# incident

plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 29 22:07:52 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<pt8p3RlHKJIuZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 29 22:07:54 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<59RH3RlH+suElEgp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 29 22:09:07 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<Lnmc4RlH6ImnrEV8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 29 22:09:19 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<kEpV4hlH/pgv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 29 22:10:36 host2 sshd[876646]: Disconnected from invalid user  62.60.131.157 port 47807 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 29 22:10:22 host2 pure-ftpd[876509]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.150.36
country_id: 99237
description:
2025-12-29 22:11:32 dovecot_login authenticator failed for H=([65.20.150.36]) [65.20.150.36]:57928: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.224
country_id: 6252001
description:
Dec 29 22:14:08 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.224, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Jle38xlHl8BBMQHg>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 29 22:14:57 host2 sshd[880683]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.222
country_id: 6252001
description:
Dec 29 22:14:26 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.222, lip=66.85.158.91, TLS handshaking: Connection closed, session=<5k/F9BlHYhlBMQHe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.181.129.131
country_id: 798549
description:
2025-12-29 22:14:52 dovecot_plain authenticator failed for H=(preoccusly) [81.181.129.131]:18517: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 29 22:18:08 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<P9LjARpHwoFo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.44.54
country_id: 1269750
description:
2025-12-29 22:22:25 dovecot_login authenticator failed for H=(static.bb.alp.61.2.44.54.bsnl.in) [61.2.44.54]:57732: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.239.5
country_id: 3144096
description:
2025-12-29 22:22:36 dovecot_login authenticator failed for H=(cm-178.232.239.5.get.no) [178.232.239.5]:42577: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.28.142
country_id: 798544
description:
Dec 29 22:22:53 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=178.216.28.142, lip=66.85.158.91, TLS, session=<Fe3OERpH/+ay2ByO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 29 22:23:00 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<L11HExpHELOeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 29 22:23:04 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<KteIExpHQtinrKy4>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 167.172.172.184
country_id: 2921044
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[167.172.172.184] [Remote Port]=[55362] [Authentication Database]=[mail] [Username]=[postfix@venee.lk] (10/10 failures) (blocked until [Tue Dec 30 16:53:02 2025 UTC/Tue Dec 30 22:23:02 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 29 22:23:15 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<WkUqFBpHCKui8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.73
country_id: 3469034
description:
Dec 29 22:23:32 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<env_eng>, method=PLAIN, rip=177.44.71.73, lip=66.85.158.91, TLS, session=<KM7nExpHAMixLEdJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-12-29 22:24:16 dovecot_plain authenticator failed for H=(stwines) [102.53.15.18]:57849: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 29 22:24:31 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<NvOuGBpHON6l6LP6>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 54.174.168.242
country_id: 6252001
description:
Dec 29 22:25:47 host2 pure-ftpd[893427]: (?@54.174.168.242) [INFO] New connection from 54.174.168.242


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.220.185.106
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.220.185.106: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 29 22:28:15 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<w58OJhpHzIIvWBNS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.238.127.92
country_id: 3573591
description:
2025-12-29 22:28:48 dovecot_plain authenticator failed for H=(L7V1JJ7) [201.238.127.92]:65215: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.214.36.178
country_id: 3351879
description:
2025-12-29 22:29:27 dovecot_plain authenticator failed for H=(10I184C09IJ1) [102.214.36.178]:54648: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 29 22:30:47 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<nQkeLxpHHTJniu0S>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.133.238
country_id: 3469034
description:
2025-12-29 22:32:03 dovecot_login authenticator failed for H=([187.51.128.233]) [189.44.133.238]:56926: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.175.61.93
country_id: 3469034
description:
2025-12-29 22:31:40 dovecot_login authenticator failed for H=(189-44-229-57.customer.tdatabrasil.net.br) [179.175.61.93]:42128: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2025-12-29 22:31:58 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:53860: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 29 22:34:18 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<ELSNOxpH8vZ100Db>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.60.131.157
country_id: 130758
description:
Dec 29 22:34:50 host2 sshd[900894]: Disconnected from invalid user  62.60.131.157 port 61116 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 29 22:37:04 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<TySTRRpHvOYFhXlo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.4
country_id: 6252001
description:
Dec 29 22:37:29 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=74.82.47.4, lip=66.85.158.91, TLS handshaking: Connection closed, session=<GKI0RxpHuMlKUi8E>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.111
country_id: 2186224
description:
2025-12-29 22:38:56 dovecot_login authenticator failed for H=([121.73.169.111]) [121.73.169.111]:49080: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.61.176.110
country_id: 3469034
description:
2025-12-29 22:39:22 dovecot_login authenticator failed for H=([187.50.122.20]) [177.61.176.110]:45032: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.99.252.8
country_id: 6251999
description:
Dec 29 22:40:16 host2 sshd[905806]: Disconnected from invalid user postgres 192.99.252.8 port 59784 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 29 22:41:10 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=</tFBVBpHVthV6odu>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.61.187.220
country_id: 6252001
description:
Dec 29 22:41:15 host2 sshd[906649]: Disconnected from invalid user testuser 45.61.187.220 port 50732 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.174.129.232
country_id: 2542007
description:
Dec 29 22:41:38 host2 sshd[906940]: Disconnected from invalid user admin 160.174.129.232 port 40400 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.189.36.162
country_id: 1880251
description:
Dec 29 22:42:11 host2 sshd[907473]: Disconnected from invalid user k8s 206.189.36.162 port 45246 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.94.69.183
country_id: 2661886
description:
2025-12-29 22:42:25 dovecot_plain authenticator failed for H=183-69.soderhamn.com (bonfaces) [81.94.69.183]:50672: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 206.189.36.162
country_id: 1880251
description:
Dec 29 22:42:52 host2 sshd[908189]: Disconnected from invalid user administrador 206.189.36.162 port 57208 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.168.78.105
country_id: 798544
description:
Dec 29 22:43:40 host2 sshd[908841]: Disconnected from invalid user ionadmin 83.168.78.105 port 54884 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.174.114.50
country_id: 1643084
description:
Dec 29 22:44:08 host2 sshd[909245]: Disconnected from invalid user user 103.174.114.50 port 36212 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.61.187.220
country_id: 6252001
description:
Dec 29 22:43:09 host2 sshd[908466]: Disconnected from invalid user test 45.61.187.220 port 55954 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 83.168.78.105
country_id: 798544
description:
Dec 29 22:44:53 host2 sshd[909924]: Disconnected from invalid user test 83.168.78.105 port 41260 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.206.171.113
country_id: 597427
description:
Dec 29 22:44:27 host2 sshd[909479]: Disconnected from invalid user bitrix 85.206.171.113 port 32976 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.61.187.220
country_id: 6252001
description:
Dec 29 22:45:32 host2 sshd[910764]: Disconnected from invalid user bitrix 45.61.187.220 port 44086 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 29 22:46:09 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<DfsUZhpH4IAzTcpt>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.141.33.240
country_id: 6252001
description:
Dec 29 22:46:16 host2 sshd[912138]: Disconnected from invalid user webserver 209.141.33.240 port 47512 [preauth]


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 51.77.202.109
country_id: 3017382
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[51.77.202.109] [Remote Port]=[32992] [Authentication Database]=[mail] [Username]=[no-reply@lankaherbalsolutions.com] (10/10 failures) (blocked until [Tue Dec 30 17:16:07 2025 UTC/Tue Dec 30 22:46:07 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 29 22:46:48 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<0h5oaBpHVKgjupN+>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 35.186.147.126
country_id: 1880251
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[35.186.147.126] [Remote Port]=[43092] [Authentication Database]=[mail] [Username]=[test@anandaobauae.org] (12/10 failures) (blocked until [Tue Dec 30 17:16:46 2025 UTC/Tue Dec 30 22:46:46 2025 LOCAL])


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.248.164.42
country_id: 1861060
description:
Dec 29 22:46:57 host2 sshd[912797]: Disconnected from invalid user test 155.248.164.42 port 50070 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.174.129.232
country_id: 2542007
description:
Dec 29 22:47:15 host2 sshd[913124]: Disconnected from invalid user socksuser 160.174.129.232 port 42871 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.174.114.50
country_id: 1643084
description:
Dec 29 22:47:41 host2 sshd[913529]: Disconnected from invalid user rd 103.174.114.50 port 58140 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 112.120.170.82
country_id: 1819730
description:
Dec 29 22:47:28 host2 sshd[913366]: Disconnected from invalid user user 112.120.170.82 port 43468 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 155.248.164.42
country_id: 1861060
description:
Dec 29 22:48:09 host2 sshd[914167]: Disconnected from invalid user testuser 155.248.164.42 port 47858 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 160.174.129.232
country_id: 2542007
description:
Dec 29 22:48:18 host2 sshd[914303]: Received disconnect from 160.174.129.232 port 54652:11: Bye Bye [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 29 22:48:54 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<iAbibxpHDoWnrKy4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.207.88
country_id: 1880251
description:
Dec 29 22:49:56 host2 sshd[915957]: Disconnected from invalid user test 152.42.207.88 port 41236 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 29 22:50:00 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<q9DVcxpHFMkv/AU1>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 47.252.5.53
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[47.252.5.53] [Remote Port]=[51476] [Authentication Database]=[mail] [Username]=[webmaster@lankaherbalsolutions.com] (11/10 failures) (blocked until [Tue Dec 30 17:19:58 2025 UTC/Tue Dec 30 22:49:58 2025 LOCAL])


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.42.207.88
country_id: 1880251
description:
Dec 29 22:50:40 host2 sshd[916812]: Disconnected from invalid user alex 152.42.207.88 port 43238 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.174.114.50
country_id: 1643084
description:
Dec 29 22:50:55 host2 sshd[916964]: Disconnected from invalid user jerry 103.174.114.50 port 57398 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 29 22:50:26 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<Sc5ldRpHpoUzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 29 22:50:39 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<KYsqdhpHeptA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 29 22:54:26 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<IzizgxpH7FKi8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.56.7.13
country_id: 1269750
description:
2025-12-29 22:55:42 dovecot_plain authenticator failed for H=(L7V1JJ7) [152.56.7.13]:59831: 535 Incorrect authentication data (set_id=sanjanap@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.60.126
country_id: 1269750
description:
2025-12-29 22:56:42 dovecot_login authenticator failed for H=([182.79.136.105]) [122.187.60.126]:51626: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.196.202.17
country_id: 3175395
description:
2025-12-29 22:56:54 dovecot_login authenticator failed for H=([2.196.202.17]) [2.196.202.17]:36212: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 29 22:57:57 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<VH9BkBpHuJwv+wDY>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 64.227.136.122
country_id: 1269750
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[64.227.136.122] [Remote Port]=[52484] [Authentication Database]=[mail] [Username]=[no-reply@dataesite.lk] (11/10 failures) (blocked until [Tue Dec 30 17:29:36 2025 UTC/Tue Dec 30 22:59:36 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 29 22:59:38 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<YRRElhpHBM1A44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.211.130.180
country_id: 6252001
description:
2025-12-29 22:59:42 dovecot_login authenticator failed for H=([162.211.130.180]) [162.211.130.180]:45808: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 29 23:00:57 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<q4TymhpHvOaeRdY+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.105.128.11
country_id: 6252001
description:
Dec 29 23:01:59 host2 pure-ftpd[927371]: (?@172.105.128.11) [INFO] New connection from 172.105.128.11


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 29 23:01:17 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<KocrnBpHXmYjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.83.87.46
country_id: 298795
description:
Dec 29 23:04:37 host2 sshd[930240]: Disconnected from invalid user user 103.83.87.46 port 46744 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 29 23:05:43 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<DBMGrBpHAMQuZXpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.162.141
country_id: 3144096
description:
2025-12-29 23:05:52 dovecot_login authenticator failed for H=(cm-178.232.162.141.get.no) [178.232.162.141]:37216: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.80.65.214
country_id: 6252001
description:
2025-12-29 23:05:30 dovecot_login authenticator failed for H=syn-075-080-065-214.biz.spectrum.com [75.80.65.214]:43857: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.83.87.46
country_id: 298795
description:
Dec 29 23:07:30 host2 sshd[933076]: Disconnected from invalid user postgresql 103.83.87.46 port 44348 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 29 23:09:14 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<rxKcuBpHFsoyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.69.124
country_id: 1880251
description:
Dec 29 23:09:50 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sobaherbal.com>, method=PLAIN, rip=167.172.69.124, lip=66.85.158.91, session=<A2/LuhpHuJGnrEV8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 29 23:10:21 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<ZRmivBpHSokv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 29 23:10:48 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<ux86vhpH4t9nmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.83.87.46
country_id: 298795
description:
Dec 29 23:11:54 host2 sshd[936872]: Disconnected from invalid user user 103.83.87.46 port 44400 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.58
country_id: 6252001
description:
Dec 29 23:12:56 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 12 secs): user=<>, rip=162.216.150.58, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<Ryr4xRpHP8Ki2JY6>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 29 23:13:32 host2 pure-ftpd[938137]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.58
country_id: 6252001
description:
Dec 29 23:13:50 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=162.216.150.58, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<zR41yRpHcO6i2JY6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 29 23:15:49 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<s24r0BpHEKWi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 29 23:16:14 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<+sGj0RpHgK2ElEgp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.250.201.1
country_id: 2245662
description:
2025-12-29 23:18:56 dovecot_login authenticator failed for H=([196.250.201.125]) [196.250.201.1]:3259: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 29 23:18:20 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<pPgu2RpHqMGeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 29 23:18:31 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<e8rV2RpHZqpo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.14
country_id: 241170
description:
Dec 29 23:19:15 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.14, lip=66.85.158.91, session=<e7ty3BpHOLvE+2YO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.221.224.110
country_id: 2077456
description:
2025-12-29 23:19:15 dovecot_login authenticator failed for H=(203-221-224-110.tpgi.com.au) [203.221.224.110]:38886: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 29 23:20:50 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<mQEh4hpHzsGYNcU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.58
country_id: 6252001
description:
Dec 29 23:21:38 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.58, lip=66.85.158.92, TLS, session=<U4IU5RpHEuWi2JY6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 29 23:22:52 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<d/dk6RpHxOel6LP6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 29 23:23:11 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<4Kp/6hpHnxFniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 148.216.49.99
country_id: 3996063
description:
Dec 29 23:24:30 host2 sshd[946847]: Disconnected from invalid user contador 148.216.49.99 port 45858 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 148.216.49.99
country_id: 3996063
description:
Dec 29 23:28:07 host2 sshd[949667]: Disconnected from invalid user db2admin 148.216.49.99 port 54416 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 148.216.49.99
country_id: 3996063
description:
Dec 29 23:28:47 host2 sshd[950033]: Disconnected from invalid user willie 148.216.49.99 port 42084 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 29 23:29:34 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<mExYARtHRJp100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.5.113.133
country_id: 3865483
description:
2025-12-29 23:29:42 dovecot_login authenticator failed for H=(host133.advance.com.ar) [200.5.113.133]:10329: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.51.135
country_id: 3144096
description:
2025-12-29 23:29:42 dovecot_login authenticator failed for H=(cm-178.232.51.135.get.no) [178.232.51.135]:36570: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 29 23:29:44 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<tgvtARtHltUvWBNS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.218.50
country_id: 1269750
description:
2025-12-29 23:29:56 dovecot_login authenticator failed for H=([125.19.218.50]) [125.19.218.50]:51354: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 148.216.49.99
country_id: 3996063
description:
Dec 29 23:29:26 host2 sshd[950436]: Disconnected from invalid user pieter 148.216.49.99 port 46650 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.51.185
country_id: 3144096
description:
2025-12-29 23:29:41 dovecot_login authenticator failed for H=(cm-84.215.51.185.get.no) [84.215.51.185]:48046: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.209
country_id: 3996063
description:
2025-12-29 23:29:41 dovecot_login authenticator failed for H=([177.236.146.209]) [177.236.146.209]:52695: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.109.56.74
country_id: 6252001
description:
2025-12-29 23:30:11 dovecot_login authenticator failed for H=(dfw-206-109-56-74.ip4.99.network) [206.109.56.74]:50294: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.10
country_id: 1269750
description:
2025-12-29 23:30:28 dovecot_login authenticator failed for H=([125.20.249.192]) [27.123.113.10]:34572: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 29 23:36:35 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<ZURtGhtHKrJV6odu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 29 23:39:33 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<RUEHJRtHLuEFhXlo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.220
country_id: 6252001
description:
Dec 29 23:40:38 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.220, lip=66.85.158.92, TLS handshaking: Connection closed, session=<nEcMKRtHnXlAPpzc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.212
country_id: 6252001
description:
Dec 29 23:40:56 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.212, lip=66.85.158.92, TLS handshaking: Connection closed, session=<3bsXKhtHXghAPpzU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.212
country_id: 6252001
description:
Dec 29 23:41:09 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.212, lip=66.85.158.92, TLS: Connection closed, session=<S97oKhtHeFZAPpzU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 29 23:42:08 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<T+tGLhtHQMSnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 29 23:42:27 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<OJFjLxtHnMMjupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.221.180.165
country_id: 6252001
description:
Dec 29 23:44:58 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=18.221.180.165, lip=66.85.158.91, session=<9RGEOBtHIsUS3bSl>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 18.221.180.165
country_id: 6252001
description:
Dec 29 23:44:57 host2 pure-ftpd[963341]: (?@18.221.180.165) [INFO] New connection from 18.221.180.165


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 29 23:47:46 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<gClnQhtHspAzTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.124
country_id: 1036973
description:
2025-12-29 23:48:43 dovecot_login authenticator failed for H=([196.28.226.124]) [196.28.226.124]:56229: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 29 23:50:47 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<DR0/TRtHhpcv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 29 23:52:01 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<gIOlURtHbKozTcpt>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 29 23:52:11 host2 sshd[969734]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 29 23:53:21 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<5JZoVhtHwLGi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 29 23:56:17 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<V8boYBtHJKyeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 29 23:56:55 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<rBQgYxtHQF8jupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 29 23:57:07 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=</WnYYxtHbrNA44h6>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.215.116.20
country_id: 2921044
description:
[2025-12-29 23:59:13 +0530] info [cpaneld] 85.215.116.20 - kamechot "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.42
country_id: 6252001
description:
Dec 29 23:59:40 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.132.42, lip=66.85.158.91, TLS, session=<vikZbRtHUvyTuYQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.53.254.168
country_id: 6252001
description:
2025-12-29 23:59:53 dovecot_plain authenticator failed for H=c-73-53-254-168.hsd1.fl.comcast.net (codip) [73.53.254.168]:53130: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-30 00:00:13 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:63968: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 30 00:02:31 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<EQcqdxtHoOwv+wDY>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 30 00:03:57 host2 sshd[980868]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 30 00:03:35 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<1uP3ehtHeqMuZXpm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 30 00:05:05 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<OuphgBtHhrFnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 30 00:06:10 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@dataesite.lk>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<BHs2hBtH2oRA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 00:07:57 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<jbejihtHtKGnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 30 00:08:21 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<s08PjBtHpJ2i8GQy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 72.14.178.148
country_id: 6252001
description:
Dec 30 00:10:00 host2 dovecot[512723]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=72.14.178.148, lip=66.85.158.92, session=<1gwKkhtHXMFIDrKU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 00:11:08 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<QFIBlhtHBrIv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 30 00:11:51 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<AyuJmBtHzLEyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 00:13:32 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<J8qGnhtHgOCeRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.128.150.67
country_id: 6252001
description:
2025-12-30 00:15:12 dovecot_login authenticator failed for H=c-73-128-150-67.hsd1.de.comcast.net [73.128.150.67]:60236: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.12.241.225
country_id: 6252001
description:
2025-12-30 00:15:47 dovecot_login authenticator failed for H=(syn-071-012-241-225.res.spectrum.com) [71.12.241.225]:35128: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 30 00:15:49 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<81y4phtHOxtniu0S>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 30 00:15:59 host2 pure-ftpd[992214]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 30 00:18:05 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<GPzcrhtHovBo7MS0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.187.45.27
country_id: 1269750
description:
Dec 30 00:18:37 host2 sshd[994440]: Disconnected from invalid user nicolas 115.187.45.27 port 42170 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.187.45.27
country_id: 1269750
description:
Dec 30 00:19:29 host2 sshd[995107]: Disconnected from invalid user auditor 115.187.45.27 port 49465 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 115.187.45.27
country_id: 1269750
description:
Dec 30 00:20:15 host2 sshd[995910]: Disconnected from invalid user law 115.187.45.27 port 56466 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.232.179.250
country_id: 1269750
description:
Dec 30 00:20:47 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@rehanseo.online>, method=PLAIN, rip=165.232.179.250, lip=66.85.158.91, session=<fSN9uBtHFLWl6LP6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.187.45.27
country_id: 1269750
description:
Dec 30 00:21:38 host2 sshd[997141]: Disconnected from invalid user ftpadmin 115.187.45.27 port 42233 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.95.24.117
country_id: 2464461
description:
2025-12-30 00:22:10 dovecot_login authenticator failed for H=([193.95.21.147]) [193.95.24.117]:44254: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.40.215.162
country_id: 3469034
description:
2025-12-30 00:22:23 dovecot_login authenticator failed for H=187-40-215-162.user.veloxzone.com.br [187.40.215.162]:40565: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 30 00:24:22 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<fThSxRtH4ZN100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 30 00:24:31 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<wBDbxRtH+I6ElEgp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 30 00:24:58 host2 sshd[1000038]: Disconnected from invalid user  62.60.131.157 port 45075 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.62
country_id: 1149361
description:
2025-12-30 00:28:53 dovecot_login authenticator failed for H=([149.54.62.62]) [149.54.62.62]:52379: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 203.55.131.3
country_id: 6252001
description:
Dec 30 00:29:02 host2 dovecot[512723]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=203.55.131.3, lip=66.85.158.91, TLS, session=<Svge1htHItnLN4MD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.67.45.29
country_id: 2661886
description:
2025-12-30 00:29:41 dovecot_login authenticator failed for H=213-67-45-29-no600.tbcn.telia.com [213.67.45.29]:43742: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.64.206
country_id: 1269750
description:
2025-12-30 00:29:16 dovecot_login authenticator failed for H=(nsg-corporate-206.64.186.122.airtel.in) [122.186.64.206]:46246: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.168.113.8
country_id: 3469034
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 45.168.113.8 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 30 00:31:13 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<2M/Y3RtHIrovWBNS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.6.147
country_id: 3144096
description:
2025-12-30 00:31:21 dovecot_login authenticator failed for H=([78.156.6.147]) [78.156.6.147]:51082: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 30 00:31:34 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<gNcQ3xtHmOaYNcU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2025-12-30 00:31:34 dovecot_login authenticator failed for H=([182.95.176.194]) [182.95.176.194]:50382: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 30 00:31:47 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<YrvW3xtHFotV6odu>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.220.185.223
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.220.185.223: 250 connections per 30 seconds to 2080 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.220.185.223
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.220.185.223: 408 connections per 30 seconds to 2080 port.


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 00:37:57 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<qznj9RtH+kMjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2025-12-30 00:39:45 dovecot_plain authenticator failed for H=(hiridan) [91.73.188.251]:43686: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.252
country_id: 6252001
description:
Dec 30 00:42:05 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.252, lip=66.85.158.91, TLS, session=<C5TOBBxHLPKTuYT8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 30 00:41:47 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<tF2gAxxHtJEFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 30 00:44:44 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<1QshDhxHtKBCdMzo>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 30 00:47:52 host2 sshd[1023484]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 00:49:51 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<gYRsIBxHtrEzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 00:51:30 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<Ik5UJhxHGoSeRdY+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.81
country_id: 6252001
description:
Dec 30 00:51:52 host2 dovecot[512723]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.81, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<rXPGJxxH9d3N0h9R>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 30 00:52:00 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<vCkeKBxHcu6i8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 00:52:04 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<GMVpKBxHtLEv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 00:52:27 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<S6a9KRxHMMcjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 30 00:52:41 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<wlSWKhxHPM4v+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 00:54:09 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<yt7OLxxHduszTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 30 00:59:02 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<f6dIQRxH/tZnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 30 01:00:36 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<z3zmRhxH6tGi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.101.122.102
country_id: 2921044
description:
Dec 30 01:01:08 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=46.101.122.102, lip=66.85.158.91, session=<63vJSBxH9OUuZXpm>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.60.131.157
country_id: 130758
description:
Dec 30 01:01:18 host2 sshd[1036850]: Disconnected from invalid user admin 62.60.131.157 port 64285 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 01:02:20 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<eh8gTRxH3IunrKy4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.237.125.155
country_id: 6252001
description:
Dec 30 01:02:52 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=135.237.125.155, lip=66.85.158.92, session=<KuccTxxHvIaH7X2b>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 30 01:04:20 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<9PM5VBxHduRA44h6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.192.33
country_id: 6252001
description:
Dec 30 01:07:52 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.65.192.33, lip=66.85.158.91, session=<wpsEYRxHsJIUQcAh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 30 01:08:22 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<tfmnYhxHyUVniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 01:08:45 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<AKEGZBxHLN+eRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 01:12:48 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<EJeIchxHupcv/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.183.106.192
country_id: 6252001
description:
2025-12-30 01:13:07 dovecot_login authenticator failed for H=([75.183.106.192]) [75.183.106.192]:45876: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Dec 30 01:13:30 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@dataesite.lk>, method=PLAIN, rip=64.227.136.122, lip=66.85.158.91, session=<VfgIdRxHqpZA44h6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 30 01:14:10 host2 sshd[1048862]: Disconnected from invalid user admin 62.60.131.157 port 12859 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 30 01:14:59 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<8d5VehxHzKoyBsPO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.56.69.194
country_id: 6252001
description:
Dec 30 01:18:08 host2 dovecot[512723]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=45.56.69.194, lip=66.85.158.92, session=<dUi6hRxH0LYtOEXC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 30 01:17:55 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<XkHUhBxHVt9o7MS0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.255.229.239
country_id: 6252001
description:
Dec 30 01:18:08 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=173.255.229.239, lip=66.85.158.92, session=<6zi+hRxHgs+t/+Xv>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 30 01:18:28 host2 pure-ftpd[1053023]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 30 01:18:36 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<0rNIhxxHpIp100Db>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.223.28.152
country_id: 2510769
description:
[2025-12-30 01:20:43 +0530] info [webmaild] 82.223.28.152 - env_eng@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.66
country_id: 6252001
description:
Dec 30 01:21:46 host2 pure-ftpd[1056555]: (?@205.210.31.66) [INFO] New connection from 205.210.31.66


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.232.74.217
country_id: 2921044
description:
Dec 30 01:22:55 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=165.232.74.217, lip=66.85.158.92, TLS, session=<U+zPlhxHHDKl6ErZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 30 01:27:42 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<RlHNpxxHZJZV6odu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 01:29:01 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<j6+CrBxH4omnrKy4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 69.164.205.225
country_id: 6252001
description:
Dec 30 01:29:54 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=69.164.205.225, lip=66.85.158.92, session=<J0HJrxxH+sRFpM3h>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Dec 30 01:31:24 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<P98TtRxHRqcFhH+s>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 30 01:33:04 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<iyAAuxxHlp8vWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 01:33:46 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<pxCFvRxHQlgjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 30 01:34:23 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<dru2vxxHbt6ElEgp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 30 01:37:27 host2 sshd[1072331]: Disconnected from invalid user  62.60.131.157 port 61915 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.80.53.81
country_id: 1168579
description:
2025-12-30 01:38:24 dovecot_plain authenticator failed for H=([192.168.56.1]) [154.80.53.81]:54826: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 30 01:39:46 host2 sshd[1074699]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 30 01:43:23 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<1MLc3xxH6K8v+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 30 01:43:48 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<dS5n4RxH/s2YNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 30 01:44:18 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<kQg24xxHjtVCdMzo>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.230.168.169
country_id: 6252001
description:
Dec 30 01:44:26 host2 pure-ftpd[1079018]: (?@91.230.168.169) [INFO] New connection from 91.230.168.169


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.230.168.173
country_id: 6252001
description:
Dec 30 01:44:25 host2 pure-ftpd[1079016]: (?@91.230.168.173) [INFO] New connection from 91.230.168.173


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 30 01:45:08 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<1HEo5hxH4NUFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 01:46:45 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<jK7x6xxHMNGeRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.173.58.47
country_id: 6252001
description:
2025-12-30 01:47:27 dovecot_plain authenticator failed for H=c-67-173-58-47.hsd1.il.comcast.net (ferestr) [67.173.58.47]:52334: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 01:48:20 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<jG6X8RxHPs4jupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 30 01:48:36 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<8CmP8hxHTLSi8Jp9>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.60.131.157
country_id: 130758
description:
Dec 30 01:50:20 host2 sshd[1084247]: Disconnected from invalid user  62.60.131.157 port 61619 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 30 01:51:27 host2 sshd[1085177]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 01:52:00 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=</t29/hxHyL0zTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 30 01:52:16 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<cI2n/xxHnK1nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 30 01:53:33 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<i9c8BB1HfpOi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 01:53:54 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<To6FBR1HzMov/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 01:56:17 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<1vIPDh1HgLUzTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-30 02:00:01 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (hytin) [87.103.126.54]:47404: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 30 02:00:37 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<A0uHHR1Hsh9niu0S>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 158.69.214.62
country_id: 6251999
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[158.69.214.62] [Remote Port]=[45756] [Authentication Database]=[mail] [Username]=[info@anandaobauae.org] (10/10 failures) (blocked until [Tue Dec 30 20:33:57 2025 UTC/Wed Dec 31 02:03:57 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 02:03:59 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<mDuJKR1HvLKeRdY+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Dec 30 02:04:35 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.113.212, lip=66.85.158.92, TLS: Connection closed, session=<ap/WKx1H4JqLonHU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.105.158.232
country_id: 6252001
description:
Dec 30 02:05:41 host2 dovecot[512723]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.105.158.232, lip=66.85.158.91, session=<vwbGLx1HgMKsaZ7o>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 206.189.167.88
country_id: 6252001
description:
Dec 30 02:05:41 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=206.189.167.88, lip=66.85.158.91, session=<IHvLLx1HpOfOvadY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.69
country_id: 3144096
description:
2025-12-30 02:07:49 dovecot_login authenticator failed for H=(cm-84.211.13.69.get.no) [84.211.13.69]:43943: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.161.93.53
country_id: 1269750
description:
2025-12-30 02:08:01 dovecot_login authenticator failed for H=([103.161.93.53]) [103.161.93.53]:14818: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.187.147.165
country_id: 1643084
description:
Dec 30 02:07:39 host2 sshd[1100928]: Disconnected from invalid user test 103.187.147.165 port 48978 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.45
country_id: 6252001
description:
Dec 30 02:08:51 host2 dovecot[512723]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.45, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<6D8VOx1HdNXG6xgt>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.223.46.235
country_id: 1880251
description:
[2025-12-30 02:12:40 +0530] info [whostmgrd] 159.223.46.235 - 2096cpsess01302957403rdpartyroundcube "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: invalid user name specified


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.56.69.49
country_id: 6252001
description:
Dec 30 02:13:00 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=45.56.69.49, lip=66.85.158.91, session=<1xzsSR1H1pItOEUx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 30 02:13:16 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<6cjFSh1Hgqd100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 02:14:30 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<utA1Tx1HtJUv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 30 02:17:55 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<kDNlWx1H/vpo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 30 02:18:30 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<LK18XR1HaKsyBsPO>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.248.9.129
country_id: 3469034
description:
[2025-12-30 02:19:40 +0530] info [cpaneld] 207.248.9.129 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 30 02:20:53 host2 pure-ftpd[1113519]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-30 02:21:14 dovecot_plain authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net (colable) [71.62.34.216]:51206: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.179.128
country_id: 3996063
description:
2025-12-30 02:23:12 dovecot_login authenticator failed for H=([140.84.179.128]) [140.84.179.128]:58558: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 02:23:10 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<Rz4tbh1HVqKnrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.65.99
country_id: 3144096
description:
2025-12-30 02:23:40 dovecot_login authenticator failed for H=(cm-178.232.65.99.get.no) [178.232.65.99]:33056: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.49
country_id: 6252001
description:
Dec 30 02:23:54 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.49, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<oSbmcB1H4sqTuYQx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 30 02:24:24 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<tImach1HKNRV6odu>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.33.186.151
country_id: 3686110
description:
Dec 30 02:27:41 host2 sshd[1118842]: Disconnected from invalid user customer 179.33.186.151 port 55136 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.80.18.158
country_id: 3686110
description:
Dec 30 02:28:03 host2 sshd[1119295]: Disconnected from invalid user portal 186.80.18.158 port 42644 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.33.186.151
country_id: 3686110
description:
Dec 30 02:28:20 host2 sshd[1119529]: Disconnected from invalid user bryan 179.33.186.151 port 34363 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.80.18.158
country_id: 3686110
description:
Dec 30 02:28:39 host2 sshd[1119780]: Disconnected from invalid user sftptest 186.80.18.158 port 41318 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.80.18.158
country_id: 3686110
description:
Dec 30 02:29:15 host2 sshd[1120251]: Disconnected from invalid user production 186.80.18.158 port 37112 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 02:29:44 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<W92phR1HKCsjupN+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 206.217.136.36
country_id: 6252001
description:
Dec 30 02:32:16 host2 sshd[1122641]: Disconnected from invalid user backupuser 206.217.136.36 port 34538 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.182.132.154
country_id: 1269750
description:
Dec 30 02:32:33 host2 sshd[1122842]: Disconnected from invalid user panel 103.182.132.154 port 46474 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.236.103
country_id: 2921044
description:
Dec 30 02:32:39 host2 sshd[1122924]: Disconnected from invalid user sdtdserver 164.92.236.103 port 33642 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.191.75
country_id: 1819730
description:
Dec 30 02:33:52 host2 sshd[1124279]: Disconnected from invalid user deploy 152.32.191.75 port 50788 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.105.235.55
country_id: 3017382
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 46.105.235.55 - vdeployc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vdeployc (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.217.136.36
country_id: 6252001
description:
Dec 30 02:33:21 host2 sshd[1123718]: Disconnected from invalid user ares 206.217.136.36 port 40260 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 150.5.157.20
country_id: 1819730
description:
Dec 30 02:33:46 host2 sshd[1124155]: Disconnected from invalid user client 150.5.157.20 port 36378 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.172.89.95
country_id: 6252001
description:
Dec 30 02:34:38 host2 sshd[1124983]: Disconnected from invalid user simone 144.172.89.95 port 51388 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 30 02:34:44 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<cF+Klx1HpJAv+wDY>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 144.172.89.95
country_id: 6252001
description:
Dec 30 02:35:41 host2 sshd[1126235]: Disconnected from invalid user mongouser 144.172.89.95 port 35210 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 30 02:35:50 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<wct9mx1HfIYvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Dec 30 02:37:32 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<b4qWoR1HVo4FhH+s>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 02:42:08 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<X2QLsh1HBJOeRdY+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.245.186.9
country_id: 6252001
description:
Dec 30 02:42:19 host2 sshd[1132106]: Disconnected from invalid user max 157.245.186.9 port 33122 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.137.144
country_id: 1605651
description:
Dec 30 02:42:34 host2 sshd[1132288]: Disconnected from invalid user ec2-user 27.254.137.144 port 42388 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.254.137.144
country_id: 1605651
description:
Dec 30 02:43:44 host2 sshd[1133123]: Disconnected from invalid user bk 27.254.137.144 port 53522 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 02:44:25 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<oxMpuh1HCpMjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 30 02:44:33 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<GJ2guh1H4oRCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.77.179.3
country_id: 3469034
description:
Dec 30 02:44:33 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=200.77.179.3, lip=66.85.158.91, TLS, session=<R6y3uR1Ht8LITbMD>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.137.144
country_id: 1605651
description:
Dec 30 02:44:50 host2 sshd[1134062]: Disconnected from invalid user william 27.254.137.144 port 38418 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.114.89.9
country_id: 798544
description:
Dec 30 02:44:55 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<charanaw>, method=PLAIN, rip=188.114.89.9, lip=66.85.158.91, TLS, session=<tATfuh1HfoC8clkJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.127.60
country_id: 6252001
description:
Dec 30 02:44:19 host2 sshd[1133659]: Disconnected from invalid user sysadmin 205.185.127.60 port 34130 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.170
country_id: 1269750
description:
2025-12-30 02:45:18 dovecot_login authenticator failed for H=([122.184.128.193]) [182.95.185.170]:48638: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.137.144
country_id: 1605651
description:
Dec 30 02:45:25 host2 sshd[1135017]: Disconnected from invalid user test 27.254.137.144 port 60004 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2025-12-30 02:45:32 dovecot_login authenticator failed for H=42-200-70-134.static.imsbiz.com [42.200.70.134]:49383: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 30 02:45:32 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<o3Aovh1H4MBnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 30 02:46:05 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<E2McwB1HRAqi8Jp9>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 205.185.127.60
country_id: 6252001
description:
Dec 30 02:46:14 host2 sshd[1136116]: Disconnected from invalid user robot 205.185.127.60 port 39982 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 30 02:46:35 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<8j7rwR1HAMCElEgp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.215.80.173
country_id: 1819730
description:
Dec 30 02:47:00 host2 sshd[1136750]: Disconnected from invalid user android 103.215.80.173 port 54376 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 30 02:46:54 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<v7kMwx1HJJ6i8GQy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.128.241.2
country_id: 3437598
description:
Dec 30 02:47:37 host2 sshd[1137386]: Disconnected from invalid user odoo15 190.128.241.2 port 26057 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 02:48:38 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<iXtGyR1HXI+nrKy4>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.59.95.213
country_id: 1643084
description:
Dec 30 02:49:01 host2 sshd[1138563]: Disconnected from invalid user omer 103.59.95.213 port 38562 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 30 02:49:32 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<Dc+BzB1HnuQFhXlo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.128.241.2
country_id: 3437598
description:
Dec 30 02:49:39 host2 sshd[1139279]: Disconnected from invalid user username 190.128.241.2 port 57210 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.215.80.173
country_id: 1819730
description:
Dec 30 02:51:23 host2 sshd[1141107]: Disconnected from invalid user steam 103.215.80.173 port 56256 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.51.7
country_id: 1880251
description:
Dec 30 02:52:12 host2 sshd[1141584]: Disconnected from invalid user bk 101.47.51.7 port 44726 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 30 02:53:09 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<2z5l2R1HkARniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 02:54:20 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<9Oam3R1HvsAzTcpt>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.51.7
country_id: 1880251
description:
Dec 30 02:55:42 host2 sshd[1145007]: Disconnected from invalid user odoo15 101.47.51.7 port 59998 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.247.23.131
country_id: 1269750
description:
Dec 30 02:55:45 host2 sshd[1145039]: Disconnected from invalid user test 117.247.23.131 port 60190 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 02:55:47 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<SBHX4h1HoKMv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.215.80.173
country_id: 1819730
description:
Dec 30 02:55:48 host2 sshd[1145204]: Disconnected from invalid user testuser 103.215.80.173 port 38082 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.51.7
country_id: 1880251
description:
Dec 30 02:56:50 host2 sshd[1145993]: Disconnected from invalid user pacific 101.47.51.7 port 50226 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 30 02:57:43 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<D6Wu6R1HMqWYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 02:58:40 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<hY4r7R1HapMzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 02:59:37 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<//qK8B1HgIyeRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.38.130
country_id: 1210997
description:
2025-12-30 02:59:45 dovecot_login authenticator failed for H=([49.0.38.130]) [49.0.38.130]:38552: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 82.115.13.156
country_id: 2077456
description:
Dec 30 02:59:49 host2 sshd[1148632]: Received disconnect from 82.115.13.156 port 36412:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 82.115.13.156
country_id: 2077456
description:
Dec 30 02:59:49 host2 sshd[1148632]: Disconnected from invalid user ubuntu 82.115.13.156 port 36412 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.109.101
country_id: 3144096
description:
2025-12-30 02:59:57 dovecot_login authenticator failed for H=(cm-178.232.109.101.get.no) [178.232.109.101]:49889: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.115.13.156
country_id: 2077456
description:
Dec 30 03:00:45 host2 sshd[1149828]: Disconnected from invalid user ftpadmin 82.115.13.156 port 55754 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.110.150
country_id: 660013
description:
2025-12-30 03:07:10 dovecot_login authenticator failed for H=([45.82.110.150]) [45.82.110.150]:33876: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.33.112
country_id: 3144096
description:
2025-12-30 03:07:23 dovecot_login authenticator failed for H=([178.232.33.112]) [178.232.33.112]:57682: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.247.23.131
country_id: 1269750
description:
Dec 30 03:07:29 host2 sshd[1155954]: Disconnected from invalid user ubuntu 117.247.23.131 port 51664 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 30 03:08:31 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<BAxYEB5HEAV100Db>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.223.11
country_id: 1880251
description:
Dec 30 03:10:03 host2 sshd[1157899]: Disconnected from invalid user admin 45.78.223.11 port 47162 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.70.19.11
country_id: 3469034
description:
2025-12-30 03:14:26 dovecot_login authenticator failed for H=(45-70-19-11.static.damsolutionsturbo.com.br) [45.70.19.11]:43235: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.0.88
country_id: 3144096
description:
2025-12-30 03:14:39 dovecot_login authenticator failed for H=(cm-78.156.0.88.get.no) [78.156.0.88]:54220: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.188.0.71
country_id: 3996063
description:
Dec 30 03:15:44 host2 sshd[1163690]: Disconnected from invalid user pepper 187.188.0.71 port 53336 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 03:16:37 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<ArJaLR5HoMQv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.188.0.71
country_id: 3996063
description:
Dec 30 03:16:50 host2 sshd[1164871]: Disconnected from invalid user bass 187.188.0.71 port 37480 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.47.190
country_id: 99237
description:
2025-12-30 03:17:56 dovecot_login authenticator failed for H=([185.255.47.190]) [185.255.47.190]:41554: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-12-30 03:18:11 dovecot_login authenticator failed for H=([196.203.231.220]) [196.203.231.220]:51202: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 30 03:19:37 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<WkAOOB5Httlo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2025-12-30 03:20:38 dovecot_plain authenticator failed for H=c-24-23-125-83.hsd1.pa.comcast.net (augeness) [24.23.125.83]:43494: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.247.23.131
country_id: 1269750
description:
Dec 30 03:20:52 host2 sshd[1167957]: Disconnected from invalid user ubuntu 117.247.23.131 port 44728 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 30 03:22:14 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<m7BuQR5HCqRV6odu>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 30 03:22:56 host2 pure-ftpd[1169221]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 30 03:23:03 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<pZtURB5HhrsyBsPO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.204.127.54
country_id: 3469034
description:
Dec 30 03:24:19 host2 sshd[1170334]: Disconnected from invalid user test 138.204.127.54 port 48362 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.128.196.243
country_id: 130758
description:
Dec 30 03:25:08 host2 sshd[1171274]: Disconnected from invalid user test 95.128.196.243 port 36296 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.1.117.220
country_id: 6252001
description:
Dec 30 03:25:12 host2 sshd[1171360]: Disconnected from invalid user admin 198.1.117.220 port 56528 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 03:25:49 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<2AQ4Th5HnFojupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.149.142.17
country_id: 630336
description:
2025-12-30 03:27:02 dovecot_login authenticator failed for H=([77.74.34.30]) [91.149.142.17]:35078: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.1.117.220
country_id: 6252001
description:
Dec 30 03:26:51 host2 sshd[1172559]: Disconnected from invalid user userftp 198.1.117.220 port 34992 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.204.127.54
country_id: 3469034
description:
Dec 30 03:26:13 host2 sshd[1172108]: Disconnected from invalid user test 138.204.127.54 port 40252 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-30 03:26:46 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:63361: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 30 03:26:55 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<er4fUh5HlN4v+wDY>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 30 03:27:29 host2 sshd[1173096]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.1.117.220
country_id: 6252001
description:
Dec 30 03:27:56 host2 sshd[1173395]: Disconnected from invalid user user 198.1.117.220 port 58278 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-12-30 03:28:05 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:53348: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.97.203.163
country_id: 3686110
description:
2025-12-30 03:27:34 dovecot_login authenticator failed for H=([186.97.203.163]) [186.97.203.163]:38558: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 198.1.117.220
country_id: 6252001
description:
Dec 30 03:27:56 host2 sshd[1173395]: Received disconnect from 198.1.117.220 port 58278:11: Bye Bye [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.164
country_id: 2993457
description:
Dec 30 03:29:03 host2 pure-ftpd[1174838]: (?@194.165.16.164) [INFO] New connection from 194.165.16.164


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.128.196.243
country_id: 130758
description:
Dec 30 03:29:16 host2 sshd[1174954]: Disconnected from invalid user ubuntu1 95.128.196.243 port 45798 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.185.207
country_id: 6252001
description:
Dec 30 03:29:46 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.220.185.207, lip=66.85.158.91, TLS handshaking: Connection closed, session=<uhN6XB5HQq4s3LnP>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 49.207.243.168
country_id: 1269750
description:
Dec 30 03:33:05 host2 sshd[1177796]: Disconnected from invalid user test 49.207.243.168 port 53886 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.207.243.168
country_id: 1269750
description:
Dec 30 03:34:18 host2 sshd[1178760]: Disconnected from invalid user username 49.207.243.168 port 54396 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.49
country_id: 6252001
description:
Dec 30 03:35:48 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.49, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<tksRch5HFNLN0h8x>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.128.196.243
country_id: 130758
description:
Dec 30 03:36:54 host2 sshd[1181095]: Disconnected from invalid user git 95.128.196.243 port 56104 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 03:37:50 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<sdU9eR5HyN6eRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 30 03:38:44 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<d4J1fB5HqIFnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.213.178.212
country_id: 1861060
description:
2025-12-30 03:39:04 dovecot_login authenticator failed for H=([154.213.178.212]) [154.213.178.212]:64180: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 30 03:39:12 host2 sshd[1183116]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 30 03:39:42 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<QYbmfx5H7t0vWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 03:40:25 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<g2t1gh5HZs8jupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 30 03:40:34 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<Z1P3gh5H3NKi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 03:42:07 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<ZuuJiB5HGMenrKy4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.255
country_id: 6252001
description:
Dec 30 03:42:17 host2 dovecot[512723]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.255, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<QfE+iR5HzsfN0h//>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.203.180.173
country_id: 3996063
description:
2025-12-30 03:42:38 dovecot_login authenticator failed for H=fixed-189-203-180-173.totalplay.net [189.203.180.173]:39067: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
country_id: 1880251
description:
2025-12-30 03:42:53 dovecot_login authenticator failed for H=(bb128-106-196-150.singnet.com.sg) [128.106.196.150]:29695: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.151.240.91
country_id: 1522867
description:
2025-12-30 03:43:17 dovecot_login authenticator failed for H=37.151.240.91.dynamic.telecom.kz [37.151.240.91]:46898: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.157.236
country_id: 6251999
description:
Dec 30 03:43:23 host2 sshd[1186147]: Disconnected from invalid user sammy 51.222.157.236 port 49304 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 30 03:44:08 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<ADTBjx5H7Dmi8Jp9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.56.11.17
country_id: 3865483
description:
Dec 30 03:44:14 host2 sshd[1187070]: Disconnected from invalid user bitrix 186.56.11.17 port 42654 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.131.163
country_id: 1819730
description:
Dec 30 03:44:30 host2 sshd[1187303]: Disconnected from invalid user openstack 128.1.131.163 port 53938 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 30 03:45:59 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<C25Wlh5HsS5niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 30 03:45:32 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<jnW7lB5HEMRCdMzo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.91.0.68
country_id: 2750405
description:
Dec 30 03:45:46 host2 sshd[1189328]: Disconnected from invalid user xiao 34.91.0.68 port 57038 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.250.96.66
country_id: 1269750
description:
Dec 30 03:46:38 host2 sshd[1190332]: Disconnected from invalid user mohsen 117.250.96.66 port 40680 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.130.176.136
country_id: 6252001
description:
2025-12-30 03:46:49 dovecot_login authenticator failed for H=mobile-166-130-176-136.mycingular.net [166.130.176.136]:54946: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 90.226.39.62
country_id: 2661886
description:
Dec 30 03:47:09 host2 sshd[1191054]: Disconnecting authenticating user root 90.226.39.62 port 37488: Too many authentication failures [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.173.57
country_id: 3144096
description:
2025-12-30 03:47:09 dovecot_login authenticator failed for H=([62.97.173.57]) [62.97.173.57]:52829: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 90.226.39.62
country_id: 2661886
description:
Dec 30 03:47:09 host2 sshd[1191054]: error: maximum authentication attempts exceeded for root from 90.226.39.62 port 37488 ssh2 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.123.68.117
country_id: 290557
description:
Dec 30 03:47:48 host2 sshd[1191743]: Disconnected from invalid user marvin 193.123.68.117 port 12931 [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 90.226.39.62
country_id: 2661886
description:
Dec 30 03:47:12 host2 sshd[1191120]: error: maximum authentication attempts exceeded for root from 90.226.39.62 port 38042 ssh2 [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 90.226.39.62
country_id: 2661886
description:
Dec 30 03:47:12 host2 sshd[1191120]: Disconnecting authenticating user root 90.226.39.62 port 38042: Too many authentication failures [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.91.0.68
country_id: 2750405
description:
Dec 30 03:47:12 host2 sshd[1191158]: Disconnected from invalid user testuser 34.91.0.68 port 41562 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 90.226.39.62
country_id: 2661886
description:
Dec 30 03:47:19 host2 sshd[1191257]: Disconnecting invalid user admin 90.226.39.62 port 39408: Too many authentication failures [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.91.0.68
country_id: 2750405
description:
Dec 30 03:48:39 host2 sshd[1192555]: Disconnected from invalid user david 34.91.0.68 port 54318 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.66.228.255
country_id: 2921044
description:
Dec 30 03:48:43 host2 sshd[1192606]: Disconnected from invalid user kocom 45.66.228.255 port 34734 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.138.142
country_id: 3144096
description:
2025-12-30 03:48:48 dovecot_login authenticator failed for H=(cm-178.232.138.142.get.no) [178.232.138.142]:49497: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 193.123.68.117
country_id: 290557
description:
Dec 30 03:49:40 host2 sshd[1193640]: Disconnected from invalid user portainer 193.123.68.117 port 62108 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-12-30 03:49:16 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:52310: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.250.96.66
country_id: 1269750
description:
Dec 30 03:49:29 host2 sshd[1193520]: Disconnected from invalid user bitrix 117.250.96.66 port 39948 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.66.228.255
country_id: 2921044
description:
Dec 30 03:51:09 host2 sshd[1195460]: Disconnected from invalid user steam 45.66.228.255 port 37682 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.123.68.117
country_id: 290557
description:
Dec 30 03:50:52 host2 sshd[1195096]: Disconnected from invalid user uno85 193.123.68.117 port 43814 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.199.126
country_id: 1269750
description:
2025-12-30 03:51:05 dovecot_login authenticator failed for H=([182.79.31.107]) [152.52.199.126]:46518: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.250.96.66
country_id: 1269750
description:
Dec 30 03:50:13 host2 sshd[1194271]: Disconnected from invalid user steam 117.250.96.66 port 53878 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.66.228.255
country_id: 2921044
description:
Dec 30 03:50:33 host2 sshd[1194745]: Disconnected from invalid user guest 45.66.228.255 port 60998 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.157.236
country_id: 6251999
description:
Dec 30 03:51:48 host2 sshd[1196009]: Disconnected from invalid user tobias 51.222.157.236 port 35982 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.56.11.17
country_id: 3865483
description:
Dec 30 03:51:11 host2 sshd[1195487]: Disconnected from invalid user openstack 186.56.11.17 port 54960 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.114.73
country_id: 1168579
description:
2025-12-30 03:51:24 dovecot_login authenticator failed for H=([103.186.114.73]) [103.186.114.73]:34542: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.157.236
country_id: 6251999
description:
Dec 30 03:52:17 host2 sshd[1196453]: Disconnected from invalid user openstack 51.222.157.236 port 45158 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.66.228.255
country_id: 2921044
description:
Dec 30 03:54:12 host2 sshd[1198301]: Disconnected from invalid user bitrix 45.66.228.255 port 35854 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 139.59.3.182
country_id: 1269750
description:
Dec 30 03:54:25 host2 sshd[1198508]: Disconnected from invalid user bitrix 139.59.3.182 port 50336 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 30 03:54:39 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<ZXdUtR5HgqwFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 03:55:15 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<YlJ+tx5HtLKeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 03:57:40 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<ggwgwB5HDJ4zTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 03:58:44 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<aB3jwx5HcL8v/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2025-12-30 03:59:31 dovecot_plain authenticator failed for H=syn-074-218-095-154.biz.spectrum.com (ketene) [74.218.95.154]:42985: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 30 04:00:47 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<3H9Jyx5HvKGElEgp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 04:02:03 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<jTPLzx5H3KwzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 30 04:03:36 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<Bp5e1R5HAPd100Db>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.1
country_id: 6252001
description:
Dec 30 04:07:37 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.1, lip=66.85.158.91, TLS handshaking: Connection closed, session=<wObU4x5H6Y7DuEwB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.224
country_id: 6252001
description:
Dec 30 04:07:47 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=195.184.76.224, lip=66.85.158.91, TLS: Connection closed, session=<jw9x5B5H5bvDuEzg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 04:08:00 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<WxsQ5R5H1tynrKy4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.230
country_id: 6252001
description:
Dec 30 04:08:01 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=195.184.76.230, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<BSVF5R5HZ7rDuEzm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.31
country_id: 6252001
description:
Dec 30 04:08:06 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.31, lip=66.85.158.91, TLS handshaking: Connection closed, session=<hnSZ5R5HkejDuEwf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.110
country_id: 6252001
description:
Dec 30 04:08:17 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=195.184.76.110, lip=66.85.158.91, TLS: Connection closed, session=<6Uc25h5Hn7nDuExu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.109
country_id: 6252001
description:
Dec 30 04:08:31 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.109, lip=66.85.158.91, TLS: Connection closed, session=<OHQS5x5HC4DDuExt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 30 04:12:16 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<VjBb9B5HtN6YNcU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.80.158
country_id: 1269750
description:
2025-12-30 04:17:50 dovecot_login authenticator failed for H=(victoryent.in) [111.93.80.158]:60644: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.0.182
country_id: 3469034
description:
2025-12-30 04:18:16 dovecot_login authenticator failed for H=([177.74.52.129]) [177.74.0.182]:45229: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 30 04:19:22 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<BqG8DR9H8L8v+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 04:19:38 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<eJC0Dh9H/ocv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 30 04:20:23 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<Sd1ZER9HHM5V6odu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.66.231
country_id: 3469034
description:
2025-12-30 04:20:11 dovecot_login authenticator failed for H=(187.58.64.145.static.host.gvt.net.br) [187.58.66.231]:38608: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 04:21:31 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<XqNpFR9HdHAjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 30 04:21:53 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<7EPBFh9HKPlo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.91.113.248
country_id: 6252001
description:
2025-12-30 04:23:29 dovecot_login authenticator failed for H=(syn-172-091-113-248.res.spectrum.com) [172.91.113.248]:43904: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.231.202
country_id: 1269750
description:
2025-12-30 04:23:45 dovecot_login authenticator failed for H=([152.52.234.4]) [152.52.231.202]:43622: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 30 04:25:17 host2 pure-ftpd[1233112]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.141.222
country_id: 3017382
description:
Dec 30 04:26:42 host2 sshd[1234308]: Disconnected from invalid user colin 51.178.141.222 port 47650 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 30 04:27:33 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<Fk4FKx9HVtwyBsPO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.141.222
country_id: 3017382
description:
Dec 30 04:28:38 host2 sshd[1236692]: Disconnected from invalid user minecraft 51.178.141.222 port 48036 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.84.41.244
country_id: 3895114
description:
Dec 30 04:28:58 host2 sshd[1237002]: Disconnected from invalid user smbguest 138.84.41.244 port 10070 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.141.222
country_id: 3017382
description:
Dec 30 04:29:11 host2 sshd[1237214]: Disconnected from invalid user cristina 51.178.141.222 port 60480 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.84.41.244
country_id: 3895114
description:
Dec 30 04:29:45 host2 sshd[1237857]: Disconnected from invalid user arma3server 138.84.41.244 port 34831 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.178.141.222
country_id: 3017382
description:
Dec 30 04:30:09 host2 sshd[1238782]: Disconnected from invalid user nc 51.178.141.222 port 57066 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.84.41.244
country_id: 3895114
description:
Dec 30 04:30:33 host2 sshd[1241274]: Disconnected from invalid user fernanda 138.84.41.244 port 32123 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 30 04:30:47 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<S7CVNh9HdIpnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.149.165.107
country_id: 6252001
description:
2025-12-30 04:30:54 dovecot_login authenticator failed for H=c-76-149-165-107.hsd1.ut.comcast.net [76.149.165.107]:44380: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.85.38
country_id: 1269750
description:
2025-12-30 04:31:06 dovecot_login authenticator failed for H=([182.79.85.38]) [182.79.85.38]:44486: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.240.0.197
country_id: 1643084
description:
Dec 30 04:30:25 host2 sshd[1240096]: Disconnected from invalid user openvpn 151.240.0.197 port 47270 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.240.0.197
country_id: 1643084
description:
Dec 30 04:31:39 host2 sshd[1242020]: Disconnected from invalid user kodi 151.240.0.197 port 53040 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.240.0.197
country_id: 1643084
description:
Dec 30 04:32:17 host2 sshd[1242746]: Disconnected from invalid user vlc 151.240.0.197 port 39484 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.105.91.164
country_id: 2017370
description:
Dec 30 04:33:24 host2 sshd[1243567]: Disconnected from invalid user ubuntu 185.105.91.164 port 53758 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 04:33:29 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<o2c9QB9H0KKeRdY+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.240.0.197
country_id: 1643084
description:
Dec 30 04:33:47 host2 sshd[1243992]: Disconnected from invalid user rushi 151.240.0.197 port 40524 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 30 04:33:58 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<n4jwQR9H8Nqi8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.106.163.189
country_id: 6252001
description:
2025-12-30 04:35:35 dovecot_plain authenticator failed for H=c-76-106-163-189.hsd1.fl.comcast.net (pecoady) [76.106.163.189]:49634: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 04:35:53 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<oAvWSB9HmqEjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-12-30 04:36:57 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:34022: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.255.26
country_id: 2661886
description:
2025-12-30 04:37:08 dovecot_login authenticator failed for H=94-255-255-26.cust.bredband2.com [94.255.255.26]:46152: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 30 04:37:56 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<Fc0jUB9HNApniu0S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.139
country_id: 6252001
description:
Dec 30 04:38:07 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.139, lip=66.85.158.91, TLS: Connection closed, session=<0zzvUB9HZPBChJmL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.82
country_id: 6252001
description:
Dec 30 04:39:28 host2 dovecot[512723]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.82, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<O0DGVR9Hd93N0h9S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 30 04:41:27 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<Mga/XB9HZn2i8Jp9>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.254.70.217
country_id: 2750405
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 5.254.70.217 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.176.79.117
country_id: 1643084
description:
Dec 30 04:43:36 host2 sshd[1251689]: Disconnected from invalid user rocketmq 103.176.79.117 port 34954 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 30 04:44:02 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<HMH5ZR9H8McvWBNS>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.185.243.158
country_id: 6252001
description:
Dec 30 04:46:40 host2 sshd[1255112]: Disconnected from invalid user monitor 20.185.243.158 port 52262 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 30 04:46:58 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<b4J6cB9H8tVCdMzo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.116.165
country_id: 3144096
description:
2025-12-30 04:48:06 dovecot_login authenticator failed for H=(cm-178.232.116.165.get.no) [178.232.116.165]:48478: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.199.162.47
country_id: 597427
description:
Dec 30 04:47:11 host2 sshd[1255446]: Disconnected from invalid user zomboid 5.199.162.47 port 45726 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.126.144.30
country_id: 6252001
description:
2025-12-30 04:47:51 dovecot_login authenticator failed for H=ool-457e901e.dyn.optonline.net [69.126.144.30]:60090: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 5.199.162.47
country_id: 597427
description:
Dec 30 04:48:14 host2 sshd[1256205]: Disconnected from invalid user admin 5.199.162.47 port 51794 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.157.219.158
country_id: 6252001
description:
2025-12-30 04:51:10 dovecot_plain authenticator failed for H=c-76-157-219-158.hsd1.il.comcast.net (reptawle) [76.157.219.158]:43756: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 04:50:27 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<N2fqfB9H+uSeRdY+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.176.79.117
country_id: 1643084
description:
Dec 30 04:50:29 host2 sshd[1258471]: Disconnected from invalid user distro 103.176.79.117 port 39396 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.176.79.117
country_id: 1643084
description:
Dec 30 04:51:17 host2 sshd[1259112]: Disconnected from invalid user abhi 103.176.79.117 port 60864 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.254
country_id: 6252001
description:
2025-12-30 04:58:39 dovecot_login authenticator failed for H=([209.23.72.254]) [209.23.72.254]:55438: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.239.5
country_id: 3144096
description:
2025-12-30 04:58:28 dovecot_login authenticator failed for H=(cm-178.232.239.5.get.no) [178.232.239.5]:42895: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 30 04:59:16 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<3jVvnB9HDE9100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.168.127.166
country_id: 1269750
description:
2025-12-30 04:59:26 dovecot_login authenticator failed for H=(abts-mp-static-166.127.168.122.airtelbroadband.in) [122.168.127.166]:54796: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.166
country_id: 1269750
description:
2025-12-30 04:59:41 dovecot_login authenticator failed for H=([182.95.131.41]) [103.251.31.166]:38420: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 30 05:00:16 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<VKQCoB9HwswFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 05:01:05 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<Mwbjoh9HZoQzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 05:02:09 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<ZzjHph9HIN+nrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 05:01:54 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<PBXTpR9H9N0v/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 30 05:03:26 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<LdBWqx9HoNaeRdGr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.125
country_id: 6252001
description:
Dec 30 05:03:51 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.125, lip=66.85.158.91, TLS handshaking: Connection closed, session=<TfDvrB9H2kFChJl9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 05:05:28 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<w9eZsh9HntIzTcpt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.14
country_id: 798549
description:
Dec 30 05:08:15 host2 dovecot[512723]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 1 secs): user=<>, rip=85.217.140.14, lip=66.85.158.92, TLS, session=<3HurvB9HopdV2YwO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.215.4
country_id: 732800
description:
Dec 30 05:11:15 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.255.215.4, lip=66.85.158.91, TLS, session=<Gypqxh9HI4G5/9cE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.67.155.104
country_id: 298795
description:
Dec 30 05:10:57 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=45.67.155.104, lip=66.85.158.91, TLS, session=<Ok9PxR9Hp80tQ5to>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 30 05:12:26 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<EYiGyx9HdJ8v+wDY>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 30 05:14:06 host2 sshd[1278850]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 30 05:14:03 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<EYpK0R9HFoOElEgp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 30 05:16:03 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<w2dr2B9HYMOeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 05:16:46 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<jI0B2x9Htn8jupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 30 05:18:58 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<olLI4h9HHuZV6odu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.12
country_id: 241170
description:
Dec 30 05:22:15 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.12, lip=66.85.158.91, session=<ObKf7h9HntXE+2YM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 05:23:10 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<b/rp8R9HptAv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 30 05:23:23 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<R96t8h9HKJhnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 30 05:24:21 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<eJAq9h9HQjZo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 30 05:27:20 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<7rXQACBH0Oai8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 30 05:27:35 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<TY2uASBHIoyYNcU1>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 30 05:27:41 host2 pure-ftpd[1289279]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 05:28:27 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<VorKBCBH8pOnrKy4>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.17.84
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 172.56.17.84 - tradeceylon "GET /login/?login_only=1&user=tradeceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.50.175.78
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 104.50.175.78 - trad "GET /login/?login_only=1&user=trad&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trad (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.241.60.233
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 96.241.60.233 - tra "GET /login/?login_only=1&user=tra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tra (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.117.122.179
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 75.117.122.179 - tradece1 "GET /login/?login_only=1&user=tradece1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece1 (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 05:28:19 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<uo9ZBCBHSoieRdY+>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.34.225.6
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 108.34.225.6 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.9.37.201
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 172.9.37.201 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.60.12.141
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 73.60.12.141 - tradece "GET /login/?login_only=1&user=tradece&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.38.3.27
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 73.38.3.27 - trade "GET /login/?login_only=1&user=trade&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trade (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.60.213.95
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 216.60.213.95 - tradece2 "GET /login/?login_only=1&user=tradece2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.184.171.155
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 97.184.171.155 - tradecey "GET /login/?login_only=1&user=tradecey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradecey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.181.164.244
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 67.181.164.244 - tradec "GET /login/?login_only=1&user=tradec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradec (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.93.110
country_id: 2542007
description:
2025-12-30 05:28:50 dovecot_login authenticator failed for H=([105.73.93.110]) [105.73.93.110]:57172: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.57.115.254
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 68.57.115.254 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.160.114.7
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 70.160.114.7 - tradeceyloncom "GET /login/?login_only=1&user=tradeceyloncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyloncom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.188.199.46
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 64.188.199.46 - tr "GET /login/?login_only=1&user=tr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tr (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 30 05:30:42 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<dmvaDCBHHxdniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.212.81.228
country_id: 3895114
description:
Dec 30 05:31:06 host2 sshd[1292131]: Disconnected from invalid user ircd 181.212.81.228 port 54108 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 05:31:22 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<4+IzDyBHaK0jupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-30 05:32:32 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (intismole) [87.103.126.54]:43405: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 30 05:32:46 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<97tAFCBHxsIyBsPO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.129.88.87
country_id: 2077456
description:
Dec 30 05:32:21 host2 sshd[1292943]: Disconnected from invalid user ftpuser 115.129.88.87 port 53670 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.212.81.228
country_id: 3895114
description:
Dec 30 05:32:59 host2 sshd[1293461]: Disconnected from invalid user monitor 181.212.81.228 port 59894 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.195.20
country_id: 6252001
description:
Dec 30 05:35:11 host2 dovecot[512723]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.65.195.20, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<LQr/HCBH0N8UQcMU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.56
country_id: 6252001
description:
Dec 30 05:35:24 host2 dovecot[512723]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=167.94.146.56, lip=66.85.158.91, session=<diXMHSBHCoKnXpI4>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.25.150.161
country_id: 798544
description:
Dec 30 05:34:53 host2 sshd[1295035]: Disconnected from invalid user bot 185.25.150.161 port 40988 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 31.14.114.105
country_id: 130758
description:
Dec 30 05:36:03 host2 sshd[1296313]: Disconnected from invalid user ircd 31.14.114.105 port 39568 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.166
country_id: 2993457
description:
Dec 30 05:36:05 host2 pure-ftpd[1296355]: (?@194.165.16.166) [INFO] New connection from 194.165.16.166


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.129.88.87
country_id: 2077456
description:
Dec 30 05:37:28 host2 sshd[1297220]: Disconnected from invalid user tempuser 115.129.88.87 port 46937 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 30 05:39:25 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<YdALLCBHLL+i8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.228.146
country_id: 1269750
description:
2025-12-30 05:39:42 dovecot_login authenticator failed for H=([125.20.228.146]) [125.20.228.146]:46654: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.23.242.223
country_id: 953987
description:
2025-12-30 05:40:14 dovecot_login authenticator failed for H=([102.23.242.223]) [102.23.242.223]:37993: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.115
country_id: 6252001
description:
Dec 30 05:41:13 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 6 secs): user=<>, rip=66.132.153.115, lip=66.85.158.92, TLS: Connection closed, session=<triPMiBHjgRChJlz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.76.248.118
country_id: 6252001
description:
Dec 30 05:45:02 host2 dovecot[512723]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=40.76.248.118, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<ElRDQCBHkpwoTPh2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 05:46:05 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<cxraQyBH+sKeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 30 05:49:17 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<vblRTyBHwrYvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 30 05:49:35 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<djtfUCBHAoBCdMzo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.130
country_id: 1269750
description:
2025-12-30 05:51:59 dovecot_login authenticator failed for H=([182.95.58.130]) [182.95.58.130]:59550: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.134.120
country_id: 1269750
description:
2025-12-30 05:52:37 dovecot_login authenticator failed for H=(abts-mum-static-120.134.179.122.airtelbroadband.in) [122.179.134.120]:54683: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.199.126
country_id: 1269750
description:
2025-12-30 05:58:33 dovecot_login authenticator failed for H=([152.52.199.126]) [152.52.199.126]:49848: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.130.212.59
country_id: 1643084
description:
2025-12-30 05:58:48 dovecot_login authenticator failed for H=([222.124.249.133]) [203.130.212.59]:33524: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
country_id: 2510769
description:
2025-12-30 05:59:03 dovecot_login authenticator failed for H=([90.173.78.90]) [90.173.78.90]:47037: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.67.152.201
country_id: 1269750
description:
2025-12-30 05:59:22 dovecot_login authenticator failed for H=([103.67.152.201]) [103.67.152.201]:35288: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 30 06:03:26 host2 sshd[1318559]: Disconnected from invalid user admin 2.57.121.112 port 34242 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 30 06:06:15 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<5WH5iyBHlJ0FhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 06:05:37 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<QJa9iSBHYqAzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 06:06:13 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<GM3eiyBHkuov/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 30 06:06:39 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=</uFtjSBHDIAv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 06:10:07 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<M/vJmSBH+IszTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.185.37.239
country_id: 1269750
description:
2025-12-30 06:11:05 dovecot_login authenticator failed for H=([136.185.37.239]) [136.185.37.239]:38012: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.97.44.51
country_id: 3175395
description:
Dec 30 06:12:09 host2 sshd[1325001]: Disconnected from invalid user sentry 62.97.44.51 port 49174 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.174.243
country_id: 1269750
description:
Dec 30 06:11:33 host2 sshd[1324623]: Disconnected from invalid user minecraft 64.227.174.243 port 33420 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.97.44.51
country_id: 3175395
description:
Dec 30 06:11:38 host2 sshd[1324660]: Disconnected from invalid user ts3bot 62.97.44.51 port 49620 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.206.51
country_id: 3144096
description:
2025-12-30 06:13:01 dovecot_login authenticator failed for H=(cm-178.232.206.51.get.no) [178.232.206.51]:47456: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 06:13:04 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<UaNfpCBHKu4jupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.97.44.51
country_id: 3175395
description:
Dec 30 06:12:41 host2 sshd[1325477]: Disconnected from invalid user louwg 62.97.44.51 port 56386 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.216.181.233
country_id: 2661886
description:
2025-12-30 06:13:29 dovecot_login authenticator failed for H=c80-216-181-233.bredband.tele2.se [80.216.181.233]:41900: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 30 06:16:34 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<support@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<qye0sCBHlMJnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 30 06:18:08 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<xjZ5tiBH2JJV6odu>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.227.174.243
country_id: 1269750
description:
Dec 30 06:18:22 host2 sshd[1329819]: Disconnected from invalid user gitlab-runner 64.227.174.243 port 55750 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.36.82
country_id: 1210997
description:
2025-12-30 06:19:02 dovecot_login authenticator failed for H=([49.0.36.82]) [49.0.36.82]:54434: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.86.61.76
country_id: 6252001
description:
2025-12-30 06:19:15 dovecot_login authenticator failed for H=([208.86.61.76]) [208.86.61.76]:53550: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 30 06:19:32 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<QPp+uyBH3NqeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 30 06:21:20 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<EILzwSBHINOi8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.202.86
country_id: 3469034
description:
2025-12-30 06:23:03 dovecot_login authenticator failed for H=(189-56-202-86.customer.tdatabrasil.net.br) [189.56.202.86]:34863: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2025-12-30 06:23:17 dovecot_login authenticator failed for H=(119.92.76.210.static.pldt.net) [119.92.76.210]:48414: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 30 06:23:36 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<VhQHyiBHqzxniu0S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.14
country_id: 798549
description:
Dec 30 06:23:56 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=85.217.140.14, lip=66.85.158.91, TLS: Connection closed, session=<4JRUyyBH2o5V2YwO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 06:24:34 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<e6R6zSBHBrCnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 06:25:09 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<NCSXzyBH8MueRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-30 06:26:16 dovecot_plain authenticator failed for H=host-196-47-172-253.afnet.net (sulang) [196.47.172.253]:47596: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.99.195
country_id: 1269750
description:
2025-12-30 06:25:43 dovecot_login authenticator failed for H=(abts-mum-static-195.99.170.122.airtelbroadband.in) [122.170.99.195]:50049: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.8.241.121
country_id: 2077456
description:
2025-12-30 06:25:56 dovecot_login authenticator failed for H=([161.8.241.121]) [161.8.241.121]:57321: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2025-12-30 06:27:24 dovecot_plain authenticator failed for H=c-73-213-237-28.hsd1.va.comcast.net (allatory) [73.213.237.28]:38632: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 06:27:51 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<gNc22SBHxlsjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 06:27:58 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<ZTqm2SBH1Nov/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 30 06:28:14 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<sUKZ2iBHogVo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.166.199
country_id: 2186224
description:
2025-12-30 06:29:00 dovecot_login authenticator failed for H=([121.73.166.199]) [121.73.166.199]:38432: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.225.114
country_id: 1269750
description:
2025-12-30 06:28:32 dovecot_login authenticator failed for H=([128.185.247.231]) [182.95.225.114]:34008: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 30 06:28:34 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<GkPT2yBHrNKElEgp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.40.238
country_id: 1210997
description:
2025-12-30 06:29:01 dovecot_login authenticator failed for H=([49.0.40.238]) [49.0.40.238]:47748: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 30 06:30:05 host2 pure-ftpd[1339977]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 30 06:31:25 host2 sshd[1340866]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.48
country_id: 6252001
description:
Dec 30 06:31:51 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=205.210.31.48, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<u7+w5yBHF9vN0h8w>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 30 06:32:33 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<4psF6iBH1sieRdGr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 30 06:38:14 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<Rq1V/iBH9uSi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 30 06:38:22 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<Fo/a/iBH0qcyBsPO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-30 06:42:22 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:62749: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.158.22.150
country_id: 99237
description:
Dec 30 06:42:26 host2 sshd[1349027]: Disconnected from invalid user gitlab-runner 185.158.22.150 port 3920 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 06:43:04 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<+tKuDyFHhLGeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 30 06:44:32 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<Kz3uFCFHtuCYNcU1>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.221.27.234
country_id: 1819730
description:
Dec 30 06:45:21 host2 sshd[1351982]: Disconnected from invalid user user 154.221.27.234 port 58290 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.95.12
country_id: 1643084
description:
Dec 30 06:45:27 host2 sshd[1352196]: Disconnected from invalid user user 103.59.95.12 port 47560 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.227.232.248
country_id: 2635167
description:
Dec 30 06:45:43 host2 dovecot[512723]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 1 secs): user=<>, rip=165.227.232.248, lip=66.85.158.91, TLS, session=<kYE+GSFHgMGl4+j4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.95.157.171
country_id: 1861060
description:
Dec 30 06:46:56 host2 sshd[1353167]: Disconnected from invalid user bitrix 150.95.157.171 port 60676 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.27.76.210
country_id: 3469034
description:
2025-12-30 06:47:02 dovecot_login authenticator failed for H=(ip-177-27-76-210.user.vivozap.com.br) [177.27.76.210]:58794: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.190
country_id: 1269750
description:
2025-12-30 06:47:22 dovecot_login authenticator failed for H=([27.123.98.190]) [27.123.98.190]:41400: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.95.12
country_id: 1643084
description:
Dec 30 06:47:58 host2 sshd[1353859]: Disconnected from invalid user ubuntu 103.59.95.12 port 42340 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.93.168.44
country_id: 298795
description:
Dec 30 06:48:12 host2 sshd[1354076]: Disconnected from invalid user administrador 45.93.168.44 port 43184 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.59.95.12
country_id: 1643084
description:
Dec 30 06:48:42 host2 sshd[1354365]: Disconnected from invalid user otsmanager 103.59.95.12 port 48644 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.158.22.150
country_id: 99237
description:
Dec 30 06:48:48 host2 sshd[1354428]: Disconnected from invalid user toor 185.158.22.150 port 21568 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.93.168.44
country_id: 298795
description:
Dec 30 06:49:42 host2 sshd[1355140]: Disconnected from invalid user gitlab-runner 45.93.168.44 port 62558 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.93.168.44
country_id: 298795
description:
Dec 30 06:51:12 host2 sshd[1356724]: Disconnected from invalid user test 45.93.168.44 port 54334 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 45.93.168.44
country_id: 298795
description:
Dec 30 06:50:42 host2 sshd[1356280]: Received disconnect from 45.93.168.44 port 21920:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.93.168.44
country_id: 298795
description:
Dec 30 06:50:42 host2 sshd[1356280]: Disconnected from invalid user jose 45.93.168.44 port 21920 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 06:51:55 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<03pVLyFHgI+nrKy4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.95.12
country_id: 1643084
description:
Dec 30 06:51:24 host2 sshd[1356885]: Disconnected from invalid user gitlab-runner 103.59.95.12 port 48784 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 30 06:53:02 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<d6ZLMyFHS7V100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 30 06:52:25 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<E+MSMSFHdKFCdMzo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 86.54.42.188
country_id: 241170
description:
Dec 30 06:54:33 host2 sshd[1360280]: Disconnected from invalid user felipe 86.54.42.188 port 53170 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.142.209.191
country_id: 2750405
description:
Dec 30 06:55:08 host2 sshd[1360868]: Disconnected from invalid user juan 83.142.209.191 port 42804 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 30 06:56:09 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<y+t0PiFHOKYvWBNS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.80
country_id: 2328926
description:
Dec 30 06:57:45 host2 sshd[1362900]: Disconnected from invalid user bot1 102.88.137.80 port 17518 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.170
country_id: 1643084
description:
Dec 30 06:58:21 host2 sshd[1363431]: Disconnected from invalid user hacluster 27.112.78.170 port 39898 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 86.54.42.188
country_id: 241170
description:
Dec 30 06:58:26 host2 sshd[1363493]: Disconnected from invalid user julio 86.54.42.188 port 38992 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.142.209.191
country_id: 2750405
description:
Dec 30 06:58:34 host2 sshd[1363593]: Disconnected from invalid user benoit 83.142.209.191 port 47534 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.236
country_id: 1819730
description:
Dec 30 06:58:37 host2 sshd[1363640]: Disconnected from invalid user appltest 152.32.129.236 port 33298 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 86.54.42.188
country_id: 241170
description:
Dec 30 06:58:58 host2 sshd[1363905]: Disconnected from invalid user bot1 86.54.42.188 port 36586 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 83.142.209.191
country_id: 2750405
description:
Dec 30 07:00:04 host2 sshd[1364851]: Disconnected from invalid user felipe 83.142.209.191 port 45138 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 86.54.42.188
country_id: 241170
description:
Dec 30 06:59:27 host2 sshd[1364299]: Disconnected from invalid user tomcat7 86.54.42.188 port 50768 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.142.209.191
country_id: 2750405
description:
Dec 30 06:59:35 host2 sshd[1364375]: Disconnected from invalid user benoit 83.142.209.191 port 38236 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.236
country_id: 1819730
description:
Dec 30 06:59:48 host2 sshd[1364498]: Disconnected from invalid user local 152.32.129.236 port 46694 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.80
country_id: 2328926
description:
Dec 30 06:59:56 host2 sshd[1364566]: Disconnected from invalid user control 102.88.137.80 port 1365 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.236
country_id: 1819730
description:
Dec 30 07:00:23 host2 sshd[1365216]: Disconnected from invalid user nick 152.32.129.236 port 40184 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.80
country_id: 2328926
description:
Dec 30 07:00:32 host2 sshd[1365460]: Disconnected from invalid user db2fenc2 102.88.137.80 port 1265 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.129
country_id: 6252001
description:
Dec 30 07:00:47 host2 pure-ftpd[1365650]: (?@66.132.153.129) [INFO] New connection from 66.132.153.129


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 30 07:01:51 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<n6TUUiFHHs4v+wDY>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.112.78.170
country_id: 1643084
description:
Dec 30 07:01:54 host2 sshd[1366420]: Disconnected from invalid user lab 27.112.78.170 port 55082 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.80
country_id: 2328926
description:
Dec 30 07:02:19 host2 sshd[1366660]: Disconnected from invalid user new 102.88.137.80 port 1435 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 30 07:02:26 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<GBrxVCFHBqJn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.178
country_id: 1269750
description:
2025-12-30 07:03:45 dovecot_login authenticator failed for H=([152.52.246.178]) [152.52.246.178]:48646: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.248.30.205
country_id: 1269750
description:
2025-12-30 07:04:09 dovecot_login authenticator failed for H=([103.248.30.205]) [103.248.30.205]:40348: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 30 07:09:48 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<c1szbyFHaNJnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 07:09:52 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<3PWEbyFHIEgjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 07:11:05 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<kfzgcyFH1qQzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 07:11:47 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<k2ZadiFHNqkv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 30 07:15:18 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<8FHpgiFHsNyi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 07:15:32 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<vC7BgyFHEowzTcpt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.55
country_id: 6252001
description:
Dec 30 07:16:26 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.55, lip=66.85.158.91, TLS: Connection closed, session=<tI0UhyFHPmmnXpI3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 30 07:17:01 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<I7kQiSFHrCBniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 30 07:17:14 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<2HXSiSFH1LtV6odu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.63.132.101
country_id: 3175395
description:
Dec 30 07:22:53 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.63.132.101, lip=66.85.158.91, TLS, session=<K8kxnSFHmqG5P4Rl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 07:22:22 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=</3w0nCFH/rqeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.115
country_id: 3865483
description:
Dec 30 07:22:36 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=179.0.252.115, lip=66.85.158.91, TLS, session=<PIL1myFH7ZCzAPxz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 07:24:36 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<rC85pCFH+kMjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.73
country_id: 3144096
description:
2025-12-30 07:26:06 dovecot_login authenticator failed for H=([62.97.161.73]) [62.97.161.73]:53101: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.46
country_id: 1269750
description:
2025-12-30 07:26:34 dovecot_login authenticator failed for H=([182.95.123.46]) [182.95.123.46]:46370: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.119
country_id: 2635167
description:
Dec 30 07:27:41 host2 dovecot[512723]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.119, lip=66.85.158.92, TLS, session=<6GRbryFHS8q594l3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.247
country_id: 2635167
description:
Dec 30 07:27:42 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.247, lip=66.85.158.92, TLS handshaking: Connection closed, session=<+KRtryFHn5ZX7LD3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.225
country_id: 2635167
description:
Dec 30 07:28:16 host2 dovecot[512723]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.225, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<9vxosSFHlbZX7LDh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.238
country_id: 2635167
description:
Dec 30 07:28:49 host2 dovecot[512723]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.238, lip=66.85.158.92, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<yI1ksyFH3b5X7LDu>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 30 07:30:09 host2 pure-ftpd[1390632]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.250
country_id: 2635167
description:
Dec 30 07:29:22 host2 dovecot[512723]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.250, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<edZftSFH856594n6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.229
country_id: 2635167
description:
Dec 30 07:29:55 host2 dovecot[512723]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.229, lip=66.85.158.92, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<XhJbtyFHP41X7LDl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.255.158.241
country_id: 1643084
description:
2025-12-30 07:30:55 dovecot_login authenticator failed for H=([101.255.158.242]) [101.255.158.241]:37021: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.245
country_id: 2635167
description:
Dec 30 07:31:02 host2 dovecot[512723]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.245, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<FCFSuyFHt4BX7LD1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.225
country_id: 2635167
description:
Dec 30 07:30:29 host2 dovecot[512723]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.225, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<hqlUuSFHt7G594nh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.250
country_id: 2635167
description:
Dec 30 07:31:35 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.250, lip=66.85.158.92, TLS handshaking: Connection closed, session=<r3NNvSFHB9W594n6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 30 07:31:49 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<2DD/vSFHTnho7MS0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 59.98.83.57
country_id: 1269750
description:
Dec 30 07:32:02 host2 sshd[1392133]: Disconnected from invalid user cvs 59.98.83.57 port 45646 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.251
country_id: 2635167
description:
Dec 30 07:32:08 host2 dovecot[512723]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.251, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<NORGvyFHg51X7LD7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.221.254.250
country_id: 783754
description:
2025-12-30 07:31:25 dovecot_login authenticator failed for H=([185.221.254.250]) [185.221.254.250]:40362: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.251
country_id: 2635167
description:
Dec 30 07:32:42 host2 dovecot[512723]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.251, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<fyxCwSFHz+1X7LD7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 59.98.83.57
country_id: 1269750
description:
Dec 30 07:34:03 host2 sshd[1393681]: Disconnected from invalid user netflow 59.98.83.57 port 45506 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 07:33:15 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<tocewyFH6oYv/AU1>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 59.98.83.57
country_id: 1269750
description:
Dec 30 07:34:47 host2 sshd[1394289]: Disconnected from invalid user ben 59.98.83.57 port 59210 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-30 07:35:43 dovecot_plain authenticator failed for H=(evarthous) [64.72.74.162]:54406: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.16
country_id: 241170
description:
Dec 30 07:35:54 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.16, lip=66.85.158.91, session=<lV2ezCFHNJrE+2YQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.253
country_id: 6252001
description:
Dec 30 07:36:11 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.253, lip=66.85.158.92, session=<ANG/zSFHJOPN0h/9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 30 07:36:44 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<1TiRzyFHZAWi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 30 07:36:51 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<+XL/zyFHxs2eRdGr>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.57.216.142
country_id: 1168579
description:
Dec 30 07:36:50 host2 sshd[1396420]: Disconnected from invalid user jacques 154.57.216.142 port 48532 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.90.207.105
country_id: 2750405
description:
Dec 30 07:37:54 host2 sshd[1397097]: Disconnected from invalid user kfserver 164.90.207.105 port 60970 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 30 07:38:03 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<+sJL1CFH7rOElEgp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.125.24.202
country_id: 3469034
description:
Dec 30 07:38:09 host2 sshd[1397316]: Disconnected from invalid user super 179.125.24.202 port 47406 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.90.207.105
country_id: 2750405
description:
Dec 30 07:38:25 host2 sshd[1397493]: Disconnected from invalid user site 164.90.207.105 port 45212 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.123.173
country_id: 1819730
description:
Dec 30 07:38:52 host2 sshd[1397834]: Disconnected from invalid user andrew 101.36.123.173 port 57586 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.123.173
country_id: 1819730
description:
Dec 30 07:39:28 host2 sshd[1398556]: Disconnected from invalid user jacques 101.36.123.173 port 41344 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 07:40:13 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<P9QP3CFHttKeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.4.45
country_id: 690791
description:
Dec 30 07:43:36 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=176.103.4.45, lip=66.85.158.91, TLS, session=<+mwm5yFHF7qwZwQt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.168.138.138
country_id: 3996063
description:
Dec 30 07:43:53 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<charanaw>, method=PLAIN, rip=201.168.138.138, lip=66.85.158.91, TLS, session=<h0xR6CFHJZ3JqIqK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 30 07:44:28 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<m+ZE6yFHFtcyBsPO>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 111.68.107.91
country_id: 1168579
description:
Dec 30 07:47:28 host2 sshd[1406710]: Disconnected from invalid user wagner 111.68.107.91 port 55506 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.5.238.101
country_id: 3175395
description:
2025-12-30 07:47:39 dovecot_login authenticator failed for H=host-87-5-238-101.retail.telecomitalia.it [87.5.238.101]:42168: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.253.226
country_id: 1269750
description:
2025-12-30 07:48:00 dovecot_login authenticator failed for H=(abts-kk-static-226.253.166.122.airtelbroadband.in) [122.166.253.226]:34314: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 07:48:39 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<+tM4+iFHks2nrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 30 07:49:42 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<NAP4/SFHUNh100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 30 07:49:45 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<hikp/iFHFK+eRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 30 07:54:11 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<V/T6DSJHbolCdMzo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 30 07:54:46 host2 dovecot[512723]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<rjIxECJH7OgDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 30 07:55:39 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<A5hYEyJHIoYDlTsa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 30 07:56:10 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<AvcTFSJH3q4v+wDY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 30 07:56:38 host2 dovecot[512723]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<duDeFiJHtp8DlTsa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 30 07:57:04 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<ItNMGCJH5tFn9M4G>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 30 07:57:22 host2 dovecot[512723]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<Dhl7GSJH+IwDlTsa>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 30 07:57:31 host2 sshd[1415494]: Disconnected from invalid user admin 2.57.121.112 port 20811 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.17
country_id: 241170
description:
Dec 30 07:58:32 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.17, lip=66.85.158.91, session=<TgSQHSJHTLrE+2YR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 30 07:58:39 host2 dovecot[512723]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<cGgZHiJHOqADlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 30 07:59:23 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<JoWuICJHhJMDlTsa>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 30 07:59:28 host2 dovecot[512723]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<djz+ICJHmpMDlTsa>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 30 08:00:11 host2 dovecot[512723]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<j3SPIyJHROwDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 30 08:00:57 host2 dovecot[512723]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<t6lLJiJHKIQDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 30 08:01:34 host2 dovecot[512723]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<4wiDKCJH2LkDlTsa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 30 08:02:02 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<IJoSKiJHaMSYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 30 08:03:07 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<tfXtLSJHhJUvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 30 08:02:27 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<+7SMKyJH1pNnmud6>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 13.59.117.27
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 13.59.117.27 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.195.194
country_id: 1819730
description:
2025-12-30 08:03:14 dovecot_login authenticator failed for H=(m121-202-195-194.smartone.com) [121.202.195.194]:37108: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.217.105
country_id: 1861060
description:
2025-12-30 08:03:58 dovecot_login authenticator failed for H=105.217.146.34.bc.googleusercontent.com [34.146.217.105]:33370: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.205.235.254
country_id: 2802361
description:
Dec 30 08:04:24 host2 pure-ftpd[1421308]: (?@35.205.235.254) [INFO] New connection from 35.205.235.254


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 08:06:32 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<8wckOiJHVI0jupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.211.156
country_id: 1269750
description:
2025-12-30 08:07:07 dovecot_login authenticator failed for H=(dhcp-192-211-156.in2cable.com) [203.192.211.156]:36992: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 30 08:07:24 host2 sshd[1424345]: Disconnected from invalid user thaddeus 62.60.131.157 port 14477 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.9.247.58
country_id: 3469034
description:
2025-12-30 08:07:36 dovecot_login authenticator failed for H=([186.238.157.140]) [187.9.247.58]:45927: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 30 08:08:42 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<x2HpQSJHjuyi8GQy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.154.125.60
country_id: 6251999
description:
Dec 30 08:09:13 host2 sshd[1425839]: Disconnected from invalid user shiny 66.154.125.60 port 49638 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 30 08:09:17 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<vGYDRCJH6URniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.152.40.8
country_id: 6252001
description:
Dec 30 08:10:50 host2 sshd[1427378]: Disconnected from invalid user arma3server 104.152.40.8 port 50132 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.152.40.8
country_id: 6252001
description:
Dec 30 08:11:36 host2 sshd[1427954]: Disconnected from invalid user peter 104.152.40.8 port 35840 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.181.142.219
country_id: 1643084
description:
Dec 30 08:11:44 host2 sshd[1428040]: Disconnected from invalid user mongo 103.181.142.219 port 43040 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.152.40.8
country_id: 6252001
description:
Dec 30 08:12:18 host2 sshd[1428496]: Disconnected from invalid user vinay 104.152.40.8 port 49712 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.152.40.8
country_id: 6252001
description:
Dec 30 08:13:35 host2 sshd[1429766]: Disconnected from invalid user buildbot 104.152.40.8 port 49188 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 142.93.212.130
country_id: 1269750
description:
Dec 30 08:13:20 host2 sshd[1429561]: Disconnected from invalid user ftpuser 142.93.212.130 port 52210 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.111.181.249
country_id: 3077311
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 172.111.181.249 - washeera@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 142.93.212.130
country_id: 1269750
description:
Dec 30 08:14:59 host2 sshd[1430787]: Disconnected from invalid user mongo 142.93.212.130 port 32964 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 66.154.125.60
country_id: 6251999
description:
Dec 30 08:15:37 host2 sshd[1431516]: Disconnected from invalid user team2 66.154.125.60 port 49880 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 142.93.212.130
country_id: 1269750
description:
Dec 30 08:15:38 host2 sshd[1431511]: Disconnected from invalid user alfresco 142.93.212.130 port 38224 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 30 08:15:57 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<e2rKWyJHRqtV6odu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 08:16:01 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<EGkWXCJH7KMzTcpt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.215.124
country_id: 1605651
description:
Dec 30 08:16:02 host2 sshd[1431825]: Disconnected from invalid user ubuntu 103.13.215.124 port 39594 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 08:15:51 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<50pzWyJHjoGnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 08:16:16 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<e9j3XCJHvJov/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.181.142.219
country_id: 1643084
description:
Dec 30 08:16:38 host2 sshd[1432318]: Disconnected from invalid user johannes 103.181.142.219 port 40056 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 142.93.212.130
country_id: 1269750
description:
Dec 30 08:16:56 host2 sshd[1432528]: Disconnected from invalid user elaine 142.93.212.130 port 50872 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 142.93.212.130
country_id: 1269750
description:
Dec 30 08:16:15 host2 sshd[1432024]: Disconnected from invalid user ocadmin 142.93.212.130 port 48032 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.181.142.219
country_id: 1643084
description:
Dec 30 08:17:33 host2 sshd[1432940]: Disconnected from invalid user builder 103.181.142.219 port 56714 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.72.57.84
country_id: 3469034
description:
Dec 30 08:18:07 host2 sshd[1433366]: Disconnected from invalid user ais 187.72.57.84 port 52196 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.72.57.84
country_id: 3469034
description:
Dec 30 08:18:55 host2 sshd[1434044]: Disconnected from invalid user system 187.72.57.84 port 59080 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 08:19:38 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<7LAAaSJHXoKeRdY+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.72.57.84
country_id: 3469034
description:
Dec 30 08:19:46 host2 sshd[1435146]: Disconnected from invalid user code87 187.72.57.84 port 37731 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 30 08:19:28 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<JglxaCJHXKAFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 08:20:32 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<8RoybCJHqtYzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 08:21:26 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<NBdzbyJHhs4jupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.80.61.151
country_id: 3017382
description:
Dec 30 08:21:56 host2 sshd[1437053]: Disconnected from invalid user deployer 151.80.61.151 port 39146 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.80.61.151
country_id: 3017382
description:
Dec 30 08:22:25 host2 sshd[1437460]: Disconnected from invalid user ftp_user 151.80.61.151 port 39190 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.215.124
country_id: 1605651
description:
Dec 30 08:22:52 host2 sshd[1437785]: Disconnected from invalid user ftp_user 103.13.215.124 port 39180 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.93.60.253
country_id: 3865483
description:
2025-12-30 08:24:06 dovecot_login authenticator failed for H=(host253.181-93-60.telecom.net.ar) [181.93.60.253]:52842: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.13.215.124
country_id: 1605651
description:
Dec 30 08:23:32 host2 sshd[1438370]: Disconnected from invalid user ftpuser 103.13.215.124 port 54760 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2025-12-30 08:23:48 dovecot_plain authenticator failed for H=c-71-235-225-181.hsd1.ct.comcast.net (vulacize) [71.235.225.181]:55054: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.215.124
country_id: 1605651
description:
Dec 30 08:24:15 host2 sshd[1439218]: Disconnected from invalid user u 103.13.215.124 port 40116 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.100.253
country_id: 1269750
description:
2025-12-30 08:24:38 dovecot_login authenticator failed for H=([122.170.100.253]) [122.170.100.253]:33789: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 151.80.61.151
country_id: 3017382
description:
Dec 30 08:25:20 host2 sshd[1440378]: Received disconnect from 151.80.61.151 port 39420:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.80.61.151
country_id: 3017382
description:
Dec 30 08:25:48 host2 sshd[1440791]: Disconnected from invalid user ubuntu 151.80.61.151 port 39460 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.80.61.151
country_id: 3017382
description:
Dec 30 08:26:17 host2 sshd[1441129]: Disconnected from invalid user k8s 151.80.61.151 port 39502 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.80.61.151
country_id: 3017382
description:
Dec 30 08:26:44 host2 sshd[1441455]: Disconnected from invalid user minecraft 151.80.61.151 port 39546 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 30 08:32:39 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<N5CUlyJHdMFo7MS0>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 30 08:32:44 host2 pure-ftpd[1446776]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 30 08:33:15 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<v4y3mSJHOtGi8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2025-12-30 08:35:30 dovecot_plain authenticator failed for H=c-73-195-211-98.hsd1.nj.comcast.net (preax) [73.195.211.98]:44514: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.45.196
country_id: 953987
description:
Dec 30 08:36:11 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=102.64.45.196, lip=66.85.158.91, TLS, session=<sBnyoiJH9J9mQC3E>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.249.241
country_id: 3865483
description:
Dec 30 08:36:41 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 25 secs): user=<env_eng>, method=PLAIN, rip=179.0.249.241, lip=66.85.158.91, TLS, session=<Bc6ipCJHRaizAPnx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 08:37:46 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<flfiqSJHwJCeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 08:37:51 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<dDwoqiJH8Lgv/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2025-12-30 08:38:20 dovecot_plain authenticator failed for H=(geonally) [24.104.225.201]:37065: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.85.150.173
country_id: 3923057
description:
2025-12-30 08:39:15 dovecot_login authenticator failed for H=(static-200-85-150173.vnet.bo) [200.85.150.173]:36184: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.157.177.33
country_id: 1733045
description:
Dec 30 08:42:37 host2 sshd[1455888]: Disconnected from invalid user andrey 202.157.177.33 port 51446 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.43.248.183
country_id: 1269750
description:
2025-12-30 08:43:47 dovecot_plain authenticator failed for H=(6S73LVD8) [49.43.248.183]:59061: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 30 08:46:02 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<M2VlxyJHZpd100Db>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.204.63.118
country_id: 2300660
description:
Dec 30 08:46:45 host2 sshd[1461260]: Disconnected from invalid user strapi 41.204.63.118 port 48922 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.242.166.38
country_id: 6252001
description:
Dec 30 08:46:14 host2 sshd[1460918]: Disconnected from invalid user partner 23.242.166.38 port 52878 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 30 08:46:22 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<9YSdyCJHWJWElEgp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.242.166.38
country_id: 6252001
description:
Dec 30 08:47:21 host2 sshd[1462158]: Disconnected from invalid user git 23.242.166.38 port 46952 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 23.242.166.38
country_id: 6252001
description:
Dec 30 08:48:29 host2 sshd[1463075]: Disconnected from invalid user josue 23.242.166.38 port 43070 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.157.177.33
country_id: 1733045
description:
Dec 30 08:48:36 host2 sshd[1463145]: Disconnected from invalid user ubuntu 202.157.177.33 port 55078 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.179.188.92
country_id: 6252001
description:
Dec 30 08:48:58 host2 sshd[1463543]: Disconnected from invalid user dev 66.179.188.92 port 47310 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.179.188.92
country_id: 6252001
description:
Dec 30 08:49:35 host2 sshd[1464032]: Disconnected from invalid user www 66.179.188.92 port 47560 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 30 08:51:05 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<XaF12SJHiM5n9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 30 08:50:27 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<xec11yJHlI4v+wDY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.204.63.118
country_id: 2300660
description:
Dec 30 08:50:43 host2 sshd[1465092]: Disconnected from invalid user ftp_user 41.204.63.118 port 37038 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 111.91.16.47
country_id: 1880251
description:
Dec 30 08:50:45 host2 sshd[1465131]: Disconnected from invalid user admin 111.91.16.47 port 53322 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.204.63.118
country_id: 2300660
description:
Dec 30 08:52:02 host2 sshd[1465913]: Disconnected from invalid user www 41.204.63.118 port 35812 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 30 08:51:13 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<Z5D32SJHzIcyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 30 08:54:07 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<cChQ5CJH+sKeRdGr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.130.212.59
country_id: 1643084
description:
2025-12-30 08:55:42 dovecot_login authenticator failed for H=([222.124.249.133]) [203.130.212.59]:50632: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 30 08:55:59 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<6dQA6yJHyplCdMzo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.40.45.223
country_id: 1861060
description:
2025-12-30 08:56:00 dovecot_login authenticator failed for H=p4095-ipbfpfx02osakakita.osaka.ocn.ne.jp [60.40.45.223]:64763: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.133.237.167
country_id: 130758
description:
Dec 30 08:56:05 host2 sshd[1469920]: Disconnected from invalid user test 85.133.237.167 port 39392 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 30 08:55:16 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<Iz9r6CJH9slnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.86.4
country_id: 6252001
description:
Dec 30 08:56:44 host2 sshd[1470468]: Disconnected from invalid user orca 198.12.86.4 port 52004 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.180
country_id: 99237
description:
2025-12-30 08:57:27 dovecot_login authenticator failed for H=([65.20.250.180]) [65.20.250.180]:54287: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.122
country_id: 1269750
description:
2025-12-30 08:57:55 dovecot_login authenticator failed for H=([182.95.178.122]) [182.95.178.122]:44456: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.12.86.4
country_id: 6252001
description:
Dec 30 08:58:15 host2 sshd[1471641]: Disconnected from invalid user denis 198.12.86.4 port 58966 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.97.24.41
country_id: 732800
description:
Dec 30 09:00:05 host2 sshd[1473617]: Disconnected from invalid user administrator 83.97.24.41 port 58408 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.47.10.77
country_id: 3469034
description:
Dec 30 09:00:32 host2 sshd[1474231]: Disconnected from invalid user mmm 189.47.10.77 port 45942 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.133.237.167
country_id: 130758
description:
Dec 30 09:00:38 host2 sshd[1474309]: Disconnected from invalid user vlad 85.133.237.167 port 38508 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.86.4
country_id: 6252001
description:
Dec 30 09:00:42 host2 sshd[1474373]: Disconnected from invalid user administrator 198.12.86.4 port 32910 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 83.97.24.41
country_id: 732800
description:
Dec 30 09:01:11 host2 sshd[1474808]: Disconnected from invalid user ss 83.97.24.41 port 41016 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 30 09:01:19 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<25sT/iJHqSVniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.164.228.242
country_id: 1605651
description:
Dec 30 09:01:23 host2 sshd[1475054]: Disconnected from invalid user odoo 110.164.228.242 port 36832 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.164.228.242
country_id: 1605651
description:
Dec 30 09:02:47 host2 sshd[1476162]: Disconnected from invalid user test 110.164.228.242 port 32776 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.146.196
country_id: 1643084
description:
Dec 30 09:02:10 host2 sshd[1475649]: Disconnected from invalid user administrator 103.187.146.196 port 54000 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 30 09:02:22 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<B73VASNHzKGi8GQy>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 85.133.237.167
country_id: 130758
description:
Dec 30 09:02:45 host2 sshd[1476131]: Disconnected from invalid user newuser 85.133.237.167 port 55586 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 09:03:42 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<ERaYBiNHGK4jupN+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.187.146.196
country_id: 1643084
description:
Dec 30 09:04:05 host2 sshd[1477365]: Disconnected from invalid user mika 103.187.146.196 port 60296 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.146.196
country_id: 1643084
description:
Dec 30 09:03:25 host2 sshd[1476827]: Disconnected from invalid user talha 103.187.146.196 port 42390 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.163.44.118
country_id: 1269750
description:
2025-12-30 09:05:46 dovecot_login authenticator failed for H=([103.163.44.118]) [103.163.44.118]:44012: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 30 09:07:14 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<Zds/EyNHxNKeRdGr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.192.123.12
country_id: 6252001
description:
2025-12-30 09:07:49 dovecot_plain authenticator failed for H=(shlobefett) [199.192.123.12]:46506: 535 Incorrect authentication data (set_id=admin@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.97.155.25
country_id: 6252001
description:
2025-12-30 09:07:52 dovecot_plain authenticator failed for H=c-76-97-155-25.hsd1.ga.comcast.net (unally) [76.97.155.25]:32892: 535 Incorrect authentication data (set_id=admin@ksoft.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.47.10.77
country_id: 3469034
description:
Dec 30 09:08:44 host2 sshd[1482096]: Disconnected from invalid user test 189.47.10.77 port 58292 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2025-12-30 09:08:19 dovecot_plain authenticator failed for H=c-73-183-74-177.hsd1.pa.comcast.net (untaness) [73.183.74.177]:41716: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 30 09:10:35 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<gn8zHyNHcoYvWBNS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2025-12-30 09:13:29 dovecot_login authenticator failed for H=([125.19.160.206]) [125.19.160.206]:52690: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.115.237.19
country_id: 3923057
description:
2025-12-30 09:14:10 dovecot_login authenticator failed for H=([181.115.237.19]) [181.115.237.19]:62803: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 30 09:15:18 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<QTYVMCNHvt1V6odu>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 30 09:16:11 host2 sshd[1488484]: Disconnected from invalid user admin 2.57.121.112 port 22905 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 09:17:17 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<cm8yNyNHRJ+eRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 09:18:35 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<PUHOOyNHhIIjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 30 09:20:04 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<U/oVQSNHVqCYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 09:20:40 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<Dxo/QyNH9Jkv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 09:20:59 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<lRNjRCNH3oQzTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.183.103.121
country_id: 2635167
description:
2025-12-30 09:22:48 dovecot_login authenticator failed for H=(185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:41306: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.84.34.85
country_id: 1210997
description:
2025-12-30 09:23:03 dovecot_login authenticator failed for H=(ppp075.bol-online.com) [202.84.34.85]:60094: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 30 09:23:14 host2 sshd[1495235]: Disconnected from invalid user user 2.57.121.25 port 29970 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.235
country_id: 6252001
description:
Dec 30 09:24:29 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=162.216.150.235, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<5qYPUSNHB92i2Jbr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 30 09:24:52 host2 sshd[1496613]: Disconnected from invalid user beatrice 62.60.131.157 port 40688 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 09:25:27 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<E9RbVCNHUu0zTcpt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.235
country_id: 6252001
description:
Dec 30 09:25:25 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 10 secs): user=<>, rip=162.216.150.235, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<EwxoVCNHQuOi2Jbr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 30 09:26:46 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<FZUQWSNHnrcFhXlo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 30 09:29:07 host2 dovecot[512723]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<fmmhYSNHzNcDlTsa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 30 09:29:39 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<gwxhYyNHEr+i8Jp9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 30 09:30:06 host2 dovecot[512723]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<ogojZSNHyMYDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 30 09:30:53 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<TI7xZyNH1OYDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 30 09:31:43 host2 dovecot[512723]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<V4XkaiNHJusDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.235
country_id: 6252001
description:
Dec 30 09:31:18 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.235, lip=66.85.158.92, TLS, session=<0vBraSNHKvSi2Jbr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 30 09:32:44 host2 dovecot[512723]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<Kl2ObiNHnssDlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.159
country_id: 3144096
description:
2025-12-30 09:34:03 dovecot_login authenticator failed for H=(cm-84.213.189.159.get.no) [84.213.189.159]:36390: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 30 09:34:07 host2 dovecot[512723]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<3AKAcyNHGK8DlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.73
country_id: 3144096
description:
2025-12-30 09:34:25 dovecot_login authenticator failed for H=(73-161-97-62.cust.smartcall.no) [62.97.161.73]:53077: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 30 09:34:56 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<o5lQdiNHDrho7MS0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 30 09:35:04 host2 dovecot[512723]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<phbpdiNH+oMDlTsa>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 30 09:36:04 host2 dovecot[512723]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<oTp9eiNHMrADlTsa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 09:35:15 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<N+FodyNHzMCeRdY+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 30 09:35:24 host2 pure-ftpd[1507251]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 30 09:35:29 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<9vleeCNHnJsDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 30 09:36:25 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<YM++eyNH2OcDlTsa>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 30 09:36:59 host2 dovecot[512723]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<H7PEfSNH1MkDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 30 09:38:03 host2 dovecot[512723]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<4q+KgSNHiNADlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 30 09:38:47 host2 dovecot[512723]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<DNg2hCNHNNgDlTsa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 09:40:51 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<Qm94iyNHupmnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 09:42:08 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<7I0HkCNHKKAv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 30 09:42:11 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<fxM7kCNHrzJ100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.0.250.125
country_id: 3469034
description:
Dec 30 09:43:10 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=170.0.250.125, lip=66.85.158.91, TLS, session=<XaLWkiNH0pSqAPp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.47.201
country_id: 2300660
description:
Dec 30 09:43:30 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=41.139.47.201, lip=66.85.158.91, TLS, session=<UND7kyNH254piy/J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 30 09:44:40 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<ySUVmSNHntwv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 30 09:45:13 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<uLobmyNHUrBn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.106.163.189
country_id: 6252001
description:
2025-12-30 09:46:02 dovecot_plain authenticator failed for H=c-76-106-163-189.hsd1.fl.comcast.net (prehotion) [76.106.163.189]:34330: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 30 09:48:42 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<+ceKpyNHXoVnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.15
country_id: 241170
description:
Dec 30 09:49:52 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.15, lip=66.85.158.91, session=<ifqmqyNHEK3E+2YP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 30 09:53:30 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<dY2suCNHdAhniu0S>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-30 09:53:45 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:62147: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.85
country_id: 1210997
description:
2025-12-30 09:55:20 dovecot_login authenticator failed for H=([103.115.252.60]) [103.115.252.85]:60243: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.72.41
country_id: 6252001
description:
Dec 30 09:55:29 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=132.148.72.41, lip=66.85.158.91, session=<g1K9vyNH4uSElEgp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.160
country_id: 1269750
description:
2025-12-30 09:55:36 dovecot_login authenticator failed for H=(nsg-corporate-160.229.187.122.airtel.in) [122.187.229.160]:53509: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 30 09:56:06 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<3qIAwiNHfuKi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 30 09:57:50 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<XxgsyCNHbN1CdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 30 09:58:16 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<l5O+ySNHzN4yBsPO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.192.74.183
country_id: 6252001
description:
2025-12-30 10:00:24 dovecot_plain authenticator failed for H=c-98-192-74-183.hsd1.ga.comcast.net (nackeabacs) [98.192.74.183]:35358: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 10:00:36 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<EJgd0iNHGu4jupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.21
country_id: 337996
description:
2025-12-30 10:01:03 dovecot_login authenticator failed for H=([196.188.187.21]) [196.188.187.21]:56034: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.204.232.244
country_id: 1269750
description:
2025-12-30 10:01:28 dovecot_login authenticator failed for H=(broadband.actcorp.in) [49.204.232.244]:55200: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.85.104.2
country_id: 6252001
description:
2025-12-30 10:01:58 dovecot_plain authenticator failed for H=(exual) [96.85.104.2]:39860: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.1.105.105
country_id: 1269750
description:
2025-12-30 10:07:20 dovecot_login authenticator failed for H=([61.1.105.105]) [61.1.105.105]:41612: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.122
country_id: 1269750
description:
2025-12-30 10:07:34 dovecot_login authenticator failed for H=([128.185.80.65]) [182.95.52.122]:57910: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.78
country_id: 1733045
description:
2025-12-30 10:07:43 dovecot_login authenticator failed for H=([49.125.201.78]) [49.125.201.78]:37802: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-12-30 10:07:51 dovecot_login authenticator failed for H=([196.191.212.235]) [213.55.85.202]:4015: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.251.104
country_id: 99237
description:
Dec 30 10:12:36 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=65.20.251.104, lip=66.85.158.91, TLS, session=<HEEV/CNHrJZBFPto>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 30 10:12:53 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<MzIC/iNHZKqeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.54.173
country_id: 953987
description:
Dec 30 10:12:56 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw>, method=PLAIN, rip=102.129.54.173, lip=66.85.158.91, TLS, session=<JCw7/SNH5+ZmgTat>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.253
country_id: 6252001
description:
Dec 30 10:14:09 host2 dovecot[512723]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.230.168.253, lip=66.85.158.91, session=<KgevAiRHMeNb5qj9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.120
country_id: 6252001
description:
Dec 30 10:14:20 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.230.168.120, lip=66.85.158.91, session=<QhlRAyRHXYlb5qh4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.248
country_id: 6252001
description:
Dec 30 10:14:33 host2 dovecot[512723]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=91.230.168.248, lip=66.85.158.91, session=<S+obBCRH8cBb5qj4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.253
country_id: 6252001
description:
Dec 30 10:14:36 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.230.168.253, lip=66.85.158.91, session=<gdBKBCRHG+Rb5qj9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 10:14:50 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<bNL8BCRHYpCeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 30 10:15:15 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<6FqABiRH/qhV6odu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 10:15:27 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<So0tByRHEFojupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 30 10:18:00 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<ulhNECRHxOQvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 10:25:09 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<postfix@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<UuazKSRHSJov/AU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 30 10:26:03 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<AKAHLSRHdIai8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 30 10:26:09 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<dO15LSRHQt2eRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 10:25:54 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<u6OVLCRHgJczTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.59.154
country_id: 1269750
description:
2025-12-30 10:26:39 dovecot_login authenticator failed for H=([182.95.25.48]) [182.95.59.154]:36388: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2025-12-30 10:26:47 dovecot_login authenticator failed for H=(AOzvnldl0) [158.94.208.110]:58822: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.222
country_id: 2186224
description:
2025-12-30 10:26:56 dovecot_login authenticator failed for H=([121.73.169.222]) [121.73.169.222]:46478: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.154
country_id: 1269750
description:
2025-12-30 10:27:06 dovecot_login authenticator failed for H=(nsg-corporate-1.193.187.122.airtel.in) [182.95.178.154]:48822: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 158.69.209.171
country_id: 6251999
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[158.69.209.171] [Remote Port]=[56642] [Authentication Database]=[mail] [Username]=[hr@bostonlanka.com] (10/10 failures) (blocked until [Wed Dec 31 04:56:07 2025 UTC/Wed Dec 31 10:26:07 2025 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.5.178.229
country_id: 3865483
description:
2025-12-30 10:27:16 dovecot_login authenticator failed for H=([186.5.178.229]) [186.5.178.229]:44684: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2025-12-30 10:27:35 dovecot_login authenticator failed for H=(pYk5f78WXT) [158.94.208.110]:64683: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.30.137
country_id: 290557
description:
2025-12-30 10:27:44 dovecot_login authenticator failed for H=([94.207.30.137]) [94.207.30.137]:36996: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2025-12-30 10:28:45 dovecot_login authenticator failed for H=(hp4UeP) [158.94.208.110]:56685: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.11
country_id: 241170
description:
Dec 30 10:29:01 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.11, lip=66.85.158.91, session=<2yOzNyRHxtHE+2YL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 10:30:23 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<JoehPCRHAskzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 10:32:44 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=</QoERSRH9I2eRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.241.132.152
country_id: 1269750
description:
2025-12-30 10:33:58 dovecot_login authenticator failed for H=([115.244.235.242]) [43.241.132.152]:46188: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 30 10:34:10 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<EvQbSiRHBskFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 30 10:34:34 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<3mGMSyRHTfl100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.82
country_id: 1269750
description:
2025-12-30 10:34:38 dovecot_login authenticator failed for H=([182.95.87.148]) [182.95.184.82]:48118: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.77
country_id: 2186224
description:
2025-12-30 10:34:20 dovecot_login authenticator failed for H=([121.73.162.77]) [121.73.162.77]:41866: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 30 10:36:19 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<29HUUSRHoO1o7MS0>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 30 10:37:55 host2 pure-ftpd[1562543]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 30 10:38:22 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<1RUlWSRHuKCYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 30 10:39:25 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<buHvXCRHsIhn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 30 10:39:30 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<wxwzXSRHNr0v+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 10:39:33 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<eoRhXSRHOIWnrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2025-12-30 10:40:44 dovecot_plain authenticator failed for H=c-24-127-53-61.hsd1.mi.comcast.net (poricora) [24.127.53.61]:35868: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 30 10:41:07 host2 sshd[1565399]: Disconnected from invalid user blair 62.60.131.157 port 24807 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 30 10:42:31 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<MHD5ZyRHgqlnmud6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.168
country_id: 6252001
description:
Dec 30 10:43:36 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.168, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<w/72ayRH1NXN0h+o>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 30 10:46:04 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<8ceudCRH7xFniu0S>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.17.38
country_id: 3469034
description:
2025-12-30 10:46:49 dovecot_login authenticator failed for H=([186.239.246.145]) [187.8.17.38]:58076: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 10:46:55 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<gM++dyRHyM0v/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.185.102.59
country_id: 294640
description:
2025-12-30 10:47:24 dovecot_login authenticator failed for H=([130.185.102.59]) [130.185.102.59]:37972: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 30 10:49:51 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<TuQ9giRHVLyi8GQy>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 93.185.162.12
country_id: 1643084
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 93.185.162.12 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.108
country_id: 6252001
description:
Dec 30 10:53:10 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=162.216.149.108, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<gl0ujiRHBsai2JVs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.108
country_id: 6252001
description:
Dec 30 10:54:05 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=162.216.149.108, lip=66.85.158.91, TLS: read(size=429) failed: Connection reset by peer, session=<QZ16kSRHzOCi2JVs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 10:57:42 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<LzlMniRHfKUjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.105
country_id: 3144096
description:
2025-12-30 10:57:53 dovecot_login authenticator failed for H=(105-170-97-62.cust.smartcall.no) [62.97.170.105]:43721: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.231.85.75
country_id: 2464461
description:
2025-12-30 10:58:37 dovecot_login authenticator failed for H=([41.231.85.75]) [41.231.85.75]:41658: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.108
country_id: 6252001
description:
Dec 30 10:58:44 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.108, lip=66.85.158.91, TLS, session=<XuUaoiRHXuai2JVs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 30 10:59:57 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<3R1JpiRHTpZCdMzo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.56.34.147
country_id: 6252001
description:
2025-12-30 11:00:12 dovecot_login authenticator failed for H=(136-56-34-147.googlefiber.net) [136.56.34.147]:55426: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.41.122
country_id: 1269750
description:
2025-12-30 11:00:33 dovecot_login authenticator failed for H=([125.23.243.66]) [125.23.41.122]:44228: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.157.95.30
country_id: 6251999
description:
2025-12-30 11:00:45 dovecot_login authenticator failed for H=d157-95-30.home4.cgocable.net [24.157.95.30]:55736: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.43.27
country_id: 3144096
description:
2025-12-30 11:00:30 dovecot_login authenticator failed for H=([178.232.43.27]) [178.232.43.27]:52623: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.36.108
country_id: 3932488
description:
2025-12-30 11:01:45 dovecot_login authenticator failed for H=([190.223.36.108]) [190.223.36.108]:43314: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.158
country_id: 1269750
description:
2025-12-30 11:02:15 dovecot_login authenticator failed for H=(nsg-corporate-199.152.185.122.airtel.in) [182.95.178.158]:44236: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.191.70.126
country_id: 6252001
description:
2025-12-30 11:04:35 dovecot_login authenticator failed for H=pool-71-191-70-126.washdc.fios.verizon.net [71.191.70.126]:54715: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.203.34.136
country_id: 6252001
description:
2025-12-30 11:04:38 dovecot_plain authenticator failed for H=c-98-203-34-136.hsd1.fl.comcast.net (flounwoofs) [98.203.34.136]:60168: 535 Incorrect authentication data (set_id=admin@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.87.18
country_id: 1269750
description:
2025-12-30 11:05:06 dovecot_login authenticator failed for H=([182.79.87.18]) [182.79.87.18]:36300: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 30 11:05:33 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<5WhhuiRHHJYyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 11:08:01 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<tdE4wyRHPq6nrKy4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.28.49.123
country_id: 6252001
description:
Dec 30 11:11:34 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=149.28.49.123, lip=66.85.158.91, TLS: Connection closed, session=<1QYC0CRHMpOVHDF7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.18
country_id: 241170
description:
Dec 30 11:14:25 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.18, lip=66.85.158.91, session=<aJwO2iRH7K7E+2YS>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 165.154.41.205
country_id: 1819730
description:
Dec 30 11:15:53 host2 dovecot[512723]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=165.154.41.205, lip=66.85.158.92, session=<pFt13yRH1KilminN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.41.205
country_id: 1819730
description:
Dec 30 11:15:52 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=165.154.41.205, lip=66.85.158.92, session=<pfVi3yRHyKelminN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 30 11:16:06 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<eCMT4CRHFtxV6odu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.23.68
country_id: 3144096
description:
2025-12-30 11:16:26 dovecot_login authenticator failed for H=([178.232.23.68]) [178.232.23.68]:42414: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.122.247
country_id: 3144096
description:
2025-12-30 11:16:41 dovecot_login authenticator failed for H=(cm-178.232.122.247.get.no) [178.232.122.247]:44753: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-12-30 11:21:17 dovecot_plain authenticator failed for H=(fidly) [12.150.243.22]:49453: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-30 11:22:17 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (arthy) [87.103.126.54]:42040: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2025-12-30 11:22:22 dovecot_plain authenticator failed for H=217-215-74-195-no2620.tbcn.telia.com (loglors) [217.215.74.195]:38318: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 30 11:22:34 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<67My9yRHcFWi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 30 11:26:39 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<skncBSVH3NYvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 30 11:27:54 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<inRGCiVHAv9100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 30 11:28:59 host2 sshd[1608545]: Disconnected from invalid user kori 62.60.131.157 port 8078 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.38
country_id: 1814991
description:
Dec 30 11:29:07 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=94.231.206.38, lip=66.85.158.91, session=<4HHJDiVHocNe584m>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.37
country_id: 1814991
description:
Dec 30 11:29:33 host2 dovecot[512723]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=94.231.206.37, lip=66.85.158.91, session=<nfZTECVHnaFe584l>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.35
country_id: 1814991
description:
Dec 30 11:29:37 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=94.231.206.35, lip=66.85.158.91, session=<pqGKECVH/cVe584j>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.109
country_id: 1814991
description:
Dec 30 11:29:18 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=94.231.206.109, lip=66.85.158.91, session=<PqFoDyVHC7Ze585t>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 11:30:44 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<+4llFCVH3sSeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 11:30:47 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<taaiFCVHcqcv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 11:31:31 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<u3s/FyVHYq0zTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2025-12-30 11:31:42 dovecot_login authenticator failed for H=(c-50-188-204-213.unallocated.comcastbusiness.net) [50.188.204.213]:49518: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-12-30 11:32:25 dovecot_login authenticator failed for H=([192.34.128.202]) [192.34.128.202]:56454: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.223.114
country_id: 1269750
description:
2025-12-30 11:34:05 dovecot_login authenticator failed for H=([182.95.193.177]) [182.95.223.114]:39290: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 30 11:33:21 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<udXJHSVH+qmeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 30 11:33:31 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<qixcHiVH5OVn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.12.244
country_id: 3144096
description:
2025-12-30 11:33:49 dovecot_login authenticator failed for H=(cm-84.211.12.244.get.no) [84.211.12.244]:44099: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 30 11:35:18 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<ddHGJCVHnJ0v+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 11:36:03 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<bNR1JyVHOIYzTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.163.219
country_id: 3144096
description:
2025-12-30 11:36:36 dovecot_login authenticator failed for H=(219-163-97-62.cust.smartcall.no) [62.97.163.219]:46435: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 30 11:36:44 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<dlTcKSVH1NRnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.53
country_id: 6251999
description:
2025-12-30 11:36:57 dovecot_login authenticator failed for H=([207.219.221.53]) [207.219.221.53]:59852: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 30 11:38:00 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<IyVtLiVHqppo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 30 11:38:37 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<us+dMCVHmztniu0S>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 30 11:40:39 host2 pure-ftpd[1617374]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 30 11:42:05 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 8 secs): user=<postfix@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<x9GkPCVHMN0FhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 30 11:44:04 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<9rkgRCVHqN2i8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 30 11:46:49 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<X57uTSVHxrOeRdGr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2025-12-30 11:46:19 dovecot_plain authenticator failed for H=c-67-172-54-29.hsd1.pa.comcast.net (deatisi) [67.172.54.29]:36174: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.248
country_id: 1269750
description:
Dec 30 11:48:57 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=103.18.166.248, lip=66.85.158.91, TLS, session=<4+l7VCVHoKlnEqb4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.30.181
country_id: 798544
description:
Dec 30 11:49:25 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<charanaw>, method=PLAIN, rip=178.216.30.181, lip=66.85.158.91, TLS, session=<U8ZhViVHcd6y2B61>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Dec 30 11:51:36 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.116.22, lip=66.85.158.92, TLS: Connection closed, session=<w+oqXyVHipqLonQW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 11:52:29 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<zKg8YiVHyswv/AU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.139
country_id: 6252001
description:
Dec 30 11:53:59 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.139, lip=66.85.158.92, TLS: Connection closed, session=<l8WwZyVHbtFChJmL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 11:56:00 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<aw7NbiVHIDAjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 30 11:57:36 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=</LiHdCVHWsmYNcU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2025-12-30 11:57:43 dovecot_plain authenticator failed for H=(labilly) [91.73.195.150]:33096: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.249.95
country_id: 798544
description:
Dec 30 12:02:10 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=109.125.249.95, lip=66.85.158.91, TLS, session=<+YP9gyVHgdZtfflf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 30 12:02:16 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<jX4uhSVHfoRCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.177.200.245
country_id: 3865483
description:
Dec 30 12:02:30 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=45.177.200.245, lip=66.85.158.91, TLS, session=<MtQVhSVHsu0tscj1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.190.246
country_id: 3017382
description:
Dec 30 12:05:09 host2 sshd[1636820]: Disconnected from invalid user vpnuser 54.38.190.246 port 44184 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.59.179.138
country_id: 3608932
description:
Dec 30 12:04:59 host2 sshd[1636477]: Disconnected from invalid user ubuntu 138.59.179.138 port 50120 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.48.144.62
country_id: 6252001
description:
Dec 30 12:05:39 host2 sshd[1637247]: Disconnected from invalid user blog 74.48.144.62 port 56008 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 54.38.190.246
country_id: 3017382
description:
Dec 30 12:05:41 host2 sshd[1637258]: Disconnected from invalid user dario 54.38.190.246 port 38260 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.59.179.138
country_id: 3608932
description:
Dec 30 12:07:30 host2 sshd[1638668]: Disconnected from invalid user sysadmin 138.59.179.138 port 52664 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.96
country_id: 6252001
description:
Dec 30 12:07:35 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.96, lip=66.85.158.91, session=<Z89bmCVH8u7G6xhg>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.59.179.138
country_id: 3608932
description:
Dec 30 12:08:04 host2 sshd[1639248]: Disconnected from invalid user andre 138.59.179.138 port 40382 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.190.246
country_id: 3017382
description:
Dec 30 12:07:13 host2 sshd[1638339]: Disconnected from invalid user ubuntu 54.38.190.246 port 38220 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 12:07:23 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<wTeIlyVHPNmnrKy4>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 74.48.144.62
country_id: 6252001
description:
Dec 30 12:09:11 host2 sshd[1640259]: Disconnected from invalid user ubuntu 74.48.144.62 port 45550 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 30 12:09:47 host2 sshd[1640858]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 12:10:37 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<xR0PoyVHbMWeRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.154
country_id: 3144096
description:
2025-12-30 12:10:50 dovecot_login authenticator failed for H=([84.213.189.154]) [84.213.189.154]:37642: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.237.107
country_id: 3144096
description:
2025-12-30 12:11:01 dovecot_login authenticator failed for H=(cm-178.232.237.107.get.no) [178.232.237.107]:48885: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 12:11:08 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<UojkpCVHAG4jupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.182.211.185
country_id: 6252001
description:
Dec 30 12:10:33 host2 dovecot[512723]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=147.182.211.185, lip=66.85.158.91, session=<KWb6oiVH+seTttO5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.105.158.35
country_id: 6252001
description:
Dec 30 12:10:33 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.105.158.35, lip=66.85.158.91, session=<6y3woiVH+KusaZ4j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.105.188.38
country_id: 1694008
description:
Dec 30 12:11:36 host2 sshd[1642615]: Disconnected from invalid user hyperspace 124.105.188.38 port 60408 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 124.105.188.38
country_id: 1694008
description:
Dec 30 12:12:32 host2 sshd[1643513]: Disconnected from invalid user test 124.105.188.38 port 36477 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.121
country_id: 6252001
description:
2025-12-30 12:13:35 dovecot_login authenticator failed for H=([209.23.72.121]) [209.23.72.121]:44040: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.80
country_id: 3144096
description:
2025-12-30 12:13:45 dovecot_login authenticator failed for H=(80-170-97-62.cust.smartcall.no) [62.97.170.80]:59708: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 30 12:13:15 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<MLF/rCVHzpEyBsPO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.105.188.38
country_id: 1694008
description:
Dec 30 12:15:31 host2 sshd[1646122]: Disconnected from invalid user administrator 124.105.188.38 port 51480 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 30 12:17:05 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<Fsk0uiVHjLRV6odu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.64
country_id: 6252001
description:
Dec 30 12:18:22 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.64, lip=66.85.158.92, TLS, session=<3KDnviVHovTN0h9A>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 30 12:19:13 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<3e/YwSVHfCyi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 30 12:20:45 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<cMpSxyVHCS9100Db>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.216.254.237
country_id: 2658434
description:
Dec 30 12:21:56 host2 pure-ftpd[1651427]: (?@35.216.254.237) [INFO] New connection from 35.216.254.237


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 35.216.254.237
country_id: 2658434
description:
Dec 30 12:22:00 host2 pure-ftpd[1651480]: (?@35.216.254.237) [INFO] New connection from 35.216.254.237


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.255.253.44
country_id: 6252001
description:
Dec 30 12:23:28 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=173.255.253.44, lip=66.85.158.91, session=<S+Iq0SVHYpSt//0s>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.206.226.233
country_id: 6252001
description:
Dec 30 12:26:35 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=172.206.226.233, lip=66.85.158.92, TLS handshaking: Connection closed, session=<dZ9M3CVHnKOszuLp>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 30 12:27:55 host2 sshd[1655864]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 30 12:27:44 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<M4pD4CVHWONn9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.188.177.46
country_id: 1643084
description:
Dec 30 12:28:16 host2 sshd[1656110]: Disconnected from invalid user stone 103.188.177.46 port 37646 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 12:28:35 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<rl1R4yVH9JueRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.76.142
country_id: 1269750
description:
2025-12-30 12:29:37 dovecot_login authenticator failed for H=([128.185.213.82]) [182.78.76.142]:50804: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.43.71.94
country_id: 3175395
description:
Dec 30 12:29:42 host2 sshd[1657133]: Disconnected from invalid user inssserver 151.43.71.94 port 30321 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.182.166.19
country_id: 3865483
description:
2025-12-30 12:29:49 dovecot_login authenticator failed for H=([190.182.166.19]) [190.182.166.19]:35956: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.193.141.133
country_id: 1269750
description:
Dec 30 12:29:50 host2 sshd[1657224]: Disconnected from invalid user viewtinet 20.193.141.133 port 1888 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 13.126.156.58
country_id: 1269750
description:
Dec 30 12:30:43 host2 sshd[1658131]: Disconnected from invalid user openproject 13.126.156.58 port 45664 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.193.141.133
country_id: 1269750
description:
Dec 30 12:30:50 host2 sshd[1658200]: Disconnected from invalid user user1 20.193.141.133 port 54945 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 30 12:31:06 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<9dFH7CVHBOwv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 30 12:30:39 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<gvO16iVHHLhnmud6>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.169.81.111
country_id: 6252001
description:
Dec 30 12:31:16 host2 pure-ftpd[1658537]: (?@20.169.81.111) [INFO] New connection from 20.169.81.111


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.193.141.133
country_id: 1269750
description:
Dec 30 12:31:26 host2 sshd[1658654]: Disconnected from invalid user steam 20.193.141.133 port 32739 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.100.208.88
country_id: 1819730
description:
Dec 30 12:31:51 host2 sshd[1658914]: Disconnected from invalid user ai 103.100.208.88 port 50126 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.239.5
country_id: 3144096
description:
2025-12-30 12:32:49 dovecot_login authenticator failed for H=(cm-178.232.239.5.get.no) [178.232.239.5]:49989: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.253.154
country_id: 1269750
description:
2025-12-30 12:33:01 dovecot_login authenticator failed for H=([182.78.122.253]) [125.19.253.154]:54562: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.100.208.88
country_id: 1819730
description:
Dec 30 12:32:35 host2 sshd[1659442]: Disconnected from invalid user user2 103.100.208.88 port 57045 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.104.176.233
country_id: 1880251
description:
Dec 30 12:33:56 host2 sshd[1660589]: Disconnected from invalid user umar 172.104.176.233 port 60062 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.63.25.203
country_id: 1643084
description:
Dec 30 12:34:13 host2 sshd[1660768]: Disconnected from invalid user kyle 103.63.25.203 port 60332 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 13.126.156.58
country_id: 1269750
description:
Dec 30 12:33:47 host2 sshd[1660450]: Disconnected from invalid user admin 13.126.156.58 port 54680 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.96.151.198
country_id: 3996063
description:
Dec 30 12:33:48 host2 sshd[1660483]: Disconnected from invalid user amber 186.96.151.198 port 36132 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 30 12:34:44 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<zlpS+SVHXB1niu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.61.39.36
country_id: 2921044
description:
Dec 30 12:34:58 host2 sshd[1661411]: Disconnected from invalid user admin 5.61.39.36 port 58850 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 30 12:35:08 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<z0XF+iVH+sgvWBNS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.96.151.198
country_id: 3996063
description:
Dec 30 12:34:18 host2 sshd[1660846]: Disconnected from invalid user sandeep 186.96.151.198 port 57880 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 13.126.156.58
country_id: 1269750
description:
Dec 30 12:34:22 host2 sshd[1660872]: Disconnected from invalid user ark 13.126.156.58 port 48158 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.141
country_id: 6252001
description:
Dec 30 12:35:26 host2 dovecot[512723]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 3 secs): user=<>, rip=66.132.153.141, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<pBz3+yVHxF1ChJmN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.98.91
country_id: 6252001
description:
Dec 30 12:36:08 host2 sshd[1662575]: Disconnected from invalid user ubuntu 101.36.98.91 port 57774 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 12:36:05 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<GQwq/iVHaLUv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.104.176.233
country_id: 1880251
description:
Dec 30 12:35:16 host2 sshd[1661818]: Disconnected from invalid user ftpuser 172.104.176.233 port 59476 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.235.21.125
country_id: 390903
description:
Dec 30 12:35:36 host2 sshd[1662135]: Disconnected from invalid user proxyuser 83.235.21.125 port 51950 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.63.25.203
country_id: 1643084
description:
Dec 30 12:35:40 host2 sshd[1662123]: Disconnected from invalid user rabbitmq 103.63.25.203 port 59434 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 12:36:13 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<gMyX/iVHxsinrKy4>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.63.223.138
country_id: 3469034
description:
Dec 30 12:37:05 host2 sshd[1663323]: Disconnected from invalid user testuser 201.63.223.138 port 52118 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.104.176.233
country_id: 1880251
description:
Dec 30 12:37:08 host2 sshd[1663360]: Disconnected from invalid user ubuntu 172.104.176.233 port 41708 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.154.217.188
country_id: 690791
description:
2025-12-30 12:37:48 dovecot_login authenticator failed for H=ip-d9bc.d-net.kiev.ua [94.154.217.188]:60544: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.219
country_id: 6252001
description:
Dec 30 12:37:32 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.219, lip=66.85.158.92, TLS, session=<M1duAyZHiO3G6xjb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.158
country_id: 1269750
description:
2025-12-30 12:37:38 dovecot_login authenticator failed for H=([182.95.26.52]) [182.95.185.158]:39276: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 12:37:20 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<ekCjAiZHuOQzTcpt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 30 12:38:15 host2 sshd[1664236]: Disconnected from invalid user admin 2.57.121.112 port 49280 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.112.79.252
country_id: 1643084
description:
Dec 30 12:38:49 host2 sshd[1664662]: Disconnected from invalid user tao 27.112.79.252 port 46758 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 30 12:38:29 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<rJjABiZHtrKi8GQy>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 5.61.39.36
country_id: 2921044
description:
Dec 30 12:38:45 host2 sshd[1664680]: Received disconnect from 5.61.39.36 port 49618:11: Bye Bye [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.230.135.52
country_id: 6252001
description:
Dec 30 12:39:52 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=173.230.135.52, lip=66.85.158.92, session=<TIjPCyZHrput5oc0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.104.70
country_id: 6252001
description:
Dec 30 12:40:02 host2 dovecot[512723]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.64.104.70, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<fMRlDCZHkrgUQGhG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.173.58.47
country_id: 6252001
description:
2025-12-30 12:39:40 dovecot_plain authenticator failed for H=c-67-173-58-47.hsd1.il.comcast.net (grakiling) [67.173.58.47]:42432: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 30 12:39:45 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<TOlCCyZHogpo7MS0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 67.205.134.167
country_id: 6252001
description:
Dec 30 12:39:53 host2 dovecot[512723]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=67.205.134.167, lip=66.85.158.92, session=<2yXZCyZH+OdDzYan>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.16.55
country_id: 3469034
description:
2025-12-30 12:40:13 dovecot_login authenticator failed for H=(177-174-16-55.user.vivozap.com.br) [177.174.16.55]:37291: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.98.91
country_id: 6252001
description:
Dec 30 12:39:33 host2 sshd[1665297]: Disconnected from invalid user admin 101.36.98.91 port 49136 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.104.176.233
country_id: 1880251
description:
Dec 30 12:39:35 host2 sshd[1665306]: Disconnected from invalid user admin 172.104.176.233 port 60606 [preauth]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 149.113.248.183
country_id: 1643084
description:
Denial of Service (DoS) attack was discovered from 149.113.248.183: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.78.55
country_id: 1819730
description:
2025-12-30 12:40:41 dovecot_login authenticator failed for H=(182.239.78.55.hk.chinamobile.com) [182.239.78.55]:27770: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.72.9.151
country_id: 1269750
description:
2025-12-30 12:40:56 dovecot_login authenticator failed for H=(9.72.116.151.hathway.com) [116.72.9.151]:60238: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.79.252
country_id: 1643084
description:
Dec 30 12:41:25 host2 sshd[1667699]: Disconnected from invalid user radio 27.112.79.252 port 35388 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.43.71.94
country_id: 3175395
description:
Dec 30 12:41:37 host2 sshd[1667947]: Disconnected from invalid user jenkins 151.43.71.94 port 30764 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 12:41:57 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<lkciEyZHOLIzTcpt>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 30 12:43:25 host2 pure-ftpd[1669243]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.43.71.94
country_id: 3175395
description:
Dec 30 12:43:35 host2 sshd[1669317]: Disconnected from invalid user publicftp 151.43.71.94 port 30526 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.43.71.94
country_id: 3175395
description:
Dec 30 12:44:33 host2 sshd[1669989]: Disconnected from invalid user user2 151.43.71.94 port 30242 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 30 12:50:04 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<lmAmMCZH/pcFhXlo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.98.166.120
country_id: 6252001
description:
Dec 30 12:51:51 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.98.166.120, lip=66.85.158.91, TLS handshaking: Connection closed, session=<jqqlNiZH8OYUYqZ4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.33.115.158
country_id: 6252001
description:
Dec 30 12:51:52 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=45.33.115.158, lip=66.85.158.92, session=<3Em7NiZH/K8tIXOe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 30 12:54:03 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=</jBnPiZHuoWeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 12:53:35 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<bNG0PCZHoIwjupN+>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.164.33.185
country_id: 690791
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 95.164.33.185 - v-deploy@v-deploy.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.102.163.237
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 191.102.163.237 - careers@v-deploy.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 12:58:09 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<O20UTSZHsrYv/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.21.28.14
country_id: 6252001
description:
2025-12-30 13:03:07 dovecot_plain authenticator failed for H=c-73-21-28-14.hsd1.ga.comcast.net (foring) [73.21.28.14]:49404: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 30 13:04:34 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<c+UIZCZHSr9CdMzo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 30 13:05:56 host2 sshd[1688310]: Disconnected from invalid user admin 2.57.121.112 port 27860 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 30 13:07:51 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<opfFbyZH7NqeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 13:08:17 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<GzFLcSZHhLOeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 13:08:38 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<jCiJciZHkKojupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.201.65
country_id: 2921044
description:
Dec 30 13:10:48 host2 dovecot[512723]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=46.101.201.65, lip=66.85.158.92, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<wUFxeiZHF7guZclB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 212.59.224.107
country_id: 798544
description:
Dec 30 13:11:04 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=212.59.224.107, lip=66.85.158.91, TLS, session=<nhdQeiZHAdnUO+Br>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.88.102.128
country_id: 2661886
description:
2025-12-30 13:10:15 dovecot_login authenticator failed for H=(128.102.88.80.sta.ac-net.se) [80.88.102.128]:48394: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.137.47.81
country_id: 6251999
description:
2025-12-30 13:10:16 dovecot_login authenticator failed for H=dhcp-4-bc-9f-52-e4-f.cpe.i-zoom.net [24.137.47.81]:56779: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.70.26
country_id: 294640
description:
2025-12-30 13:10:39 dovecot_login authenticator failed for H=([2.55.70.26]) [2.55.70.26]:34959: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2025-12-30 13:10:41 dovecot_plain authenticator failed for H=(inglic) [94.201.22.158]:41941: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.183.92.232
country_id: 3469034
description:
Dec 30 13:11:23 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw>, method=PLAIN, rip=45.183.92.232, lip=66.85.158.91, TLS, session=<cIR2eyZHNestt1zo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 209.38.222.129
country_id: 2921044
description:
Dec 30 13:11:24 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=209.38.222.129, lip=66.85.158.92, TLS handshaking: Connection closed, session=<OUaNfCZHlonRJt6B>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.29.49.93
country_id: 6252001
description:
Dec 30 13:14:04 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.29.49.93, lip=66.85.158.91, TLS handshaking: Connection closed, session=<NVIbhiZHnNcUHTFd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 30 13:14:33 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<5l+9hyZH0WN100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-30 13:16:18 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:61542: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 30 13:16:47 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<5Ma2jyZHTiqi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 30 13:18:33 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<Jw8JliZHWKqYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 30 13:18:53 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<t7IplyZHBOZV6odu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.142
country_id: 1269750
description:
2025-12-30 13:19:59 dovecot_login authenticator failed for H=([182.79.202.89]) [182.95.230.142]:55284: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-30 13:20:14 dovecot_login authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:56590: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 30 13:21:42 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<V9FCoSZHhKgyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 30 13:22:57 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<Km+7pSZHbJBn9M4G>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 30 13:23:59 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: Connection closed, session=<aYyXqSZHRrsDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 30 13:25:08 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<s6uTrSZH+rNnmud6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 30 13:25:47 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<BxYJsCZH3uwDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 13:26:24 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<N6wWsiZHRuKeRdY+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 30 13:26:43 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<ZBk4syZHlEZniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 30 13:27:42 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<19m1tiZHwMsv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.73.134
country_id: 6252001
description:
2025-12-30 13:29:50 dovecot_login authenticator failed for H=([209.23.73.134]) [209.23.73.134]:39448: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.194
country_id: 1269750
description:
2025-12-30 13:30:07 dovecot_login authenticator failed for H=([182.95.115.194]) [182.95.115.194]:32910: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 30 13:29:23 host2 dovecot[512723]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS, session=<zEjhvCZHaO0DjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 30 13:30:28 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: Connection closed, session=<+EDIwCZH/sADjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 30 13:31:16 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<ldidwyZHzLMDjyE/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 30 13:32:15 host2 sshd[1709512]: Disconnected from invalid user user 2.57.121.25 port 15648 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-30 13:32:55 dovecot_plain authenticator failed for H=host-196-47-172-253.afnet.net (enerlinted) [196.47.172.253]:38364: 535 Incorrect authentication data (set_id=admin@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 30 13:33:37 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed: read(size=772) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS: read(size=772) failed: Connection reset by peer, session=<hZsKzCZH+JQDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 30 13:33:28 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<tyFeyyZHPtmi8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.189
country_id: 1733045
description:
2025-12-30 13:33:37 dovecot_login authenticator failed for H=([49.124.148.189]) [49.124.148.189]:48098: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.118.162.194
country_id: 2453866
description:
2025-12-30 13:34:38 dovecot_login authenticator failed for H=([154.118.162.194]) [154.118.162.194]:3801: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 13:37:25 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<fJZ62SZHPuanrKy4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.183.66
country_id: 1269750
description:
2025-12-30 13:37:56 dovecot_login authenticator failed for H=([125.19.183.66]) [125.19.183.66]:53766: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.18
country_id: 1269750
description:
2025-12-30 13:38:09 dovecot_login authenticator failed for H=([182.95.58.18]) [182.95.58.18]:38034: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.144
country_id: 6252001
description:
2025-12-30 13:40:50 dovecot_login authenticator failed for H=([209.23.72.144]) [209.23.72.144]:58192: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.24
country_id: 1733045
description:
2025-12-30 13:41:05 dovecot_login authenticator failed for H=([49.124.153.24]) [49.124.153.24]:46234: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 30 13:41:32 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<jZQu6CZHzo5o7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 13:42:03 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<qcMR6iZHgqUv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 13:44:11 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<dwyz8SZHioAzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 30 13:45:17 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<bp6h9SZHyr4vWBNS>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 30 13:46:18 host2 pure-ftpd[1722415]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.13
country_id: 241170
description:
Dec 30 13:47:07 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.13, lip=66.85.158.91, session=<L8Qk/CZH2tjE+2YN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 13:48:50 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<7XpLAidH6s0zTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 13:51:20 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<v3FBCydHsKwjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.102.16.220
country_id: 3469034
description:
Dec 30 13:56:56 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=187.102.16.220, lip=66.85.158.91, TLS, session=</KJMHidHtK27ZhDc>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 30 13:57:57 host2 sshd[1732397]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.199
country_id: 3175395
description:
Dec 30 13:57:14 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.197.9.199, lip=66.85.158.91, TLS, session=<wzl6HydHHra5xQnH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 30 13:58:09 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<h9ygIydH8NQFhXlo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 30 13:58:21 host2 sshd[1732694]: Disconnected from invalid user yasmeen 62.60.131.157 port 9611 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.104.228.204
country_id: 1227603
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 212.104.228.204 - chinthana.rajapaksha@saara.lk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.23.199.107
country_id: 2921044
description:
Dec 30 14:02:03 host2 sshd[1735642]: Disconnected from invalid user ftpuser 193.23.199.107 port 56926 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.85
country_id: 6252001
description:
Dec 30 14:01:31 host2 pure-ftpd[1735230]: (?@205.210.31.85) [INFO] New connection from 205.210.31.85


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 14:04:03 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<oAK2OCdHPokv/AU1>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 193.23.199.107
country_id: 2921044
description:
Dec 30 14:04:43 host2 sshd[1737849]: Received disconnect from 193.23.199.107 port 49048:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.91.103.202
country_id: 6252001
description:
2025-12-30 14:05:26 dovecot_plain authenticator failed for H=c-24-91-103-202.hsd1.ma.comcast.net (forrate) [24.91.103.202]:37492: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 193.23.199.107
country_id: 2921044
description:
Dec 30 14:06:34 host2 sshd[1739307]: Disconnected from invalid user ftpuser2 193.23.199.107 port 48602 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 14:06:47 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<qFuEQidHVM2eRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 14:07:10 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<ka/bQydH/JCnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 14:06:19 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<JEjRQCdHrqAjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 30 14:06:21 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<L7HyQCdHStNCdMzo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.23.199.107
country_id: 2921044
description:
Dec 30 14:07:53 host2 sshd[1740373]: Disconnected from invalid user user10 193.23.199.107 port 34872 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 30 14:08:30 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<j5enSCdHMkt100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.235.248.73
country_id: 3469034
description:
2025-12-30 14:08:53 dovecot_login authenticator failed for H=(186.235.248.73.girardi-rs.com.br) [186.235.248.73]:49198: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.157.98.80
country_id: 453733
description:
2025-12-30 14:09:10 dovecot_login authenticator failed for H=80-98-157-37.dyn.estpak.ee [37.157.98.80]:39653: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.50.167.81
country_id: 1269750
description:
2025-12-30 14:13:51 dovecot_login authenticator failed for H=([36.50.167.81]) [36.50.167.81]:42748: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 30 14:14:21 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<syKWXSdHKpKi8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.143
country_id: 1819730
description:
2025-12-30 14:14:26 dovecot_login authenticator failed for H=(223-197-153-143.static.imsbiz.com) [223.197.153.143]:64599: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.29.135.63
country_id: 294640
description:
Dec 30 14:15:12 host2 sshd[1747099]: Disconnected from invalid user admin 5.29.135.63 port 39006 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 30 14:16:04 host2 sshd[1747948]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 30 14:16:53 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<OfKlZidHooieRdGr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2025-12-30 14:17:47 dovecot_plain authenticator failed for H=c-98-40-101-10.hsd1.tn.comcast.net (tratins) [98.40.101.10]:50040: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 30 14:17:58 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<gv6AaidH/Chniu0S>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 5.29.135.63
country_id: 294640
description:
Dec 30 14:17:58 host2 sshd[1749525]: Disconnected from invalid user ubuntu 5.29.135.63 port 38390 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.104.228.204
country_id: 1227603
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 212.104.228.204 - chiranthana.rajapaksha@saara.lk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 30 14:18:17 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<0yOiaydHuudn9M4G>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.7
country_id: 798549
description:
Dec 30 14:18:18 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.140.7, lip=66.85.158.92, session=<9zvPaydH5JZV2YwH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.10
country_id: 798549
description:
Dec 30 14:19:45 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.10, lip=66.85.158.92, TLS: Connection closed, session=<vekFcSdHjKFV2ZUK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 30 14:19:55 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<4uFycSdHJpFnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 30 14:19:55 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<km9/cSdHkKhV6odu>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.29.135.63
country_id: 294640
description:
Dec 30 14:19:29 host2 sshd[1750611]: Disconnected from invalid user git1 5.29.135.63 port 50628 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.208
country_id: 1733045
description:
2025-12-30 14:20:52 dovecot_login authenticator failed for H=([49.124.152.208]) [49.124.152.208]:41610: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 30 14:24:43 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<+cehgidHqKsv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 14:25:08 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<yLgdhCdH3NmeRdY+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 30 14:25:28 host2 sshd[1755098]: Disconnected from invalid user yasmeen 62.60.131.157 port 62292 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 30 14:26:16 host2 sshd[1755479]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.67.70.198
country_id: 1643084
description:
Dec 30 14:27:06 host2 sshd[1756161]: Disconnected from invalid user service 36.67.70.198 port 48804 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.106.63.80
country_id: 3469034
description:
Dec 30 14:28:00 host2 sshd[1756734]: Disconnected from invalid user wordpress 177.106.63.80 port 50028 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 30 14:28:08 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<XCXdjidHptOi8GQy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.106.63.80
country_id: 3469034
description:
Dec 30 14:27:15 host2 sshd[1756267]: Disconnected from invalid user photos 177.106.63.80 port 36112 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.19.156.18
country_id: 3932488
description:
Dec 30 14:27:49 host2 sshd[1756618]: Disconnected from invalid user aleks 38.19.156.18 port 50786 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.106.63.80
country_id: 3469034
description:
Dec 30 14:28:45 host2 sshd[1757349]: Disconnected from invalid user mac 177.106.63.80 port 35710 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.19.156.18
country_id: 3932488
description:
Dec 30 14:29:47 host2 sshd[1758022]: Disconnected from invalid user hadoopuser 38.19.156.18 port 36338 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.106.63.80
country_id: 3469034
description:
Dec 30 14:29:25 host2 sshd[1757818]: Disconnected from invalid user samp 177.106.63.80 port 49624 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.112
country_id: 3017382
description:
Dec 30 14:31:05 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.196.152.112, lip=66.85.158.92, TLS handshaking: Connection closed, session=<6mWKmSdHod9bxJhw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 30 14:31:07 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<vUyLmSdH+IKeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 30 14:30:28 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<niY8lydHppAyBsPO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.26
country_id: 3017382
description:
Dec 30 14:31:30 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=91.196.152.26, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<FasAmydHQdBbxJga>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.116
country_id: 3017382
description:
Dec 30 14:31:33 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.116, lip=66.85.158.92, TLS: Connection closed, session=<n/QwmydHl+NbxJh0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.142
country_id: 1269750
description:
2025-12-30 14:31:44 dovecot_login authenticator failed for H=([182.95.215.71]) [182.95.230.142]:36094: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.27
country_id: 3017382
description:
Dec 30 14:31:16 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.196.152.27, lip=66.85.158.92, TLS: Connection closed, session=<QfktmidHCZtbxJgb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.203
country_id: 3144096
description:
2025-12-30 14:31:26 dovecot_login authenticator failed for H=([84.211.13.203]) [84.211.13.203]:36264: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.67.70.198
country_id: 1643084
description:
Dec 30 14:32:25 host2 sshd[1759977]: Disconnected from invalid user sistemas 36.67.70.198 port 36020 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.116.31.97
country_id: 3017382
description:
Dec 30 14:32:47 host2 sshd[1760166]: Disconnected from invalid user lynx 89.116.31.97 port 59934 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.48
country_id: 3017382
description:
Dec 30 14:34:29 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.231.89.48, lip=66.85.158.92, TLS: Connection closed, session=<Bf61pSdH2Ydb51kw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.192
country_id: 3017382
description:
Dec 30 14:34:41 host2 dovecot[512723]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.231.89.192, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<hF5lpidHGcBb51nA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.50
country_id: 3017382
description:
Dec 30 14:34:44 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.231.89.50, lip=66.85.158.92, TLS: Connection closed, session=<epaVpidHzZ9b51ky>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.55
country_id: 3017382
description:
Dec 30 14:34:18 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.231.89.55, lip=66.85.158.92, TLS handshaking: Connection closed, session=<pHcRpSdHXdRb51k3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.223.75.89
country_id: 3469034
description:
Dec 30 14:35:39 host2 sshd[1763217]: Disconnected from invalid user hans 191.223.75.89 port 45372 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.223.75.89
country_id: 3469034
description:
Dec 30 14:36:42 host2 sshd[1763956]: Disconnected from invalid user paulo 191.223.75.89 port 29996 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-30 14:36:16 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (unsupous) [87.103.126.54]:16634: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 191.223.75.89
country_id: 3469034
description:
Dec 30 14:37:22 host2 sshd[1764444]: Disconnected from invalid user admin 191.223.75.89 port 43396 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Dec 30 14:39:07 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<ksZKtidHrumLonQW>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.123.7.15
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 23.123.7.15 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 82.23.183.33
country_id: 2921044
description:
Dec 30 14:39:35 host2 dovecot[512723]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=82.23.183.33, lip=66.85.158.92, session=<iDjttydHnMRSF7ch>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 30 14:40:01 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<KjVcuSdHrrqYNcU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.253.205
country_id: 1819730
description:
Dec 30 14:42:07 host2 sshd[1769379]: Disconnected from invalid user ftpuser 152.32.253.205 port 51200 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.23.180.137
country_id: 6252001
description:
Dec 30 14:42:55 host2 sshd[1770068]: Disconnected from invalid user harry 64.23.180.137 port 41024 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.93.207
country_id: 1880251
description:
Dec 30 14:43:06 host2 sshd[1770230]: Disconnected from invalid user radio 146.190.93.207 port 40186 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 30 14:43:09 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<d5qTxCdHEOFo7MS0>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.23.180.137
country_id: 6252001
description:
Dec 30 14:43:26 host2 sshd[1770526]: Disconnected from invalid user ubuntu 64.23.180.137 port 50886 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.93.207
country_id: 1880251
description:
Dec 30 14:43:49 host2 sshd[1770820]: Disconnected from invalid user temp 146.190.93.207 port 53716 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.252.16.238
country_id: 1269750
description:
Dec 30 14:45:09 host2 sshd[1772218]: Disconnected from invalid user ashish 117.252.16.238 port 54984 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 146.190.93.207
country_id: 1880251
description:
Dec 30 14:45:54 host2 sshd[1772963]: Disconnected from invalid user tao 146.190.93.207 port 60476 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.252.16.238
country_id: 1269750
description:
Dec 30 14:46:32 host2 sshd[1773841]: Disconnected from invalid user share 117.252.16.238 port 55376 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.132.180.118
country_id: 3932488
description:
Dec 30 14:47:45 host2 sshd[1774934]: Disconnected from invalid user cvs 161.132.180.118 port 7121 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.138
country_id: 6252001
description:
Dec 30 14:49:14 host2 dovecot[512723]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.138, lip=66.85.158.92, TLS: Connection closed, session=<yPR32idHfMlChJmK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 14:48:18 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<MTv71idHoLYv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.180.118
country_id: 3932488
description:
Dec 30 14:48:22 host2 sshd[1775525]: Disconnected from invalid user fmaster 161.132.180.118 port 7122 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.252.16.238
country_id: 1269750
description:
Dec 30 14:48:35 host2 sshd[1775693]: Disconnected from invalid user test 117.252.16.238 port 48488 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 14:48:39 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<VQxD2CdHsI8jupN+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 30 14:48:57 host2 pure-ftpd[1776069]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.253.205
country_id: 1819730
description:
Dec 30 14:49:06 host2 sshd[1776226]: Disconnected from invalid user temp 152.32.253.205 port 54002 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.138
country_id: 6252001
description:
Dec 30 14:49:17 host2 dovecot[512723]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=66.132.153.138, lip=66.85.158.92, session=<jcCg2idHoslChJmK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.99.60.75
country_id: 6252001
description:
Dec 30 14:50:53 host2 dovecot[512723]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=167.99.60.75, lip=66.85.158.92, TLS, session=<vAxg4CdHvLunYzxL>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 54.39.20.135
country_id: 6251999
description:
Dec 30 14:51:03 host2 sshd[1778308]: Disconnected from invalid user musikbot 54.39.20.135 port 52470 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 14:50:28 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<3vG13idHMt8zTcpt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.39.20.135
country_id: 6251999
description:
Dec 30 14:50:33 host2 sshd[1777750]: Disconnected from invalid user ftpadmin 54.39.20.135 port 32768 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.39.20.135
country_id: 6251999
description:
Dec 30 14:51:33 host2 sshd[1778810]: Disconnected from invalid user infra 54.39.20.135 port 42118 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 30 14:54:22 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<Y76w7CdHILIvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 30 14:54:55 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<b6Ot7idHXMwzTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.149.45
country_id: 3144096
description:
2025-12-30 14:55:48 dovecot_login authenticator failed for H=(cm-84.210.149.45.get.no) [84.210.149.45]:41835: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.151
country_id: 1733045
description:
2025-12-30 14:55:21 dovecot_login authenticator failed for H=([49.124.152.151]) [49.124.152.151]:43970: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.253.205
country_id: 1819730
description:
Dec 30 14:59:54 host2 sshd[1786821]: Disconnected from invalid user agotoz 152.32.253.205 port 50316 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.138.69
country_id: 1819730
description:
2025-12-30 15:00:36 dovecot_login authenticator failed for H=069.138.48.116.static.netvigator.com [116.48.138.69]:61360: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.98.8
country_id: 3144096
description:
2025-12-30 15:00:48 dovecot_login authenticator failed for H=(cm-84.215.98.8.get.no) [84.215.98.8]:55298: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 30 15:01:52 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<XEGCByhHVoR100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 15:03:37 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<EijLDShH9sojupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 30 15:04:58 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<3QGREihHUJgFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 15:04:52 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<04I/EihHpo+eRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-30 15:06:00 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (ouscreness) [87.103.126.54]:35105: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 30 15:08:13 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<OlEzHihH+s5CdMzo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 30 15:07:22 host2 sshd[1793980]: Disconnected from invalid user admin 2.57.121.112 port 17739 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.127.202.128
country_id: 6252001
description:
Dec 30 15:07:23 host2 pure-ftpd[1794028]: (?@20.127.202.128) [INFO] New connection from 20.127.202.128


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 30 15:09:12 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<CqC4IShHDQVniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 15:08:17 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@venee.lk>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<7k57HihHOOKnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 30 15:10:09 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<pe4iJShH7LMv/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.43.167
country_id: 337996
description:
2025-12-30 15:11:09 dovecot_login authenticator failed for H=([196.190.43.162]) [196.190.43.167]:51230: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2025-12-30 15:10:30 dovecot_login authenticator failed for H=bb121-6-81-59.singnet.com.sg [121.6.81.59]:46448: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 30 15:11:25 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<HNOvKShHBiui8Jp9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 30 15:12:16 host2 sshd[1798290]: Disconnected from invalid user glen 62.60.131.157 port 59645 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 30 15:13:11 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<qov1LyhHZJJn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 30 15:15:04 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<ctCwNihHKLVnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.234.135.110
country_id: 2635167
description:
Dec 30 15:21:09 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=85.234.135.110, lip=66.85.158.91, session=<oKdrTChHHrZV6odu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.192.85.86
country_id: 3175395
description:
2025-12-30 15:21:51 dovecot_login authenticator failed for H=([2.192.85.86]) [2.192.85.86]:41150: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Dec 30 15:21:50 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@nsteeleng.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<lgzrTihHno0v+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.255.26
country_id: 2661886
description:
2025-12-30 15:21:16 dovecot_login authenticator failed for H=94-255-255-26.cust.bredband2.com [94.255.255.26]:58304: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 30 15:21:36 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<R+8OTihHiOyi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 30 15:22:56 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<YlHaUihHUO2eRdY+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.15.119.12
country_id: 1605651
description:
Dec 30 15:23:50 host2 sshd[1807574]: Disconnected from invalid user panda 209.15.119.12 port 59064 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.251.32
country_id: 2661886
description:
Dec 30 15:25:48 host2 sshd[1808980]: Disconnected from invalid user arma3server 62.60.251.32 port 42664 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.206
country_id: 1269750
description:
2025-12-30 15:26:01 dovecot_login authenticator failed for H=([27.123.105.41]) [182.95.52.206]:46434: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 30 15:26:16 host2 sshd[1809276]: Disconnected from invalid user user 2.57.121.25 port 14666 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2025-12-30 15:26:17 dovecot_login authenticator failed for H=([125.18.154.73]) [182.95.226.118]:53896: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 82.23.183.33
country_id: 2921044
description:
Dec 30 15:26:47 host2 dovecot[512723]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=82.23.183.33, lip=66.85.158.91, session=<dlC3YChHEq9SF7ch>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.101.216.74
country_id: 1643084
description:
Dec 30 15:26:57 host2 sshd[1809659]: Disconnected from invalid user activemq 103.101.216.74 port 50462 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.15.119.12
country_id: 1605651
description:
Dec 30 15:27:04 host2 sshd[1809765]: Disconnected from invalid user mailer 209.15.119.12 port 34550 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.101.216.74
country_id: 1643084
description:
Dec 30 15:28:10 host2 sshd[1810661]: Disconnected from invalid user jack 103.101.216.74 port 52306 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.251.32
country_id: 2661886
description:
Dec 30 15:27:18 host2 sshd[1809911]: Disconnected from invalid user test3 62.60.251.32 port 49308 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.15.119.12
country_id: 1605651
description:
Dec 30 15:27:40 host2 sshd[1810103]: Disconnected from invalid user csgo 209.15.119.12 port 40706 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.15.119.12
country_id: 1605651
description:
Dec 30 15:28:15 host2 sshd[1810731]: Disconnected from invalid user couchdb 209.15.119.12 port 48296 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.60.251.32
country_id: 2661886
description:
Dec 30 15:28:34 host2 sshd[1811015]: Disconnected from invalid user admin1 62.60.251.32 port 59248 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.101.216.74
country_id: 1643084
description:
Dec 30 15:28:52 host2 sshd[1811268]: Disconnected from invalid user vps 103.101.216.74 port 34760 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.101.216.74
country_id: 1643084
description:
Dec 30 15:30:13 host2 sshd[1812616]: Disconnected from invalid user vbox 103.101.216.74 port 46086 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.46
country_id: 3865483
description:
2025-12-30 15:33:07 dovecot_login authenticator failed for H=([131.161.184.46]) [131.161.184.46]:48086: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.210.118
country_id: 1269750
description:
2025-12-30 15:33:24 dovecot_login authenticator failed for H=([152.52.210.118]) [152.52.210.118]:55772: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.172.172.184
country_id: 2921044
description:
Dec 30 15:37:00 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=167.172.172.184, lip=66.85.158.91, session=<pCEqhShHNsCnrKy4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 30 15:37:31 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<gVsEhyhH2qsyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 30 15:39:06 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<ZaynjChHDKeeRdGr>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 40.124.173.31
country_id: 6252001
description:
Dec 30 15:40:39 host2 pure-ftpd[1820927]: (?@40.124.173.31) [INFO] New connection from 40.124.173.31


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 30 15:43:39 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<+YTwnChHtpdo7MS0>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 30 15:45:51 host2 sshd[1824553]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 30 15:46:11 host2 dovecot[512723]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<OxAGpihHYKAjupN+>


