login authenticator failed for H=([128.185.70.193]) [125.19.157.158]:34848: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.39
country_id: 2186224
description:
2026-01-06 14:46:13 dovecot_login authenticator failed for H=([121.73.163.39]) [121.73.163.39]:56774: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2026-01-06 14:46:41 dovecot_login authenticator failed for H=([173.25.186.130]) [173.25.186.130]:57159: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 85.217.149.12
country_id: 798549
description:
Jan  6 14:46:44 host2 pure-ftpd[1996623]: (?@85.217.149.12) [INFO] New connection from 85.217.149.12


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 14:46:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<LP02orRHOlR100Db>


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 85.217.149.12
country_id: 798549
description:
Jan  6 14:46:49 host2 pure-ftpd[1996753]: (?@85.217.149.12) [INFO] New connection from 85.217.149.12


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.83.107
country_id: 2635167
description:
Jan  6 14:47:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=46.101.83.107, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<nUelprRH2LUuZVNr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 14:48:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<p/wPqbRHDIxCdMzo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.46.148.180
country_id: 6252001
description:
2026-01-06 14:49:28 dovecot_plain authenticator failed for H=c-68-46-148-180.hsd1.mi.comcast.net (dingnous) [68.46.148.180]:53896: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 14:50:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<nhVFr7RH5pAyBsPO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.32.50.39
country_id: 6252001
description:
2026-01-06 14:50:36 dovecot_login authenticator failed for H=(ADMIN) [212.32.50.39]:46733: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 14:55:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<gU7uwLRHauNA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 14:55:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<z34WwrRHmogifrCV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 14:58:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<KSbqy7RHitJm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 15:01:37 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<xbF317RHLc8z0msW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.82.194
country_id: 1269750
description:
2026-01-06 15:03:00 dovecot_login authenticator failed for H=([59.145.171.168]) [182.78.82.194]:40960: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.115.237.19
country_id: 3923057
description:
2026-01-06 15:02:39 dovecot_login authenticator failed for H=([181.115.237.19]) [181.115.237.19]:56109: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 15:03:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<3SLs3bRHmpqi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 15:03:29 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<PH0q3rRHgJAIijoY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2026-01-06 15:04:07 dovecot_plain authenticator failed for H=c-71-224-169-28.hsd1.pa.comcast.net (ittly) [71.224.169.28]:51178: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Jan  6 15:04:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@melanifinefood.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<nRl64bRHDIkvT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 15:04:39 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<tdlU4rRHrucIijoY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-06 15:05:24 dovecot_plain authenticator failed for H=(togerdeste) [64.72.74.162]:49093: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 15:06:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<bKC457RH0rJm2gqW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.250.201.1
country_id: 2245662
description:
2026-01-06 15:07:11 dovecot_login authenticator failed for H=([196.250.201.125]) [196.250.201.1]:10141: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.143
country_id: 1819730
description:
2026-01-06 15:06:56 dovecot_login authenticator failed for H=(223-197-153-143.static.imsbiz.com) [223.197.153.143]:60953: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 15:08:06 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<5Fix7rRHtq2i8KbF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.194
country_id: 99237
description:
2026-01-06 15:08:31 dovecot_plain authenticator failed for H=(dumbles) [65.20.148.194]:34952: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.122.43
country_id: 3042058
description:
2026-01-06 15:11:03 dovecot_login authenticator failed for H=(ADMIN) [91.90.122.43]:8389: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 15:13:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<43N3A7VHwpZA46ZK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-01-06 15:17:39 dovecot_plain authenticator failed for H=(chark) [102.53.15.18]:46136: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.178.136
country_id: 3175395
description:
Jan  6 15:19:03 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=217.26.178.136, lip=66.85.158.91, TLS, session=<zUC3FLVHGKvZGrKI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.231.47.253
country_id: 1269750
description:
Jan  6 15:19:03 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=103.231.47.253, lip=66.85.158.91, TLS, session=<StHCFLVHI59n5y/9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.112.105.140
country_id: 3175395
description:
Jan  6 15:19:21 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<hr>, method=PLAIN, rip=217.112.105.140, lip=66.85.158.91, TLS, session=<EvoTFrVHb7vZcGmM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.235.7.231
country_id: 3077311
description:
Jan  6 15:19:21 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<hr>, method=PLAIN, rip=109.235.7.231, lip=66.85.158.91, TLS, session=<ILkOFrVHpN1t6wfn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.112.148.66
country_id: 130758
description:
2026-01-06 15:19:27 dovecot_login authenticator failed for H=([185.112.148.66]) [185.112.148.66]:59227: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.170
country_id: 1269750
description:
2026-01-06 15:19:39 dovecot_login authenticator failed for H=([182.95.52.170]) [182.95.52.170]:54844: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 15:20:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<qv7jGrVHUKhCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 15:20:41 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<QLu1G7VHf+x100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 15:20:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<BZd/HLVHfowIhpC/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 15:21:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<Na6CHrVHRsYyBsPO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  6 15:25:38 host2 sshd[2035026]: Disconnected from invalid user admin 2.57.121.112 port 13485 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.119.198.81
country_id: 3932488
description:
Jan  6 15:27:51 host2 sshd[2036868]: Disconnected from invalid user user5 190.119.198.81 port 37868 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 15:28:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<o4s1N7VHuqRA46ZK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.124.206
country_id: 1269750
description:
2026-01-06 15:29:05 dovecot_login authenticator failed for H=([182.95.87.3]) [182.95.124.206]:34196: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2026-01-06 15:29:35 dovecot_login authenticator failed for H=([59.145.84.169]) [182.95.176.122]:45690: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.142.106.177
country_id: 298795
description:
2026-01-06 15:30:04 dovecot_login authenticator failed for H=([188.132.210.145]) [195.142.106.177]:12066: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 15:30:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<b/tmPbVHoIQifrCV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.6.147
country_id: 3144096
description:
2026-01-06 15:30:46 dovecot_login authenticator failed for H=(cm-78.156.6.147.get.no) [78.156.6.147]:43556: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.252
country_id: 2186224
description:
2026-01-06 15:30:26 dovecot_login authenticator failed for H=([121.73.168.252]) [121.73.168.252]:53754: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.100.64.148
country_id: 289688
description:
Jan  6 15:30:26 host2 sshd[2039476]: Disconnected from invalid user paulo 78.100.64.148 port 62868 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.211.152.138
country_id: 3469034
description:
Jan  6 15:31:09 host2 sshd[2040115]: Disconnected from invalid user ferry 102.211.152.138 port 47348 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.119.198.81
country_id: 3932488
description:
Jan  6 15:31:12 host2 sshd[2040151]: Disconnected from invalid user noc 190.119.198.81 port 34556 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 15:31:42 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<Ei0RQ7VH88wz0msW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.119.198.81
country_id: 3932488
description:
Jan  6 15:32:27 host2 sshd[2041243]: Disconnected from invalid user claude 190.119.198.81 port 58124 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 15:33:01 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<eRfOR7VH/rxm2gqW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.100.64.148
country_id: 289688
description:
Jan  6 15:33:11 host2 sshd[2041998]: Disconnected from invalid user eric 78.100.64.148 port 56364 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.242.142
country_id: 1269750
description:
2026-01-06 15:33:40 dovecot_login authenticator failed for H=([182.78.242.142]) [182.78.242.142]:37456: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.36.108
country_id: 3932488
description:
2026-01-06 15:33:53 dovecot_login authenticator failed for H=([190.223.36.108]) [190.223.36.108]:58696: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 15:35:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<pyp5T7VHkNyi8GQy>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 78.100.64.148
country_id: 289688
description:
Jan  6 15:35:13 host2 sshd[2044472]: Disconnected from invalid user admin 78.100.64.148 port 37452 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.239.23
country_id: 1227603
description:
2026-01-06 15:35:37 dovecot_login authenticator failed for H=(ADMIN) [95.181.239.23]:15684: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 15:38:36 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<RJ7HW7VHyp8IijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 15:39:39 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<yluLX7VH2MCi8KbF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 15:39:48 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<cOEIYLVHqIgIijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 15:40:40 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<jKgqY7VH+pdm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Jan  6 15:42:21 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<HvkgabVH4LkvT1jH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan  6 15:45:45 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<bopwdbVHzqEDiUnd>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 15:46:26 host2 sshd[2056416]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan  6 15:46:29 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<p+QaeLVHLtIDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan  6 15:47:43 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<bf91fLVHuOQDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.151.88.27
country_id: 6251999
description:
2026-01-06 15:48:06 dovecot_login authenticator failed for H=([184.151.88.27]) [184.151.88.27]:60150: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 15:47:17 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<EZnUerVHQNBA46ZK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.211.130.180
country_id: 6252001
description:
2026-01-06 15:47:42 dovecot_login authenticator failed for H=([162.211.130.180]) [162.211.130.180]:42715: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan  6 15:49:02 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<g4gvgbVHpOwDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan  6 15:49:35 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<D/8mg7VH0IMDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.185.119.170
country_id: 3175395
description:
2026-01-06 15:50:56 dovecot_login authenticator failed for H=([94.185.119.170]) [94.185.119.170]:36561: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.51
country_id: 3144096
description:
2026-01-06 15:50:18 dovecot_login authenticator failed for H=([62.97.170.51]) [62.97.170.51]:57947: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan  6 15:50:48 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<gIeLh7VHQocDiUnd>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.137.73.221
country_id: 6252001
description:
Jan  6 15:51:32 host2 dovecot[1170291]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<yYQgirVHlrADiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan  6 15:51:30 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<7Pj9ibVHkLADiUnd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 15:52:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<3GBzjrVHsMMyBsPO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan  6 15:52:22 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<NcQjjbVHaJ8DiUnd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 15:52:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<kxkDjbVHVshCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 15:54:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<BD6flLVHUUt100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.241.125.165
country_id: 6252001
description:
2026-01-06 15:55:36 dovecot_login authenticator failed for H=(ADMIN) [151.241.125.165]:53596: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.164.107.6
country_id: 6252001
description:
Jan  6 15:55:59 host2 pure-ftpd[2068464]: (?@194.164.107.6) [INFO] New connection from 194.164.107.6


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 15:57:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<D1u1nbVHAJQIhpC/>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 15:59:39 host2 sshd[2072579]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 16:01:47 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<dgmirrVHeslA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 16:02:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<N+sOsbVHJM4z0msW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.104
country_id: 1880251
description:
Jan  6 16:03:22 host2 sshd[2077361]: Disconnected from invalid user test1 45.78.230.104 port 52324 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 16:05:02 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<1yVNurVHVo8ifrCV>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 16:05:37 host2 sshd[2080143]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 16:07:05 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<PleawbVHqMdm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.36.101
country_id: 3469034
description:
Jan  6 16:07:31 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=191.240.36.101, lip=66.85.158.91, TLS, session=<VLAfwrVH+r+/8CRl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 16:07:34 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<fyRbw7VHNrGi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.37.218
country_id: 2300660
description:
Jan  6 16:07:54 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<charanaw>, method=PLAIN, rip=41.139.37.218, lip=66.85.158.91, TLS, session=<67Zyw7VHUY4piyXa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.20.58.146
country_id: 798544
description:
Jan  6 16:07:57 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=46.20.58.146, lip=66.85.158.91, TLS, session=<ojrkw7VHB+kuFDqS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.104.224
country_id: 3469034
description:
Jan  6 16:08:20 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=187.120.104.224, lip=66.85.158.91, TLS, session=<Re4GxbVHdI67eGjg>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.230.104
country_id: 1880251
description:
Jan  6 16:09:58 host2 sshd[2085019]: Disconnected from invalid user teste 45.78.230.104 port 51198 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.104
country_id: 1880251
description:
Jan  6 16:11:12 host2 sshd[2086713]: Disconnected from invalid user claude 45.78.230.104 port 58570 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 16:11:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<tDAT0bVHwpqi8KbF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 16:14:34 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<VsBg3LVHAK8IijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 16:14:56 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<Kfew3bVHhpVm2gqW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.155
country_id: 3703430
description:
Jan  6 16:16:29 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=45.227.254.155, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<ZhFj47VHR/4t4/6b>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.104
country_id: 1880251
description:
Jan  6 16:17:24 host2 sshd[2093576]: Disconnected from invalid user sysadmin 45.78.230.104 port 50044 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 16:18:44 host2 sshd[2095205]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Jan  6 16:20:27 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<Blpm8bVHrMYvT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 16:20:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<q+zH8rVH7pxA46ZK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  6 16:21:26 host2 sshd[2098247]: Disconnected from invalid user admin 2.57.121.112 port 43453 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 16:24:16 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<5N8U/7VHZscyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 16:24:51 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<0f0sAbZHso9CdMzo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.32.122.59
country_id: 597427
description:
2026-01-06 16:26:01 dovecot_login authenticator failed for H=(ADMIN) [194.32.122.59]:1126: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 16:28:58 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<ewTqD7ZHxqR100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.182.118
country_id: 1269750
description:
2026-01-06 16:30:00 dovecot_login authenticator failed for H=([59.145.86.177]) [125.19.182.118]:33094: 535 Incorrect authentication data (set_id=marketing)


