# incident

plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 00:42:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<YQWauJRHnMQjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.11.198
country_id: 690791
description:
Jan  5 00:43:51 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=176.103.11.198, lip=66.85.158.91, TLS, session=<kcsCvZRHrJSwZwvG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.11.228
country_id: 2300660
description:
Jan  5 00:44:13 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=41.139.11.228, lip=66.85.158.91, TLS, session=<az9LvpRHoKMpiwvk>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.45.112
country_id: 1880251
description:
Jan  5 00:53:49 host2 sshd[3840867]: Disconnected from invalid user michael 159.223.45.112 port 38080 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 95.0.252.5
country_id: 298795
description:
Jan  5 00:54:04 host2 sshd[3841225]: Disconnected from invalid user github-runner 95.0.252.5 port 60538 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 00:54:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<lvQH5ZRHsIZA46ZK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.45.112
country_id: 1880251
description:
Jan  5 00:54:39 host2 sshd[3842228]: Disconnected from invalid user gildata 159.223.45.112 port 32804 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.70.19.11
country_id: 3469034
description:
2026-01-05 00:56:00 dovecot_login authenticator failed for H=([45.70.19.11]) [45.70.19.11]:33677: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 174.138.59.242
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[174.138.59.242] [Remote Port]=[44708] [Authentication Database]=[mail] [Username]=[sales@anandaobauae.org] (10/10 failures) (blocked until [Mon Jan  5 19:26:19 2026 UTC/Tue Jan  6 00:56:19 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 00:56:21 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=</TTH6pRHpK6uijvy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.0.252.5
country_id: 298795
description:
Jan  5 00:56:28 host2 sshd[3844581]: Disconnected from invalid user mini 95.0.252.5 port 51844 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.45.112
country_id: 1880251
description:
Jan  5 00:56:46 host2 sshd[3844894]: Disconnected from invalid user claude 159.223.45.112 port 36702 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.142
country_id: 6252001
description:
Jan  5 00:56:53 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.142, lip=66.85.158.91, TLS: Connection closed, session=<nu7M7JRHetFChJmO>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  5 00:57:42 host2 sshd[3845925]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.114.73
country_id: 1168579
description:
2026-01-05 00:57:13 dovecot_login authenticator failed for H=([103.186.114.73]) [103.186.114.73]:46283: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 159.223.45.112
country_id: 1880251
description:
Jan  5 00:58:09 host2 sshd[3846346]: Disconnected from invalid user jacky 159.223.45.112 port 50412 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2026-01-05 01:02:51 dovecot_plain authenticator failed for H=c-24-15-216-41.hsd1.il.comcast.net (trize) [24.15.216.41]:42176: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2026-01-05 01:02:54 dovecot_plain authenticator failed for H=c-73-197-194-98.hsd1.nj.comcast.net (aphauts) [73.197.194.98]:56690: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.207.181
country_id: 6252001
description:
Jan  5 01:03:06 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.79.207.181, lip=66.85.158.92, session=<0XMDA5VHP6MtT8+1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 01:03:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<vhxMBZVHgLdnmud6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.8
country_id: 798549
description:
Jan  5 01:05:51 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=85.217.149.8, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<cBrbDJVHnMVV2ZUI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.224
country_id: 6252001
description:
Jan  5 01:07:37 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.224, lip=66.85.158.92, session=<T1MpE5VHbvnN0h/g>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 01:07:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<3SrSE5VH5pSOq2dI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.31.74
country_id: 1522867
description:
2026-01-05 01:09:23 dovecot_plain authenticator failed for H=2.135.31.74.dynamic.telecom.kz (esclism) [2.135.31.74]:52715: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.67
country_id: 6252001
description:
Jan  5 01:10:49 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.20.67, lip=66.85.158.92, session=<aY2VHpVHCDhBMRRD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.67
country_id: 6252001
description:
Jan  5 01:11:16 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=65.49.20.67, lip=66.85.158.92, session=<tkgzIJVH7HdBMRRD>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.29.135.63
country_id: 294640
description:
Jan  5 01:13:54 host2 sshd[3865161]: Disconnected from invalid user ubuntu 5.29.135.63 port 42196 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.29.135.63
country_id: 294640
description:
Jan  5 01:15:47 host2 sshd[3867574]: Disconnected from invalid user patrol 5.29.135.63 port 47840 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.29.135.63
country_id: 294640
description:
Jan  5 01:16:21 host2 sshd[3868279]: Disconnected from invalid user icinga 5.29.135.63 port 40598 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 01:16:42 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<8DWJM5VHyH0jupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.120.169
country_id: 2963597
description:
Jan  5 01:16:17 host2 sshd[3868200]: Disconnected from invalid user claude 20.123.120.169 port 42126 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 5.29.135.63
country_id: 294640
description:
Jan  5 01:17:29 host2 sshd[3869675]: Disconnected from invalid user admin 5.29.135.63 port 51708 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  5 01:18:25 host2 sshd[3870732]: Disconnected from invalid user admin 2.57.121.112 port 53614 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.120.169
country_id: 2963597
description:
Jan  5 01:19:44 host2 sshd[3872129]: Disconnected from invalid user claude 20.123.120.169 port 43158 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.123.120.169
country_id: 2963597
description:
Jan  5 01:20:18 host2 sshd[3872949]: Disconnected from invalid user ftptest 20.123.120.169 port 53348 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.195.138.52
country_id: 6252001
description:
2026-01-05 01:20:43 dovecot_plain authenticator failed for H=c-98-195-138-52.hsd1.tx.comcast.net (hallar) [98.195.138.52]:37470: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.208.106.186
country_id: 3175395
description:
Jan  5 01:21:06 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=185.208.106.186, lip=66.85.158.91, TLS, session=<q4ZrQpVHdeq50Gq6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.120.169
country_id: 2963597
description:
Jan  5 01:21:26 host2 sshd[3874141]: Disconnected from invalid user ubuntu 20.123.120.169 port 48606 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.32.117
country_id: 953987
description:
Jan  5 01:21:27 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw>, method=PLAIN, rip=102.64.32.117, lip=66.85.158.91, TLS, session=<VOKKQ5VHOotmQCB1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.190.155.43
country_id: 6252001
description:
2026-01-05 01:22:17 dovecot_plain authenticator failed for H=(devetrical) [76.190.155.43]:57573: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.67
country_id: 99237
description:
2026-01-05 01:23:15 dovecot_plain authenticator failed for H=(minge) [65.20.129.67]:48360: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 01:30:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<cTReZZVH3nOuijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 01:31:42 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<3xsmaZVHEMxA46ZK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.193
country_id: 6252001
description:
Jan  5 01:32:54 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.193, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<0RiZbZVHO8rN0h/B>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-05 01:33:55 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:54453: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.69.236.207
country_id: 3865483
description:
Jan  5 01:36:21 host2 sshd[3889307]: Disconnected from invalid user claude 200.69.236.207 port 47263 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.92.222
country_id: 1880251
description:
Jan  5 01:36:10 host2 sshd[3889151]: Disconnected from invalid user claude 178.128.92.222 port 47920 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  5 01:36:17 host2 pure-ftpd[3889261]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.195.66
country_id: 1269750
description:
2026-01-05 01:38:49 dovecot_login authenticator failed for H=([128.185.169.25]) [125.19.195.66]:52650: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.115.144.103
country_id: 3469034
description:
2026-01-05 01:39:02 dovecot_login authenticator failed for H=(191.34.253.17.dynamic.adsl.gvt.net.br) [187.115.144.103]:33479: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.92.222
country_id: 1880251
description:
Jan  5 01:38:27 host2 sshd[3891234]: Disconnected from invalid user claude 178.128.92.222 port 50430 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 178.128.92.222
country_id: 1880251
description:
Jan  5 01:39:53 host2 sshd[3892720]: Disconnected from invalid user claude 178.128.92.222 port 48934 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.69.236.207
country_id: 3865483
description:
Jan  5 01:39:11 host2 sshd[3891982]: Disconnected from invalid user test2 200.69.236.207 port 45958 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 01:40:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<6Y/rh5VHVNuOq2dI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.69.236.207
country_id: 3865483
description:
Jan  5 01:40:32 host2 sshd[3893709]: Disconnected from invalid user milad 200.69.236.207 port 59422 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 01:42:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<Kdb3j5VHerZnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.92.222
country_id: 1880251
description:
Jan  5 01:43:28 host2 sshd[3896350]: Disconnected from invalid user es1 178.128.92.222 port 42922 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.44.174.254
country_id: 357994
description:
2026-01-05 01:48:14 dovecot_plain authenticator failed for H=(breabic) [102.44.174.254]:43918: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.167
country_id: 6252001
description:
Jan  5 01:50:06 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.167, lip=66.85.158.92, TLS handshaking: Connection closed, session=<tA8dq5VHn9RBMQGn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.162
country_id: 6252001
description:
Jan  5 01:50:26 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.162, lip=66.85.158.92, TLS handshaking: Connection closed, session=<q1pIrJVH0B5BMQGi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 01:50:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shop@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<yr3srZVHcM8jupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.211.99.142
country_id: 6252001
description:
Jan  5 02:02:42 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=198.211.99.142, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<whQk2JVHWuLG02OO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 02:03:41 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<dPiD25VHFM2uijvy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.54.242.253
country_id: 2186224
description:
2026-01-05 02:05:53 dovecot_login authenticator failed for H=210-54-242-253.adsl.xtra.co.nz [210.54.242.253]:56762: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.68.220.15
country_id: 6252001
description:
2026-01-05 02:06:15 dovecot_plain authenticator failed for H=c-73-68-220-15.hsd1.ma.comcast.net (minda) [73.68.220.15]:46832: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.83.98
country_id: 1269750
description:
2026-01-05 02:06:43 dovecot_login authenticator failed for H=([182.71.132.193]) [182.79.83.98]:59690: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.100.41.198
country_id: 798549
description:
2026-01-05 02:07:00 dovecot_login authenticator failed for H=([109.100.41.198]) [109.100.41.198]:48197: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.50
country_id: 6252001
description:
Jan  5 02:07:04 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.50, lip=66.85.158.92, TLS: Connection closed, session=<zTDK55VHBkKnXpIy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2026-01-05 02:06:12 dovecot_plain authenticator failed for H=c-24-15-216-41.hsd1.il.comcast.net (choopedus) [24.15.216.41]:57840: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.50
country_id: 6252001
description:
Jan  5 02:07:12 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=167.94.146.50, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<5iw56JVH7K6nXpIy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 02:08:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<xerl65VH2I5A46ZK>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 157.245.122.12
country_id: 6252001
description:
Jan  5 02:12:01 host2 pure-ftpd[3924590]: (?@157.245.122.12) [INFO] New connection from 157.245.122.12


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2026-01-05 02:14:47 dovecot_plain authenticator failed for H=c-98-204-134-124.hsd1.md.comcast.net (nonaurs) [98.204.134.124]:56136: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.67
country_id: 6252001
description:
Jan  5 02:15:31 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=216.218.206.67, lip=66.85.158.91, session=<Ekz8BZZHkEDY2s5D>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 02:20:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<QP78FpZHaKxnmud6>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  5 02:23:54 host2 sshd[3937170]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  5 02:23:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<R05LI5ZH2rcFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 02:25:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<bxl9KJZHuGsjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-05 02:27:48 dovecot_plain authenticator failed for H=(untied) [64.72.74.162]:55804: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.207
country_id: 6252001
description:
Jan  5 02:28:46 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.207, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<1hlcNZZH9cyTuYTP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.104.9
country_id: 6252001
description:
Jan  5 02:30:53 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (disconnected before auth was ready, waited 0 secs): user=<>, rip=20.64.104.9, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<aT30PJZHEqEUQGgJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  5 02:36:16 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<MjIYUJZHFNoFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 02:37:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<AFwaVJZHGpuuijvy>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  5 02:39:42 host2 pure-ftpd[3955973]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.128
country_id: 6252001
description:
Jan  5 02:42:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.128, lip=66.85.158.91, TLS handshaking: Connection closed, session=<iH0mZZZHH4RAPpyA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.122
country_id: 6252001
description:
Jan  5 02:42:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.122, lip=66.85.158.91, TLS handshaking: Connection closed, session=<zP82ZpZHCqhAPpx6>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  5 02:43:23 host2 sshd[3960478]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.221.172.97
country_id: 1269750
description:
Jan  5 02:44:40 host2 sshd[3961691]: Disconnected from invalid user claude 117.221.172.97 port 39563 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 02:45:04 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<flqKb5ZHdJFA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 02:45:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<KyT3b5ZH1NKOq2dI>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 117.221.172.97
country_id: 1269750
description:
Jan  5 02:46:15 host2 sshd[3963682]: Disconnected from invalid user claude 117.221.172.97 port 56457 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.221.172.97
country_id: 1269750
description:
Jan  5 02:49:29 host2 sshd[3966927]: Disconnected from invalid user claude 117.221.172.97 port 37252 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.244
country_id: 6252001
description:
Jan  5 02:57:26 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.244, lip=66.85.158.91, TLS, session=<XmXpm5ZHROzN0h/0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.248.244.75
country_id: 2921044
description:
Jan  5 02:57:32 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=104.248.244.75, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<kDE8nJZHbKRo+PRL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 02:58:21 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<rVoGn5ZHkOhnmud6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.172.21
country_id: 6252001
description:
Jan  5 02:59:49 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:140943F2:SSL routines:ssl3_read_bytes:sslv3 alert unexpected message: SSL alert number 10 (no auth attempts in 0 secs): user=<>, rip=45.79.172.21, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:140943F2:SSL routines:ssl3_read_bytes:sslv3 alert unexpected message: SSL alert number 10, session=<mRNwpJZHWkctT6wV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 03:00:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<6FLvpJZHcu0jupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-05 03:01:39 dovecot_plain authenticator failed for H=(cerow) [64.72.74.162]:45374: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.46.17.63
country_id: 6252001
description:
Jan  5 03:06:14 host2 sshd[3985290]: Disconnected from invalid user dylan 37.46.17.63 port 35982 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.51.174.253
country_id: 3017382
description:
2026-01-05 03:06:19 dovecot_login authenticator failed for H=mastergateway.ville-saint-louis.fr [212.51.174.253]:63691: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.35.240
country_id: 2077456
description:
2026-01-05 03:06:35 dovecot_login authenticator failed for H=([101.168.35.240]) [101.168.35.240]:54204: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.65.229.156
country_id: 6252001
description:
Jan  5 03:08:37 host2 sshd[3987627]: Disconnected from invalid user elsearch 159.65.229.156 port 38684 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 03:11:04 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<Z5yHzJZH/qWuijvy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.65.229.156
country_id: 6252001
description:
Jan  5 03:11:20 host2 sshd[3990899]: Disconnected from invalid user oracle 159.65.229.156 port 35058 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 159.65.229.156
country_id: 6252001
description:
Jan  5 03:12:14 host2 sshd[3991995]: Disconnected from invalid user rms 159.65.229.156 port 40188 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.65.229.156
country_id: 6252001
description:
Jan  5 03:13:16 host2 sshd[3993346]: Disconnected from invalid user hari 159.65.229.156 port 52594 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.46.17.63
country_id: 6252001
description:
Jan  5 03:13:39 host2 sshd[3993755]: Disconnected from invalid user rms 37.46.17.63 port 57176 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.248.40.17
country_id: 6252001
description:
Jan  5 03:16:26 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 1 secs): user=<>, rip=52.248.40.17, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<UHPS35ZHQpo0+CgR>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 37.46.17.63
country_id: 6252001
description:
Jan  5 03:17:33 host2 sshd[3999102]: Disconnected from invalid user fsc 37.46.17.63 port 54118 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 03:18:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<FEqE5ZZHeMqOq2dI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2026-01-05 03:20:33 dovecot_plain authenticator failed for H=c-73-137-7-97.hsd1.ga.comcast.net (wanteryst) [73.137.7.97]:41346: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.56.103.154
country_id: 6252001
description:
Jan  5 03:20:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.56.103.154, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Sma575ZHNoItOGea>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 03:22:08 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<7yUa9JZHFr5A46ZK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.168.136
country_id: 1269750
description:
2026-01-05 03:26:52 dovecot_login authenticator failed for H=([203.193.168.136]) [203.193.168.136]:49266: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.172.189.13
country_id: 3017382
description:
[2026-01-05 03:30:33 +0530] info [cpaneld] 217.172.189.13 - lezzarotech "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  5 03:31:53 host2 sshd[4017556]: Disconnected from invalid user admin 2.57.121.112 port 54770 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 03:35:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<iAewIpdHmrQjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 03:36:41 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<FaseKJdHjOVnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2026-01-05 03:39:40 dovecot_login authenticator failed for H=([128.185.18.217]) [122.185.176.126]:40130: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.237.113.106
country_id: 587116
description:
2026-01-05 03:39:58 dovecot_login authenticator failed for H=([109.237.113.106]) [109.237.113.106]:43348: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  5 03:42:59 host2 pure-ftpd[4029385]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.157.219.158
country_id: 6252001
description:
2026-01-05 03:43:02 dovecot_plain authenticator failed for H=c-76-157-219-158.hsd1.il.comcast.net (oversh) [76.157.219.158]:45994: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.174
country_id: 732800
description:
2026-01-05 03:43:07 dovecot_plain authenticator failed for H=(unshersia) [92.62.243.174]:59643: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.251.121.70
country_id: 1861060
description:
2026-01-05 03:43:42 dovecot_login authenticator failed for H=works.ssc-gr.info [160.251.121.70]:44550: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.242
country_id: 2186224
description:
2026-01-05 03:44:11 dovecot_login authenticator failed for H=([121.73.162.242]) [121.73.162.242]:58542: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 03:45:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<CtieRpdHQI6uijvy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.167
country_id: 2993457
description:
Jan  5 03:49:54 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.167, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<s3OFV5dHDv7CpRCn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 03:51:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<Ft8CXZdH6OCOq2dI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2026-01-05 03:51:39 dovecot_plain authenticator failed for H=c-98-40-101-10.hsd1.tn.comcast.net (rariverict) [98.40.101.10]:55190: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2026-01-05 03:54:00 dovecot_plain authenticator failed for H=(trinonania) [94.201.22.158]:59409: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.214.92.14
country_id: 6252001
description:
Jan  5 03:54:34 host2 sshd[4044032]: Disconnected from invalid user www-data 162.214.92.14 port 60540 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-05 03:55:22 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (unnon) [87.103.126.54]:32049: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 192.155.90.220
country_id: 6252001
description:
Jan  5 03:56:21 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=192.155.90.220, lip=66.85.158.91, session=<NtWabpdHuBHAm1rc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.214.92.14
country_id: 6252001
description:
Jan  5 03:57:23 host2 sshd[4047474]: Disconnected from invalid user myadmin 162.214.92.14 port 43676 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.155.21.198
country_id: 1819730
description:
Jan  5 03:58:15 host2 sshd[4048458]: Disconnected from invalid user satis 43.155.21.198 port 38922 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 03:59:02 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<KjkVeJdHUrpA46ZK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.155.21.198
country_id: 1819730
description:
Jan  5 03:59:30 host2 sshd[4049740]: Disconnected from invalid user richard 43.155.21.198 port 36788 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.52
country_id: 6252001
description:
Jan  5 04:07:26 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.52, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<NC02lpdHqd+TuYQ0>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  5 04:08:11 host2 sshd[4061752]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.211
country_id: 6252001
description:
Jan  5 04:08:32 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.211, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<0v4smpdHx8DG6xjT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 04:09:47 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<lJGLnpdHWDgjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.193.18.148
country_id: 660013
description:
Jan  5 04:11:47 host2 sshd[4067784]: Disconnected from invalid user ubuntu 212.193.18.148 port 45728 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 04:14:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<qtLlrpdHBNJnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.215.228.18
country_id: 298795
description:
Jan  5 04:14:28 host2 sshd[4071959]: Disconnected from invalid user test 81.215.228.18 port 52936 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.193.18.148
country_id: 660013
description:
Jan  5 04:15:15 host2 sshd[4073161]: Disconnected from invalid user ubuntu 212.193.18.148 port 59590 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 81.215.228.18
country_id: 298795
description:
Jan  5 04:15:31 host2 sshd[4073653]: Disconnected from invalid user claude 81.215.228.18 port 48012 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.117
country_id: 1643084
description:
Jan  5 04:16:07 host2 sshd[4074466]: Disconnected from invalid user taiga 103.171.85.117 port 47396 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.190.155.43
country_id: 6252001
description:
2026-01-05 04:15:46 dovecot_plain authenticator failed for H=(esess) [76.190.155.43]:55488: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.31.39.143
country_id: 1643084
description:
Jan  5 04:16:48 host2 sshd[4075444]: Disconnected from invalid user cinema 103.31.39.143 port 55842 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.171.85.117
country_id: 1643084
description:
Jan  5 04:17:41 host2 sshd[4076944]: Disconnected from invalid user claude 103.171.85.117 port 41132 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.31.39.143
country_id: 1643084
description:
Jan  5 04:17:36 host2 sshd[4076881]: Disconnected from invalid user claude 103.31.39.143 port 39066 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.117
country_id: 1643084
description:
Jan  5 04:18:28 host2 sshd[4077894]: Disconnected from invalid user jagdish 103.171.85.117 port 46868 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 04:18:41 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<xTJUvpdHpJauijvy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.93
country_id: 2750405
description:
Jan  5 04:18:45 host2 sshd[4078351]: Disconnected from invalid user bitnami 20.123.146.93 port 49508 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.117
country_id: 1643084
description:
Jan  5 04:19:09 host2 sshd[4078761]: Disconnected from invalid user yaya 103.171.85.117 port 60486 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.228.53.204
country_id: 6252001
description:
Jan  5 04:19:28 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=66.228.53.204, lip=66.85.158.92, TLS, session=<xkFHwZdHtvpC5DXM>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.94
country_id: 2750405
description:
Jan  5 04:19:39 host2 sshd[4079584]: Disconnected from invalid user mis 20.123.146.94 port 24810 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.193.18.148
country_id: 660013
description:
Jan  5 04:20:46 host2 sshd[4081592]: Disconnected from invalid user mac 212.193.18.148 port 47308 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.193.18.148
country_id: 660013
description:
Jan  5 04:22:17 host2 sshd[4083634]: Disconnected from invalid user ftpuser 212.193.18.148 port 43056 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.210.186.201
country_id: 2750405
description:
Jan  5 04:23:20 host2 sshd[4085162]: Disconnected from invalid user contas 4.210.186.201 port 53944 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 04:23:49 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<y3a60JdHPpiOq2dI>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 142.171.103.72
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[142.171.103.72] [Remote Port]=[38974] [Authentication Database]=[mail] [Username]=[no-reply@anandaobauae.org] (10/10 failures) (blocked until [Mon Jan  5 22:53:47 2026 UTC/Tue Jan  6 04:23:47 2026 LOCAL])


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.64.179
country_id: 1269750
description:
Jan  5 04:25:39 host2 sshd[4088439]: Disconnected from invalid user smile 139.59.64.179 port 52956 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.185.168.78
country_id: 3469034
description:
Jan  5 04:26:16 host2 sshd[4089301]: Disconnected from invalid user ubuntu 191.185.168.78 port 37886 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.24.183.76
country_id: 6252001
description:
2026-01-05 04:27:22 dovecot_login authenticator failed for H=(173-24-183-76.client.mchsi.com) [173.24.183.76]:57456: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.185.168.78
country_id: 3469034
description:
Jan  5 04:27:40 host2 sshd[4091675]: Disconnected from invalid user claude 191.185.168.78 port 57002 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.145.54
country_id: 1269750
description:
2026-01-05 04:27:43 dovecot_login authenticator failed for H=([128.185.135.33]) [122.185.145.54]:55348: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  5 04:28:11 host2 sshd[4092676]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.19.77
country_id: 3932488
description:
Jan  5 04:28:53 host2 sshd[4094530]: Disconnected from invalid user ftpuser 161.132.19.77 port 50872 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 130.250.191.230
country_id: 1269750
description:
Jan  5 04:28:55 host2 sshd[4094604]: Disconnected from invalid user sims 130.250.191.230 port 53682 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 191.185.168.78
country_id: 3469034
description:
Jan  5 04:28:21 host2 sshd[4092903]: Disconnected from invalid user readonly 191.185.168.78 port 40444 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-05 04:28:31 dovecot_plain authenticator failed for H=(shnudono) [64.72.74.162]:51671: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-05 04:28:35 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (hiatheg) [87.103.126.54]:34127: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 51.83.164.92
country_id: 3017382
description:
Jan  5 04:29:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=51.83.164.92, lip=66.85.158.92, session=<fIuw5JdH9YAzU6Rc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.93
country_id: 2750405
description:
Jan  5 04:29:10 host2 sshd[4095020]: Disconnected from invalid user indra 20.123.146.93 port 39069 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.93
country_id: 2750405
description:
Jan  5 04:30:57 host2 sshd[4097982]: Disconnected from invalid user leonard 20.123.146.93 port 59542 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.212
country_id: 2635167
description:
Jan  5 04:31:03 host2 dovecot[1170291]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.212, lip=66.85.158.91, TLS, session=<yNyx6pdHg4tX7LDU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.19.77
country_id: 3932488
description:
Jan  5 04:31:46 host2 sshd[4099169]: Disconnected from invalid user k8s 161.132.19.77 port 44240 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 139.59.64.179
country_id: 1269750
description:
Jan  5 04:31:18 host2 sshd[4098621]: Disconnected from invalid user claude 139.59.64.179 port 56328 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.19.77
country_id: 3932488
description:
Jan  5 04:32:23 host2 sshd[4099815]: Disconnected from invalid user ubuntu 161.132.19.77 port 45306 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 130.250.191.230
country_id: 1269750
description:
Jan  5 04:32:45 host2 sshd[4100104]: Disconnected from invalid user debian 130.250.191.230 port 59240 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.93
country_id: 2750405
description:
Jan  5 04:32:48 host2 sshd[4100118]: Disconnected from invalid user claude 20.123.146.93 port 28412 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.248
country_id: 1880251
description:
Jan  5 04:32:55 host2 sshd[4100256]: Disconnected from invalid user claude 45.78.201.248 port 50074 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 130.250.191.230
country_id: 1269750
description:
Jan  5 04:33:24 host2 sshd[4100802]: Disconnected from invalid user testuser 130.250.191.230 port 52672 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.140.19.22
country_id: 1269750
description:
Jan  5 04:34:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colourmarklabels.com>, method=PLAIN, rip=103.140.19.22, lip=66.85.158.91, session=<vBpi95dHgthnjBMW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.248
country_id: 1880251
description:
Jan  5 04:35:30 host2 sshd[4103328]: Disconnected from invalid user smile 45.78.201.248 port 36668 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.95
country_id: 2750405
description:
Jan  5 04:36:27 host2 sshd[4104139]: Disconnected from invalid user guest2 20.123.146.95 port 4718 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.201.248
country_id: 1880251
description:
Jan  5 04:38:03 host2 sshd[4105812]: Disconnected from invalid user ubuntu 45.78.201.248 port 58138 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.4
country_id: 798549
description:
Jan  5 04:39:49 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=85.217.140.4, lip=66.85.158.92, TLS, session=<eCsTCphHVrRV2YwE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.92
country_id: 2750405
description:
Jan  5 04:39:55 host2 sshd[4107440]: Disconnected from invalid user ana 20.123.146.92 port 61209 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.4
country_id: 798549
description:
Jan  5 04:40:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=85.217.140.4, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<bu7sC5hHiLxV2YwE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 04:40:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<7JLiC5hHJr1A46ZK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.248
country_id: 1880251
description:
Jan  5 04:40:31 host2 sshd[4108538]: Disconnected from invalid user hoster 45.78.201.248 port 40918 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.14
country_id: 798549
description:
Jan  5 04:41:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.140.14, lip=66.85.158.92, session=<JoXVEJhHQOhV2YwO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.123.109.114
country_id: 732800
description:
Jan  5 04:42:14 host2 sshd[4110202]: Invalid user sivagnanamfoundation from 93.123.109.114 port 50860


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 04:42:47 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<DCuQFJhHXrcjupN+>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 35.186.147.126
country_id: 1880251
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[35.186.147.126] [Remote Port]=[46942] [Authentication Database]=[mail] [Username]=[postfix@anandaobauae.org] (10/10 failures) (blocked until [Mon Jan  5 23:12:45 2026 UTC/Tue Jan  6 04:42:45 2026 LOCAL])


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  5 04:46:20 host2 pure-ftpd[4114969]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-05 04:49:28 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:53921: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 04:50:29 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<ZhMVMJhHTliuijvy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.158.162.24
country_id: 2510769
description:
Jan  5 04:50:51 host2 sshd[4119644]: Disconnected from invalid user user5 146.158.162.24 port 47576 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 04:51:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<O9ZvMphHMpJnmud6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.156
country_id: 3703430
description:
Jan  5 04:52:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.227.254.156, lip=66.85.158.91, session=<Zdp/NphHev8t4/6c>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 04:55:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<rntqQZhHTLyOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.140.19.22
country_id: 1269750
description:
Jan  5 04:55:39 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=103.140.19.22, lip=66.85.158.91, session=<H2mNQphHaqJnjBMW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.158.162.24
country_id: 2510769
description:
Jan  5 04:55:46 host2 sshd[4125380]: Disconnected from invalid user oracle 146.158.162.24 port 39990 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 146.158.162.24
country_id: 2510769
description:
Jan  5 04:56:24 host2 sshd[4126039]: Disconnected from invalid user test2 146.158.162.24 port 51710 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.92
country_id: 2750405
description:
Jan  5 04:57:09 host2 sshd[4126666]: Disconnected from invalid user pagar 20.123.146.92 port 2982 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.161.207.2
country_id: 1643084
description:
Jan  5 04:59:18 host2 sshd[4128551]: Disconnected from invalid user admin 103.161.207.2 port 51200 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2026-01-05 05:01:07 dovecot_plain authenticator failed for H=(colorptice) [91.73.188.251]:42296: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.8.155
country_id: 3175395
description:
Jan  5 05:01:39 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=185.197.8.155, lip=66.85.158.91, TLS, session=<3j8vV5hH49+5xQib>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.161.207.2
country_id: 1643084
description:
Jan  5 05:02:03 host2 sshd[4131142]: Disconnected from invalid user claude 103.161.207.2 port 49062 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.181.167.52
country_id: 3865483
description:
Jan  5 05:02:07 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info>, method=PLAIN, rip=45.181.167.52, lip=66.85.158.91, TLS, session=<gd12WJhHCcAttac0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.182.125.210
country_id: 6252001
description:
2026-01-05 05:01:36 dovecot_plain authenticator failed for H=(urginsters) [12.182.125.210]:40585: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.158.162.24
country_id: 2510769
description:
Jan  5 05:02:22 host2 sshd[4131530]: Disconnected from invalid user reza 146.158.162.24 port 51588 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.161.207.2
country_id: 1643084
description:
Jan  5 05:04:18 host2 sshd[4133604]: Disconnected from invalid user claude 103.161.207.2 port 33342 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 212.104.231.204
country_id: 1227603
description:
Jan  5 05:06:26 host2 dovecot[1170291]: imap-login: Disconnected: Inactivity (auth failed, 1 attempts in 178 secs): user=<chamath.chamupathi@saara.lk>, method=PLAIN, rip=212.104.231.204, lip=66.85.158.91, TLS, session=<fZaaXphHWDXUaOfM>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.161.207.2
country_id: 1643084
description:
Jan  5 05:06:33 host2 sshd[4135983]: Disconnected from invalid user admin 103.161.207.2 port 45852 [preauth]


plugin: ossec
rule: 9711
name: Multiple Dovecot authentication failures on disconnect.
abuser: 212.104.231.204
country_id: 1227603
description:
Jan  5 05:07:05 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 33 secs): user=<chamath.chamupathi@saara.lk>, method=PLAIN, rip=212.104.231.204, lip=66.85.158.91, TLS: Connection closed, session=<HYSbaZhHXzXUaOfM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.34
country_id: 2186224
description:
2026-01-05 05:07:26 dovecot_login authenticator failed for H=([121.73.168.34]) [121.73.168.34]:52244: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.211.156
country_id: 1269750
description:
2026-01-05 05:07:43 dovecot_login authenticator failed for H=(dhcp-192-211-156.in2cable.com) [203.192.211.156]:60082: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2026-01-05 05:07:55 dovecot_plain authenticator failed for H=(akess) [12.150.243.22]:10070: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.95
country_id: 2750405
description:
Jan  5 05:09:42 host2 sshd[4138880]: Disconnected from invalid user install 20.123.146.95 port 40212 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.104.231.204
country_id: 1227603
description:
Jan  5 05:10:10 host2 dovecot[1170291]: imap-login: Disconnected: Inactivity (no auth attempts in 181 secs): user=<>, rip=212.104.231.204, lip=66.85.158.91, TLS handshaking, session=<OymRdphHYTXUaOfM>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.176.122.24
country_id: 1269750
description:
Jan  5 05:14:36 host2 sshd[4144555]: Disconnected from invalid user cron 122.176.122.24 port 51316 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 05:15:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<vsOsiphHfLJA46ZK>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 64.227.166.74
country_id: 1269750
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[64.227.166.74] [Remote Port]=[45692] [Authentication Database]=[mail] [Username]=[support@anandaobauae.org] (10/10 failures) (blocked until [Mon Jan  5 23:45:48 2026 UTC/Tue Jan  6 05:15:48 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 05:15:58 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<tP4xi5hHnJMjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.57.150
country_id: 1643084
description:
Jan  5 05:16:27 host2 sshd[4146907]: Disconnected from invalid user ftpuser2 103.179.57.150 port 45656 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.140.19.22
country_id: 1269750
description:
Jan  5 05:17:08 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=103.140.19.22, lip=66.85.158.91, session=<L9hej5hHaLhnjBMW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2026-01-05 05:17:19 dovecot_login authenticator failed for H=(netcomafrica.com) [41.219.149.74]:16933: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2026-01-05 05:17:39 dovecot_login authenticator failed for H=([189.57.81.137]) [186.201.54.90]:40677: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 133.117.72.88
country_id: 1861060
description:
Jan  5 05:18:18 host2 sshd[4148989]: Disconnected from invalid user admin 133.117.72.88 port 60036 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.176.122.24
country_id: 1269750
description:
Jan  5 05:18:57 host2 sshd[4149646]: Disconnected from invalid user mail1 122.176.122.24 port 40678 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 133.117.72.88
country_id: 1861060
description:
Jan  5 05:19:21 host2 sshd[4150077]: Disconnected from invalid user ftpuser 133.117.72.88 port 35408 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.176.122.24
country_id: 1269750
description:
Jan  5 05:19:35 host2 sshd[4150353]: Disconnected from invalid user webmaster 122.176.122.24 port 52054 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.57.150
country_id: 1643084
description:
Jan  5 05:20:09 host2 sshd[4151081]: Disconnected from invalid user runo 103.179.57.150 port 50010 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.176.122.24
country_id: 1269750
description:
Jan  5 05:20:12 host2 sshd[4151154]: Disconnected from invalid user media 122.176.122.24 port 35192 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.183.74.214
country_id: 1643084
description:
Jan  5 05:20:36 host2 sshd[4151642]: Disconnected from invalid user bitrix 103.183.74.214 port 34708 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.179.57.150
country_id: 1643084
description:
Jan  5 05:21:49 host2 sshd[4153075]: Disconnected from invalid user slr 103.179.57.150 port 33116 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 05:22:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<Zgdbo5hHFliuijvy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.57.150
country_id: 1643084
description:
Jan  5 05:22:34 host2 sshd[4153929]: Disconnected from invalid user pro 103.179.57.150 port 47306 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.152.83.202
country_id: 2264397
description:
Jan  5 05:24:23 host2 sshd[4155911]: Disconnected from invalid user claude 89.152.83.202 port 51256 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.183.74.214
country_id: 1643084
description:
Jan  5 05:24:47 host2 sshd[4156321]: Disconnected from invalid user shares 103.183.74.214 port 42102 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.152.83.202
country_id: 2264397
description:
Jan  5 05:25:43 host2 sshd[4157810]: Disconnected from invalid user deploy 89.152.83.202 port 44148 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 89.152.83.202
country_id: 2264397
description:
Jan  5 05:26:15 host2 sshd[4158420]: Disconnected from invalid user dns 89.152.83.202 port 38890 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.176.79.139
country_id: 1643084
description:
Jan  5 05:26:28 host2 sshd[4158643]: Disconnected from invalid user claude 103.176.79.139 port 55656 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 05:26:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<bQsUsZhH5oiOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 05:27:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<HSaUtJhHvqtnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.152.83.202
country_id: 2264397
description:
Jan  5 05:27:51 host2 sshd[4160159]: Disconnected from invalid user UBUNTU 89.152.83.202 port 43440 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.152.83.202
country_id: 2264397
description:
Jan  5 05:28:21 host2 sshd[4160801]: Disconnected from invalid user claude 89.152.83.202 port 40548 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.176.79.139
country_id: 1643084
description:
Jan  5 05:29:39 host2 sshd[4162204]: Disconnected from invalid user amir 103.176.79.139 port 33676 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.176.79.139
country_id: 1643084
description:
Jan  5 05:31:59 host2 sshd[4164690]: Disconnected from invalid user user1 103.176.79.139 port 39136 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.123
country_id: 6252001
description:
Jan  5 05:34:41 host2 pure-ftpd[4167356]: (?@66.132.153.123) [INFO] New connection from 66.132.153.123


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.141.132.26
country_id: 130758
description:
Jan  5 05:44:06 host2 sshd[4176766]: Disconnected from invalid user beth 185.141.132.26 port 57778 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.5.189.189
country_id: 241170
description:
Jan  5 05:43:07 host2 sshd[4175742]: Disconnected from invalid user gabriel 69.5.189.189 port 54156 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.213.175.140
country_id: 2510769
description:
Jan  5 05:44:47 host2 sshd[4177441]: Disconnected from invalid user holu 185.213.175.140 port 1932 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  5 05:44:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<cHMS8JhHVOgFhXlo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.213.175.140
country_id: 2510769
description:
Jan  5 05:45:51 host2 sshd[4178994]: Disconnected from invalid user claude 185.213.175.140 port 28806 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.18.236.229
country_id: 3175395
description:
Jan  5 05:45:51 host2 sshd[4179031]: Disconnected from invalid user ganesh 85.18.236.229 port 43390 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.75.194.10
country_id: 3017382
description:
Jan  5 05:45:40 host2 sshd[4178734]: Disconnected from invalid user ts 51.75.194.10 port 57740 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.213.175.140
country_id: 2510769
description:
Jan  5 05:46:23 host2 sshd[4179778]: Disconnected from invalid user deployer 185.213.175.140 port 42652 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 85.18.236.229
country_id: 3175395
description:
Jan  5 05:47:59 host2 sshd[4181359]: Disconnected from invalid user jumpuser 85.18.236.229 port 32992 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.213.175.140
country_id: 2510769
description:
Jan  5 05:47:22 host2 sshd[4180781]: Disconnected from invalid user claude 185.213.175.140 port 6412 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.62.87.27
country_id: 3469034
description:
Jan  5 05:48:16 host2 sshd[4181649]: Disconnected from invalid user ubuntu 187.62.87.27 port 59712 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 05:48:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shop@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<iCeDAJlH/n0jupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 192.155.90.118
country_id: 6252001
description:
Jan  5 05:48:10 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=192.155.90.118, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<Smt6/phH2EPAm1p2>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.10.98
country_id: 6252001
description:
Jan  5 05:49:23 host2 sshd[4182707]: Disconnected from invalid user elastic 107.173.10.98 port 31920 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.75.161
country_id: 6252001
description:
Jan  5 05:49:14 host2 sshd[4182582]: Disconnected from invalid user claude 107.172.75.161 port 35346 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  5 05:49:29 host2 pure-ftpd[4182805]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.62.87.27
country_id: 3469034
description:
Jan  5 05:49:33 host2 sshd[4182853]: Disconnected from invalid user elastic 187.62.87.27 port 45558 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 69.5.189.189
country_id: 241170
description:
Jan  5 05:49:34 host2 sshd[4182864]: Disconnected from invalid user user 69.5.189.189 port 56204 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 05:50:53 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<TnEUCJlHRN5A46ZK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.10.98
country_id: 6252001
description:
Jan  5 05:50:18 host2 sshd[4183692]: Disconnected from invalid user kapil 107.173.10.98 port 58084 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.123.109.114
country_id: 732800
description:
Jan  5 05:50:48 host2 sshd[4184144]: Invalid user sivagnanamfoundation from 93.123.109.114 port 46956


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.75.194.10
country_id: 3017382
description:
Jan  5 05:51:23 host2 sshd[4184736]: Disconnected from invalid user radio 51.75.194.10 port 57000 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.141.132.26
country_id: 130758
description:
Jan  5 05:51:11 host2 sshd[4184471]: Disconnected from invalid user it 185.141.132.26 port 36178 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.75.161
country_id: 6252001
description:
Jan  5 05:52:10 host2 sshd[4185525]: Disconnected from invalid user claude 107.172.75.161 port 28686 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.10.98
country_id: 6252001
description:
Jan  5 05:52:15 host2 sshd[4185604]: Disconnected from invalid user hpc 107.173.10.98 port 55142 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  5 05:53:24 host2 sshd[4186570]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-01-05 05:54:30 dovecot_plain authenticator failed for H=(comium) [102.53.15.18]:51418: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 05:55:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<scsbGJlHkC6uijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 05:57:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<TkZhH5lHXpeOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  5 05:58:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<ElRUI5lHOuoFhXlo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.182.38
country_id: 1269750
description:
Jan  5 05:58:59 host2 sshd[4192039]: Disconnected from invalid user admin 64.227.182.38 port 46966 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.251.10
country_id: 6252001
description:
Jan  5 06:00:14 host2 sshd[4193444]: Disconnected from invalid user claude 199.195.251.10 port 42704 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.239.10.198
country_id: 357994
description:
2026-01-05 06:00:47 dovecot_login authenticator failed for H=([154.239.10.205]) [154.239.10.198]:50842: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.162.163
country_id: 298795
description:
2026-01-05 06:01:16 dovecot_login authenticator failed for H=([5.11.162.163]) [5.11.162.163]:55568: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 199.195.251.10
country_id: 6252001
description:
Jan  5 06:02:16 host2 sshd[1715]: Disconnected from invalid user rishabh 199.195.251.10 port 60206 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.251.10
country_id: 6252001
description:
Jan  5 06:01:33 host2 sshd[988]: Disconnected from invalid user claude 199.195.251.10 port 43622 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.251.10
country_id: 6252001
description:
Jan  5 06:03:41 host2 sshd[2986]: Disconnected from invalid user roo 199.195.251.10 port 36456 [preauth]


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 103.154.231.122
country_id: 1643084
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[103.154.231.122] [Remote Port]=[33518] [Authentication Database]=[mail] [Username]=[admin@anandaobauae.org] (10/10 failures) (blocked until [Tue Jan  6 00:34:10 2026 UTC/Tue Jan  6 06:04:10 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 06:04:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<6pmuN5lH7oJnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2026-01-05 06:05:41 dovecot_plain authenticator failed for H=c-73-13-220-220.hsd1.de.comcast.net (overbung) [73.13.220.220]:52646: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.182.38
country_id: 1269750
description:
Jan  5 06:06:33 host2 sshd[5614]: Disconnected from invalid user elasticsearch 64.227.182.38 port 47424 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.227.182.38
country_id: 1269750
description:
Jan  5 06:08:17 host2 sshd[7119]: Disconnected from invalid user claude 64.227.182.38 port 47564 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.64.215.64
country_id: 298795
description:
[2026-01-05 06:08:51 +0530] info [cpaneld] 212.64.215.64 - lezzarotech "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.2.4.105
country_id: 1819730
description:
Jan  5 06:12:15 host2 sshd[10705]: Disconnected from invalid user myuser 20.2.4.105 port 35288 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  5 06:12:57 host2 sshd[11791]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Jan  5 06:13:51 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.116.22, lip=66.85.158.92, TLS: Connection closed, session=<+ZpRWplH6KCLonQW>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.240.223.202
country_id: 6252001
description:
Jan  5 06:15:36 host2 pure-ftpd[14481]: (?@66.240.223.202) [INFO] New connection from 66.240.223.202


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.140.19.22
country_id: 1269750
description:
Jan  5 06:17:16 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=103.140.19.22, lip=66.85.158.91, session=<APtuZplHpsVnjBMW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.162.8.14
country_id: 3469034
description:
Jan  5 06:18:02 host2 sshd[16735]: Disconnected from invalid user administrator 45.162.8.14 port 42636 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.84.236.242
country_id: 1269750
description:
Jan  5 06:18:12 host2 sshd[16879]: Disconnected from invalid user david 103.84.236.242 port 59768 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.126
country_id: 6252001
description:
Jan  5 06:19:03 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.126, lip=66.85.158.92, TLS: Connection closed, session=<32frbJlHUvtChJl+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.162.8.14
country_id: 3469034
description:
Jan  5 06:18:42 host2 sshd[17247]: Disconnected from invalid user claude 45.162.8.14 port 55296 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.162.8.14
country_id: 3469034
description:
Jan  5 06:20:42 host2 sshd[19185]: Disconnected from invalid user claude 45.162.8.14 port 36808 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.233
country_id: 6252001
description:
Jan  5 06:20:49 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.233, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<jz9Bc5lHXMPG6xjp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.154.255
country_id: 1269750
description:
Jan  5 06:20:53 host2 sshd[19340]: Disconnected from invalid user claude 103.172.154.255 port 40968 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.162.8.14
country_id: 3469034
description:
Jan  5 06:22:05 host2 sshd[20468]: Disconnected from invalid user centos 45.162.8.14 port 33902 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.154.255
country_id: 1269750
description:
Jan  5 06:21:46 host2 sshd[20180]: Disconnected from invalid user admin 103.172.154.255 port 60930 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 06:21:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<QxKPdplHzE8jupN+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.172.154.255
country_id: 1269750
description:
Jan  5 06:22:03 host2 sshd[20425]: Disconnected from invalid user claude 103.172.154.255 port 57096 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 103.172.154.255
country_id: 1269750
description:
Jan  5 06:22:35 host2 sshd[20862]: Received disconnect from 103.172.154.255 port 45736:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.154.255
country_id: 1269750
description:
Jan  5 06:22:35 host2 sshd[20862]: Disconnected from invalid user developer 103.172.154.255 port 45736 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 06:25:48 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<uuXvhJlHNpVA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 06:27:34 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<zUZDi5lHIGuuijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 06:28:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<sam1jZlHVpSOq2dI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.15.170.124
country_id: 3017382
description:
Jan  5 06:31:09 host2 sshd[28718]: Disconnected from invalid user administrador 51.15.170.124 port 41602 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.212.34.236
country_id: 3895114
description:
Jan  5 06:31:13 host2 sshd[28798]: Disconnected from invalid user ubuntu 181.212.34.236 port 46214 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.15.170.124
country_id: 3017382
description:
Jan  5 06:31:45 host2 sshd[29406]: Disconnected from invalid user flink 51.15.170.124 port 47980 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.212.34.236
country_id: 3895114
description:
Jan  5 06:31:57 host2 sshd[29592]: Disconnected from invalid user dmdba 181.212.34.236 port 36214 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.212.34.236
country_id: 3895114
description:
Jan  5 06:32:36 host2 sshd[30242]: Disconnected from invalid user owncloud 181.212.34.236 port 34866 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.15.170.124
country_id: 3017382
description:
Jan  5 06:32:49 host2 sshd[30430]: Disconnected from invalid user claude 51.15.170.124 port 43904 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.212.34.236
country_id: 3895114
description:
Jan  5 06:33:15 host2 sshd[30868]: Disconnected from invalid user guest 181.212.34.236 port 58602 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.74.115.25
country_id: 1861060
description:
Jan  5 06:33:22 host2 sshd[30968]: Disconnected from invalid user testuser 40.74.115.25 port 32798 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.212.34.236
country_id: 3895114
description:
Jan  5 06:33:52 host2 sshd[31372]: Disconnected from invalid user park 181.212.34.236 port 46250 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.197.53.204
country_id: 1269750
description:
Jan  5 06:34:18 host2 sshd[31768]: Disconnected from invalid user test1 20.197.53.204 port 42950 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 40.74.115.25
country_id: 1861060
description:
Jan  5 06:34:41 host2 sshd[32086]: Disconnected from invalid user teamspeak 40.74.115.25 port 49384 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.74.115.25
country_id: 1861060
description:
Jan  5 06:35:21 host2 sshd[32877]: Disconnected from invalid user db-user 40.74.115.25 port 52172 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.120.182
country_id: 3144096
description:
2026-01-05 06:37:19 dovecot_login authenticator failed for H=(cm-178.232.120.182.get.no) [178.232.120.182]:43174: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.181.87.33
country_id: 298795
description:
Jan  5 06:37:37 host2 sshd[35081]: Disconnected from invalid user webadm 5.181.87.33 port 34304 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.50.221
country_id: 3144096
description:
2026-01-05 06:38:18 dovecot_login authenticator failed for H=([178.232.50.221]) [178.232.50.221]:33322: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.170
country_id: 1643084
description:
Jan  5 06:37:35 host2 sshd[35052]: Disconnected from invalid user claude 27.112.78.170 port 43226 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.51.153.37
country_id: 3469034
description:
Jan  5 06:38:27 host2 sshd[35831]: Disconnected from invalid user reza 179.51.153.37 port 36402 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.248.139
country_id: 1880251
description:
Jan  5 06:38:45 host2 sshd[36018]: Disconnected from invalid user sns 188.166.248.139 port 60770 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.181.87.33
country_id: 298795
description:
Jan  5 06:40:51 host2 sshd[38368]: Disconnected from invalid user service 5.181.87.33 port 33600 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.170
country_id: 1643084
description:
Jan  5 06:41:33 host2 sshd[39147]: Disconnected from invalid user cssserver 27.112.78.170 port 40902 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 06:41:40 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<SqSrvZlHAJBnmud6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 5.181.87.33
country_id: 298795
description:
Jan  5 06:41:25 host2 sshd[38926]: Disconnected from invalid user jeffrey 5.181.87.33 port 35252 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.181.87.33
country_id: 298795
description:
Jan  5 06:42:32 host2 sshd[40075]: Disconnected from invalid user sandbox 5.181.87.33 port 37058 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.112.78.170
country_id: 1643084
description:
Jan  5 06:43:08 host2 sshd[40674]: Disconnected from invalid user marcela 27.112.78.170 port 40050 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.170
country_id: 1643084
description:
Jan  5 06:43:51 host2 sshd[41393]: Disconnected from invalid user admin4 27.112.78.170 port 42052 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.124.127
country_id: 1819730
description:
Jan  5 06:44:00 host2 sshd[41536]: Disconnected from invalid user ubuntu 101.36.124.127 port 50122 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2026-01-05 06:44:17 dovecot_plain authenticator failed for H=c-73-197-194-98.hsd1.nj.comcast.net (rated) [73.197.194.98]:34198: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.202.197.108
country_id: 6252001
description:
2026-01-05 06:44:20 dovecot_plain authenticator failed for H=(martar) [50.202.197.108]:55974: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.124.127
country_id: 1819730
description:
Jan  5 06:44:42 host2 sshd[42170]: Disconnected from invalid user postgres 101.36.124.127 port 52014 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.51.153.37
country_id: 3469034
description:
Jan  5 06:44:51 host2 sshd[42317]: Disconnected from invalid user localhost 179.51.153.37 port 58886 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.51.153.37
country_id: 3469034
description:
Jan  5 06:46:17 host2 sshd[44387]: Disconnected from invalid user ubuntu 179.51.153.37 port 46396 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.124.127
country_id: 1819730
description:
Jan  5 06:45:21 host2 sshd[43273]: Disconnected from invalid user claude 101.36.124.127 port 42444 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.248.139
country_id: 1880251
description:
Jan  5 06:45:49 host2 sshd[43871]: Disconnected from invalid user claude 188.166.248.139 port 54344 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.51.153.37
country_id: 3469034
description:
Jan  5 06:48:25 host2 sshd[46625]: Disconnected from invalid user pq 179.51.153.37 port 53742 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2026-01-05 06:51:13 dovecot_plain authenticator failed for H=(nomer) [178.250.191.189]:41348: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  5 06:52:35 host2 pure-ftpd[50845]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.73.195.150
country_id: 290557
description:
Jan  5 06:53:30 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<enveng@lezzarotech.com>, method=PLAIN, rip=91.73.195.150, lip=66.85.158.91, session=<gsHz55lH6ZhbScOW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.226.88.121
country_id: 2661886
description:
Jan  5 06:53:30 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<eng_env@lezzarotech.com>, method=PLAIN, rip=81.226.88.121, lip=66.85.158.91, session=<P9f455lHbJBR4lh5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.233.140.250
country_id: 3469034
description:
Jan  5 06:53:57 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<env>, method=PLAIN, rip=181.233.140.250, lip=66.85.158.91, session=<tAiG6ZlH2KG16Yz6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.19.195.12
country_id: 3144096
description:
Jan  5 06:54:14 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<env.eng>, method=PLAIN, rip=85.19.195.12, lip=66.85.158.91, TLS, session=<HjHN6ZlHLulVE8MM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.148.194
country_id: 99237
description:
Jan  5 06:53:24 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<eng@lezzarotech.com>, method=PLAIN, rip=65.20.148.194, lip=66.85.158.91, session=<+AOa55lH/a1BFJTC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.59.202.241
country_id: 149590
description:
Jan  5 06:53:32 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<env.eng@lezzarotech.com>, method=PLAIN, rip=41.59.202.241, lip=66.85.158.91, session=<mnAX6JlHIqcpO8rx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 105.72.176.66
country_id: 2542007
description:
Jan  5 06:53:55 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<engenv>, method=PLAIN, rip=105.72.176.66, lip=66.85.158.91, TLS, session=<Ze2q6JlHVMJpSLBC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.200.6.38
country_id: 3469034
description:
Jan  5 06:53:58 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 25 secs): user=<enveng@lezzarotech.com>, method=PLAIN, rip=186.200.6.38, lip=66.85.158.91, TLS, session=<VKRL6JlH+Ma6yAYm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 74.218.95.154
country_id: 6252001
description:
Jan  5 06:53:37 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<engenv@lezzarotech.com>, method=PLAIN, rip=74.218.95.154, lip=66.85.158.91, TLS, session=<km5855lHFeVK2l+a>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.163.103
country_id: 99237
description:
Jan  5 06:53:42 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<eng_env@lezzarotech.com>, method=PLAIN, rip=65.20.163.103, lip=66.85.158.91, session=<if266JlH/o1BFKNn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 130.255.96.29
country_id: 3175395
description:
Jan  5 06:53:56 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<env.eng@lezzarotech.com>, method=PLAIN, rip=130.255.96.29, lip=66.85.158.91, session=<X9eJ6ZlHOxWC/2Ad>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.68.22.140
country_id: 1269750
description:
Jan  5 06:54:00 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<eng.env>, method=PLAIN, rip=103.68.22.140, lip=66.85.158.91, session=<ecPJ6ZlHsexnRBaM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.174.34.49
country_id: 1269750
description:
Jan  5 06:54:02 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<eng_env@lezzarotech.com>, method=PLAIN, rip=103.174.34.49, lip=66.85.158.91, session=<JhfL6ZlHLO9nriIx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.171.12.170
country_id: 1269750
description:
Jan  5 06:54:13 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<enveng>, method=PLAIN, rip=103.171.12.170, lip=66.85.158.91, session=<kexw6plH0uJnqwyq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 61.2.44.54
country_id: 1269750
description:
Jan  5 06:53:31 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<eng-env@lezzarotech.com>, method=PLAIN, rip=61.2.44.54, lip=66.85.158.91, session=<S/H755lH7uk9Aiw2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 78.68.37.25
country_id: 2661886
description:
Jan  5 06:53:34 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<env@lezzarotech.com>, method=PLAIN, rip=78.68.37.25, lip=66.85.158.91, TLS, session=<BlFr55lH4MJORCUZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.235.31.47
country_id: 6252001
description:
Jan  5 06:53:38 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<eng.env@lezzarotech.com>, method=PLAIN, rip=50.235.31.47, lip=66.85.158.91, TLS, session=<0a1555lH+qAy6x8v>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.241.132.152
country_id: 1269750
description:
Jan  5 06:53:47 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<env.eng@lezzarotech.com>, method=PLAIN, rip=43.241.132.152, lip=66.85.158.91, session=<Mdzu6JlH8Kgr8YSY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.212.178
country_id: 732800
description:
Jan  5 06:53:59 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<eng-env@lezzarotech.com>, method=PLAIN, rip=185.255.212.178, lip=66.85.158.91, session=<45S86ZlH7VG5/9Sy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.57.184.151
country_id: 1269750
description:
Jan  5 06:54:04 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 9 secs): user=<eng>, method=PLAIN, rip=103.57.184.151, lip=66.85.158.91, session=<gZmd6ZlHwrFnObiX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.153.146
country_id: 99237
description:
Jan  5 06:54:21 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<eng.env>, method=PLAIN, rip=65.20.153.146, lip=66.85.158.91, TLS, session=<X6US6plHHqRBFJmS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.93.68.178
country_id: 3469034
description:
Jan  5 06:54:23 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<eng>, method=PLAIN, rip=187.93.68.178, lip=66.85.158.91, TLS, session=<5eAc6plH6+C7XUSy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.93.154.207
country_id: 1643084
description:
Jan  5 06:54:41 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=36.93.154.207, lip=66.85.158.91, session=<52wU7JlHbN0kXZrP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.220.10.60
country_id: 1269750
description:
Jan  5 06:54:20 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<env>, method=PLAIN, rip=117.220.10.60, lip=66.85.158.91, TLS, session=<rHPf6ZlHXMR13Ao8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 59.183.56.107
country_id: 1269750
description:
Jan  5 06:55:09 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<eng-env>, method=PLAIN, rip=59.183.56.107, lip=66.85.158.91, session=<G0bT7ZlHnac7tzhr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.7
country_id: 2635167
description:
Jan  5 06:55:09 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.7, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<2f8H7plHJaZX7LAH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.47.172.253
country_id: 2287781
description:
Jan  5 06:54:59 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<env-eng>, method=PLAIN, rip=196.47.172.253, lip=66.85.158.91, TLS, session=<o3NN7JlH+cXEL6z9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.32.99.14
country_id: 290557
description:
Jan  5 06:55:01 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=5.32.99.14, lip=66.85.158.91, TLS, session=<d3937JlHKJwFIGMO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.187.226.13
country_id: 1269750
description:
Jan  5 06:54:37 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<enveng>, method=PLAIN, rip=122.187.226.13, lip=66.85.158.91, TLS, session=<bVvQ6plHaM56u+IN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 80.227.102.242
country_id: 290557
description:
Jan  5 06:54:21 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<eng-env@lezzarotech.com>, method=PLAIN, rip=80.227.102.242, lip=66.85.158.91, TLS, session=<A68A6plHZaFQ42by>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.100
country_id: 2635167
description:
Jan  5 06:55:08 host2 dovecot[1170291]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.100, lip=66.85.158.92, TLS, session=<B/797ZlHqaFX7LBk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.129.28
country_id: 99237
description:
Jan  5 06:54:20 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<eng_env>, method=PLAIN, rip=65.20.129.28, lip=66.85.158.91, TLS, session=<y/MY6plHK7dBFIEc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.174.63
country_id: 99237
description:
Jan  5 06:56:05 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<eng-env>, method=PLAIN, rip=65.20.174.63, lip=66.85.158.91, session=<egMn8ZlHm6NBFK4/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.193.122.91
country_id: 690791
description:
Jan  5 06:56:17 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<eng-env>, method=PLAIN, rip=82.193.122.91, lip=66.85.158.91, session=<bTPs8ZlHEalSwXpb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.27
country_id: 2635167
description:
Jan  5 06:56:16 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=185.247.137.27, lip=66.85.158.92, TLS handshaking: Connection closed, session=<HLME8plHUd+594kb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 06:55:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<GKGN7plH9NsjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.233.235.203
country_id: 2661886
description:
Jan  5 06:55:19 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<env_eng>, method=PLAIN, rip=81.233.235.203, lip=66.85.158.91, TLS, session=<G32o7ZlHMsBR6evL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.12
country_id: 2635167
description:
Jan  5 06:55:42 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.12, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<bHkD8JlHi+dX7LAM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.30
country_id: 2635167
description:
Jan  5 06:56:49 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.30, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<ExoA9JlH3btX7LAe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.68.22.140
country_id: 1269750
description:
Jan  5 06:57:15 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<eng-env>, method=PLAIN, rip=103.68.22.140, lip=66.85.158.91, session=<jv9Q9ZlHocpnRBaM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.26
country_id: 2635167
description:
Jan  5 06:57:22 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.26, lip=66.85.158.92, TLS handshaking: Connection closed, session=<OID79ZlHZ85X7LAa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.26
country_id: 2635167
description:
Jan  5 06:57:56 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.26, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<MDIE+JlH0YW594ka>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.6
country_id: 2635167
description:
Jan  5 06:58:30 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.6, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<bmMB+plHu69X7LAG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.24
country_id: 2635167
description:
Jan  5 06:59:03 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.24, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<Or38+5lH8aq594kY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 06:59:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<o4EK/ZlHxoWOq2dI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.17
country_id: 2635167
description:
Jan  5 06:59:36 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.17, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<eCv2/ZlHg+q594kR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.23
country_id: 2635167
description:
Jan  5 07:00:09 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (disconnected before auth was ready, waited 0 secs): user=<>, rip=87.236.176.23, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<xKDx/5lH1blX7LAX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 07:00:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shop@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<ccVUAJpHpoyuijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 07:00:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<Qs49AppHtNhA46ZK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.36.108
country_id: 3932488
description:
2026-01-05 07:08:04 dovecot_login authenticator failed for H=([190.223.36.108]) [190.223.36.108]:49126: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.64
country_id: 1733045
description:
2026-01-05 07:08:28 dovecot_login authenticator failed for H=([49.125.201.64]) [49.125.201.64]:43774: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.245.117.221
country_id: 1880251
description:
Jan  5 07:10:34 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=47.245.117.221, lip=66.85.158.92, session=<AwwtJZpH+oQv9XXd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  5 07:11:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<82e2J5pHnKIFhXlo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.202
country_id: 6252001
description:
Jan  5 07:14:50 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.202, lip=66.85.158.91, session=<sPtpNJpH7ujG6xjK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.190.22.247
country_id: 2750405
description:
Jan  5 07:16:04 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=146.190.22.247, lip=66.85.158.91, session=<bl+JOJpHKsCSvhb3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.84.211.204
country_id: 6252001
description:
Jan  5 07:17:06 host2 sshd[79415]: Disconnected from invalid user invoices 50.84.211.204 port 50672 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.62.43.176
country_id: 2635167
description:
Jan  5 07:17:51 host2 sshd[80075]: Disconnected from invalid user cssserver 178.62.43.176 port 58120 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.84.211.204
country_id: 6252001
description:
Jan  5 07:18:04 host2 sshd[80340]: Disconnected from invalid user josh 50.84.211.204 port 39024 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.174.129.232
country_id: 2542007
description:
Jan  5 07:18:05 host2 sshd[80353]: Disconnected from invalid user denise 160.174.129.232 port 55008 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 80.82.77.139
country_id: 2750405
description:
Jan  5 07:18:31 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=80.82.77.139, lip=66.85.158.92, session=<25WaQZpHEr5QUk2L>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 80.82.77.139
country_id: 2750405
description:
Jan  5 07:18:30 host2 dovecot[1170291]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=80.82.77.139, lip=66.85.158.92, session=<ke6KQZpHZrZQUk2L>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 50.84.211.204
country_id: 6252001
description:
Jan  5 07:18:37 host2 sshd[80841]: Disconnected from invalid user emma 50.84.211.204 port 51468 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 160.174.129.232
country_id: 2542007
description:
Jan  5 07:19:41 host2 sshd[81946]: Disconnected from invalid user steam 160.174.129.232 port 28514 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.84.211.204
country_id: 6252001
description:
Jan  5 07:19:43 host2 sshd[81983]: Disconnected from invalid user system 50.84.211.204 port 48122 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 07:19:57 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<x3GbRppHwLVnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.62.43.176
country_id: 2635167
description:
Jan  5 07:21:10 host2 sshd[83614]: Disconnected from invalid user claude 178.62.43.176 port 54586 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.62.43.176
country_id: 2635167
description:
Jan  5 07:21:40 host2 sshd[84066]: Disconnected from invalid user ben 178.62.43.176 port 56598 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 178.62.43.176
country_id: 2635167
description:
Jan  5 07:22:10 host2 sshd[84526]: Disconnected from invalid user iptv 178.62.43.176 port 39336 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.62.43.176
country_id: 2635167
description:
Jan  5 07:22:39 host2 sshd[84918]: Disconnected from invalid user ftptest 178.62.43.176 port 42500 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  5 07:25:15 host2 sshd[87532]: Disconnected from invalid user admin 2.57.121.112 port 28482 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 07:28:16 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shop@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<LR5UZJpH7ukjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.54.62.66
country_id: 3469034
description:
Jan  5 07:27:21 host2 sshd[89607]: Disconnected from invalid user sandeep 177.54.62.66 port 63361 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2026-01-05 07:28:32 dovecot_plain authenticator failed for H=(howely) [102.53.15.180]:58199: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2026-01-05 07:28:28 dovecot_plain authenticator failed for H=c-71-224-169-28.hsd1.pa.comcast.net (anemeling) [71.224.169.28]:35116: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.54.62.66
country_id: 3469034
description:
Jan  5 07:28:44 host2 sshd[90982]: Disconnected from invalid user radio 177.54.62.66 port 61176 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2026-01-05 07:30:02 dovecot_plain authenticator failed for H=(unhonia) [91.73.195.150]:41364: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 07:30:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<uSega5pH4puOq2dI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.54.62.66
country_id: 3469034
description:
Jan  5 07:30:38 host2 sshd[92820]: Disconnected from invalid user frontend 177.54.62.66 port 53063 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 07:32:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<+N+0cZpHnMeuijvy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2026-01-05 07:33:45 dovecot_plain authenticator failed for H=c-68-60-77-128.hsd1.mi.comcast.net (reake) [68.60.77.128]:33056: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2026-01-05 07:33:49 dovecot_plain authenticator failed for H=c-68-40-189-43.hsd1.mi.comcast.net (conity) [68.40.189.43]:56508: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 07:35:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<Fn2nf5pHYuFA46ZK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  5 07:37:40 host2 sshd[99108]: Disconnected from invalid user user 2.57.121.25 port 42863 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.123.109.114
country_id: 732800
description:
Jan  5 07:44:26 host2 sshd[104883]: Invalid user sivagnanamfoundation from 93.123.109.114 port 57576


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.251.92.56
country_id: 6252001
description:
Jan  5 07:46:30 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=783) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=47.251.92.56, lip=66.85.158.92, TLS handshaking: read(size=783) failed: Connection reset by peer, session=<NaOopZpHnEYv+1w4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.251.53.147
country_id: 6252001
description:
Jan  5 07:47:00 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=47.251.53.147, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<uoRzp5pHjEkv+zWT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  5 07:48:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<8X1NrppHaNoDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  5 07:49:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<URnZsZpH9q4DgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  5 07:51:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: Connection closed, session=<EbyZt5pHAoIDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.190.155.43
country_id: 6252001
description:
2026-01-05 07:51:58 dovecot_plain authenticator failed for H=(shorkly) [76.190.155.43]:48724: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  5 07:52:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<vhuiu5pHcIIDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  5 07:53:43 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<rYaEv5pH/psDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  5 07:55:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<0/3LxJpH/LwDgmBb>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  5 07:56:22 host2 pure-ftpd[117649]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2026-01-05 07:56:25 dovecot_plain authenticator failed for H=(freption) [90.161.217.228]:54213: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  5 07:56:34 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: Connection closed, session=<25KqyZpHsr4DgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  5 07:57:49 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<kQ4hzppHMooDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 07:58:01 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<ZMXAzppHVr5nmud6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  5 07:58:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS, session=<q0N50JpHdMwDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 08:01:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<0r7D2ppHdGwjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 08:01:35 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<YNx725pHXpqOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 08:04:08 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<QtOe5JpH8Miuijvy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-05 08:04:21 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:53290: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.196.9.141
country_id: 2635167
description:
Jan  5 08:05:40 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=978) failed: Connection reset by peer (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=185.196.9.141, lip=66.85.158.91, session=<coYh6ppHXIy5xAmN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.203.138
country_id: 1269750
description:
2026-01-05 08:07:49 dovecot_login authenticator failed for H=([122.185.0.201]) [125.23.203.138]:39016: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.228.234
country_id: 1269750
description:
2026-01-05 08:08:12 dovecot_login authenticator failed for H=([182.76.228.234]) [182.76.228.234]:45590: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.53.124
country_id: 6252001
description:
Jan  5 08:08:25 host2 sshd[128733]: Disconnected from invalid user administrator 209.141.53.124 port 55848 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.46
country_id: 1269750
description:
2026-01-05 08:08:59 dovecot_login authenticator failed for H=([125.19.156.46]) [125.19.156.46]:58416: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.53.124
country_id: 6252001
description:
Jan  5 08:09:40 host2 sshd[129976]: Disconnected from invalid user admin 209.141.53.124 port 42934 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.76.188.180
country_id: 1819730
description:
2026-01-05 08:09:24 dovecot_login authenticator failed for H=180.188.76.219.static.netvigator.com [219.76.188.180]:63875: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 08:11:35 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<es5J/5pHftlA46ZK>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.141.53.124
country_id: 6252001
description:
Jan  5 08:13:43 host2 sshd[134317]: Disconnected from invalid user sammy 209.141.53.124 port 42910 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.158.255
country_id: 1227603
description:
Jan  5 08:14:35 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=175.157.158.255, lip=66.85.158.91, TLS handshaking: Connection closed, session=<bVYZCptHLeSvnZ7/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.37.253.93
country_id: 6252001
description:
2026-01-05 08:15:46 dovecot_plain authenticator failed for H=([169.254.167.31]) [193.37.253.93]:12179: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.53.124
country_id: 6252001
description:
Jan  5 08:15:19 host2 sshd[135978]: Disconnected from invalid user db2inst1 209.141.53.124 port 37254 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 193.37.253.93
country_id: 6252001
description:
Jan  5 08:16:12 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=193.37.253.93, lip=66.85.158.91, TLS handshaking: Connection closed, session=<BajnD5tHXOHBJf1d>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.120.138.3
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 37.120.138.3 - env_eng@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  5 08:21:34 host2 sshd[141698]: Disconnected from invalid user user 2.57.121.25 port 38781 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.140.19.22
country_id: 1269750
description:
Jan  5 08:21:14 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=103.140.19.22, lip=66.85.158.91, session=<vZXCIZtH2MlnjBMW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.171.8.85
country_id: 6252001
description:
Jan  5 08:32:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.171.8.85, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<JF+qS5tHuMIUqwhV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 08:32:57 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<i5SpS5tHOJqOq2dI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2026-01-05 08:34:40 dovecot_login authenticator failed for H=([196.191.212.235]) [213.55.85.202]:4084: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 08:34:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<9gKtUptH8kMjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.47
country_id: 3469034
description:
Jan  5 08:34:58 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=190.89.137.47, lip=66.85.158.91, TLS, session=<oFrhUZtHE+6+WYkv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.221.254.250
country_id: 783754
description:
2026-01-05 08:35:01 dovecot_login authenticator failed for H=([185.221.254.250]) [185.221.254.250]:38899: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.196.70
country_id: 3469034
description:
Jan  5 08:35:00 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=179.189.196.70, lip=66.85.158.91, TLS, session=<Ld/lUZtHbaWzvcRG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.74.5.68
country_id: 2395170
description:
Jan  5 08:35:19 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<hr>, method=PLAIN, rip=41.74.5.68, lip=66.85.158.91, TLS, session=<jiQkU5tHSr0pSgVE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.245.219.226
country_id: 6290252
description:
Jan  5 08:35:19 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<hr>, method=PLAIN, rip=109.245.219.226, lip=66.85.158.91, TLS, session=<I95BU5tHTqFt9dvi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.9.200.229
country_id: 2510769
description:
2026-01-05 08:36:08 dovecot_login authenticator failed for H=229.red-88-9-200.dynamicip.rima-tde.net [88.9.200.229]:52954: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.48.229.117
country_id: 3469034
description:
2026-01-05 08:36:48 dovecot_login authenticator failed for H=ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:58532: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.236.66
country_id: 6252001
description:
2026-01-05 08:36:50 dovecot_plain authenticator failed for H=c-73-213-236-66.hsd1.va.comcast.net (spallarin) [73.213.236.66]:43688: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.170.59
country_id: 99237
description:
2026-01-05 08:37:00 dovecot_login authenticator failed for H=([65.20.170.59]) [65.20.170.59]:53536: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.143.166
country_id: 1819730
description:
2026-01-05 08:36:33 dovecot_login authenticator failed for H=166.143.48.116.static.netvigator.com [116.48.143.166]:56466: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 08:36:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<26Q+WZtHhNVnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 08:37:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<UWu8XJtH/oSuijvy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.114
country_id: 6252001
description:
Jan  5 08:43:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=147.185.133.114, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<F3dYcptH1MaTuYVy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.114
country_id: 6252001
description:
Jan  5 08:44:59 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 12 secs): user=<>, rip=147.185.133.114, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<k1jTdptHxOSTuYVy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  5 08:46:31 host2 sshd[163936]: Disconnected from invalid user admin 2.57.121.112 port 56541 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 08:47:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<zx9uf5tHzsxA46ZK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.151.91.78
country_id: 732800
description:
Jan  5 08:49:54 host2 sshd[168704]: Disconnected from invalid user me 45.151.91.78 port 58904 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.254.149.199
country_id: 1605651
description:
Jan  5 08:49:19 host2 sshd[167952]: Disconnected from invalid user data 27.254.149.199 port 59714 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.149.199
country_id: 1605651
description:
Jan  5 08:50:35 host2 sshd[169793]: Disconnected from invalid user debian 27.254.149.199 port 53896 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.218.244
country_id: 1880251
description:
Jan  5 08:50:57 host2 sshd[170069]: Disconnected from invalid user facturacion 152.32.218.244 port 34220 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.149.199
country_id: 1605651
description:
Jan  5 08:51:17 host2 sshd[170422]: Disconnected from invalid user claude 27.254.149.199 port 36876 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.81.244.142
country_id: 1269750
description:
Jan  5 08:51:45 host2 sshd[170921]: Disconnected from invalid user onkar 40.81.244.142 port 36880 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.114
country_id: 6252001
description:
Jan  5 08:52:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.133.114, lip=66.85.158.91, TLS, session=<PeawkJtHEOGTuYVy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.218.244
country_id: 1880251
description:
Jan  5 08:52:20 host2 sshd[171657]: Disconnected from invalid user userftp 152.32.218.244 port 58498 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.151.91.78
country_id: 732800
description:
Jan  5 08:52:36 host2 sshd[171976]: Disconnected from invalid user user 45.151.91.78 port 47412 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.216.116.13
country_id: 1819730
description:
Jan  5 08:52:51 host2 sshd[172161]: Disconnected from invalid user server 185.216.116.13 port 59268 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  5 08:53:48 host2 sshd[172912]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.218.244
country_id: 1880251
description:
Jan  5 08:54:47 host2 sshd[174242]: Disconnected from invalid user claude 152.32.218.244 port 33200 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.234.207.202
country_id: 6252001
description:
Jan  5 08:54:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.234.207.202, lip=66.85.158.91, TLS handshaking: Connection closed, session=<aCG0l5tHxIys6s/K>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.151.91.78
country_id: 732800
description:
Jan  5 08:54:11 host2 sshd[173463]: Disconnected from invalid user tim 45.151.91.78 port 56044 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.53.184.147
country_id: 2782113
description:
Jan  5 08:55:54 host2 sshd[175771]: Disconnected from invalid user panel 152.53.184.147 port 51952 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.31.255.21
country_id: 6252001
description:
Jan  5 08:56:16 host2 sshd[176119]: Disconnected from invalid user test01 144.31.255.21 port 33014 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.197.78.36
country_id: 6252001
description:
Jan  5 08:56:50 host2 sshd[176654]: Disconnected from invalid user claude 138.197.78.36 port 40208 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.97.44.51
country_id: 3175395
description:
Jan  5 08:56:55 host2 sshd[176727]: Disconnected from invalid user qiyuesuo 62.97.44.51 port 43816 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.38.130.3
country_id: 3017382
description:
Jan  5 08:56:12 host2 sshd[176037]: Disconnected from invalid user ftpuser 51.38.130.3 port 53318 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.216.116.13
country_id: 1819730
description:
Jan  5 08:56:20 host2 sshd[176195]: Disconnected from invalid user ts3 185.216.116.13 port 33830 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.97.44.51
country_id: 3175395
description:
Jan  5 08:56:22 host2 sshd[176214]: Disconnected from invalid user test 62.97.44.51 port 32976 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.38.130.3
country_id: 3017382
description:
Jan  5 08:57:18 host2 sshd[177247]: Disconnected from invalid user ubuntu 51.38.130.3 port 48834 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.197.78.36
country_id: 6252001
description:
Jan  5 08:57:24 host2 sshd[177332]: Disconnected from invalid user compta 138.197.78.36 port 59478 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.253.156.184
country_id: 1643084
description:
Jan  5 08:57:48 host2 sshd[177680]: Disconnected from invalid user gabriel 182.253.156.184 port 45696 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.97.44.51
country_id: 3175395
description:
Jan  5 08:57:59 host2 sshd[177825]: Disconnected from invalid user arduino 62.97.44.51 port 38716 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.216.116.13
country_id: 1819730
description:
Jan  5 08:57:41 host2 sshd[177582]: Disconnected from invalid user kafka 185.216.116.13 port 57116 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.38.130.3
country_id: 3017382
description:
Jan  5 08:58:21 host2 sshd[178205]: Disconnected from invalid user ubuntu 51.38.130.3 port 49830 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.253.156.184
country_id: 1643084
description:
Jan  5 08:58:25 host2 sshd[178274]: Disconnected from invalid user newuser 182.253.156.184 port 57498 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.53.184.147
country_id: 2782113
description:
Jan  5 08:59:04 host2 sshd[178961]: Disconnected from invalid user claude 152.53.184.147 port 40828 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.216.116.13
country_id: 1819730
description:
Jan  5 08:58:23 host2 sshd[178242]: Disconnected from invalid user kamil 185.216.116.13 port 40532 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.197.78.36
country_id: 6252001
description:
Jan  5 08:58:35 host2 sshd[178476]: Disconnected from invalid user ito 138.197.78.36 port 60666 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.31.255.21
country_id: 6252001
description:
Jan  5 08:58:44 host2 sshd[178583]: Disconnected from invalid user steam 144.31.255.21 port 48438 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.31.255.21
country_id: 6252001
description:
Jan  5 08:59:13 host2 sshd[179121]: Disconnected from invalid user ate 144.31.255.21 port 43942 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.237.126.9
country_id: 6252001
description:
Jan  5 08:59:34 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=135.237.126.9, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<VIj5qptHsOGH7X4J>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.253.156.184
country_id: 1643084
description:
Jan  5 08:59:39 host2 sshd[179504]: Disconnected from invalid user steam 182.253.156.184 port 52870 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.53.184.147
country_id: 2782113
description:
Jan  5 08:59:41 host2 sshd[179537]: Disconnected from invalid user claude 152.53.184.147 port 37042 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.221.50.123
country_id: 3865483
description:
Jan  5 08:59:52 host2 sshd[179696]: Disconnected from invalid user claude 190.221.50.123 port 47326 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  5 09:00:19 host2 pure-ftpd[180378]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.221.50.123
country_id: 3865483
description:
Jan  5 09:00:30 host2 sshd[180533]: Disconnected from invalid user user 190.221.50.123 port 39150 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.221.50.123
country_id: 3865483
description:
Jan  5 09:01:08 host2 sshd[181106]: Disconnected from invalid user user 190.221.50.123 port 39628 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.230.228.16
country_id: 6252001
description:
2026-01-05 09:01:40 dovecot_plain authenticator failed for H=c-71-230-228-16.hsd1.de.comcast.net (chypotly) [71.230.228.16]:35696: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.31.74
country_id: 1522867
description:
2026-01-05 09:01:42 dovecot_plain authenticator failed for H=2.135.31.74.dynamic.telecom.kz (louts) [2.135.31.74]:58426: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.221.50.123
country_id: 3865483
description:
Jan  5 09:02:26 host2 sshd[182476]: Disconnected from invalid user ate 190.221.50.123 port 44454 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 09:03:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<OB1St5tHAMKOq2dI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.165.219
country_id: 1605651
description:
2026-01-05 09:04:18 dovecot_login authenticator failed for H=([106.0.165.219]) [106.0.165.219]:46556: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  5 09:06:47 host2 sshd[186394]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-01-05 09:06:15 dovecot_login authenticator failed for H=([103.168.241.32]) [103.168.241.32]:34896: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 09:07:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<kCkGxptHzKcjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 09:08:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@seyawin.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<mofDyZtHYMFCdMzo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.88.196.91
country_id: 6252001
description:
2026-01-05 09:09:24 dovecot_plain authenticator failed for H=c-73-88-196-91.hsd1.ky.comcast.net (pamip) [73.88.196.91]:55100: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 09:09:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<FAMrzZtH5uquijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 09:13:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<Gh+m3ZtHfJlnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 09:16:40 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<oWEI6JtHmNtCdMzo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.144.28.85
country_id: 1819730
description:
Jan  5 09:19:56 host2 sshd[198380]: Disconnected from invalid user usuario 103.144.28.85 port 38500 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.144.28.85
country_id: 1819730
description:
Jan  5 09:20:46 host2 sshd[199307]: Disconnected from invalid user k 103.144.28.85 port 54592 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 09:20:57 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<rCpQ95tH9OdA46ZK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.114.21.51
country_id: 2328926
description:
2026-01-05 09:21:53 dovecot_plain authenticator failed for H=(unciess) [105.114.21.51]:41013: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.144.28.85
country_id: 1819730
description:
Jan  5 09:22:29 host2 sshd[200732]: Disconnected from invalid user mysqluser 103.144.28.85 port 38208 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.46.140.241
country_id: 1210997
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 103.46.140.241 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.128.190.44
country_id: 3017382
description:
Jan  5 09:24:16 host2 sshd[202382]: Disconnected from invalid user usuario 57.128.190.44 port 50824 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.228.127.7
country_id: 3686110
description:
Jan  5 09:25:33 host2 sshd[203759]: Disconnected from invalid user user 168.228.127.7 port 42554 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 57.128.190.44
country_id: 3017382
description:
Jan  5 09:25:11 host2 sshd[203277]: Disconnected from invalid user duo 57.128.190.44 port 42518 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.60.51.173
country_id: 3686110
description:
Jan  5 09:26:50 host2 sshd[204908]: Disconnected from invalid user bitrix 190.60.51.173 port 43078 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.44.174.254
country_id: 357994
description:
2026-01-05 09:26:30 dovecot_plain authenticator failed for H=(fotor) [102.44.174.254]:58302: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.60.51.173
country_id: 3686110
description:
Jan  5 09:28:02 host2 sshd[205973]: Disconnected from invalid user claude 190.60.51.173 port 45476 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 168.228.127.7
country_id: 3686110
description:
Jan  5 09:27:39 host2 sshd[205634]: Disconnected from invalid user teamspeak 168.228.127.7 port 47458 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.228.127.7
country_id: 3686110
description:
Jan  5 09:28:18 host2 sshd[206198]: Disconnected from invalid user ubuntu 168.228.127.7 port 46092 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.60.51.173
country_id: 3686110
description:
Jan  5 09:28:40 host2 sshd[206451]: Disconnected from invalid user wordpress 190.60.51.173 port 59280 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.60.51.173
country_id: 3686110
description:
Jan  5 09:29:17 host2 sshd[206945]: Disconnected from invalid user ftpuser 190.60.51.173 port 49074 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.228.127.7
country_id: 3686110
description:
Jan  5 09:29:36 host2 sshd[207202]: Disconnected from invalid user claude 168.228.127.7 port 35640 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 09:32:05 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<l34oH5xHzumOq2dI>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.117
country_id: 6252001
description:
Jan  5 09:32:53 host2 pure-ftpd[209416]: (?@147.185.132.117) [INFO] New connection from 147.185.132.117


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 09:38:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<oDWYNZxHCOojupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 133.117.74.174
country_id: 1861060
description:
Jan  5 09:38:58 host2 sshd[214257]: Disconnected from invalid user william 133.117.74.174 port 59012 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 09:40:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<5+oQPJxHnvKuijvy>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 133.117.74.174
country_id: 1861060
description:
Jan  5 09:40:56 host2 sshd[216115]: Disconnected from invalid user aryan 133.117.74.174 port 54182 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 09:41:21 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<info@seyawin.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<BMosQJxHaNFCdMzo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 133.117.74.174
country_id: 1861060
description:
Jan  5 09:42:02 host2 sshd[217124]: Disconnected from invalid user scp 133.117.74.174 port 48900 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.0.189.231
country_id: 3469034
description:
Jan  5 09:43:33 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=138.0.189.231, lip=66.85.158.91, TLS, session=<5xA0R5xHx7OKAL3n>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 2.136.115.209
country_id: 2510769
description:
Jan  5 09:43:51 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<charanaw>, method=PLAIN, rip=2.136.115.209, lip=66.85.158.91, TLS, session=<AEtbSJxHnNUCiHPR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.107.158
country_id: 226074
description:
2026-01-05 09:48:31 dovecot_login authenticator failed for H=([196.0.107.158]) [196.0.107.158]:38637: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.250.78
country_id: 290557
description:
2026-01-05 09:48:45 dovecot_login authenticator failed for H=([94.205.250.78]) [94.205.250.78]:57033: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  5 09:49:38 host2 sshd[224624]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 09:49:42 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<Rr4pXpxHeuNnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 09:49:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<ni1RXpxH8LpCdMzo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.3.42.126
country_id: 130758
description:
Jan  5 09:53:39 host2 sshd[228250]: Disconnected from invalid user geek 62.3.42.126 port 55542 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 09:54:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<ugo4cJxHYJtA46ZK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.50
country_id: 6252001
description:
Jan  5 09:55:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.50, lip=66.85.158.91, TLS: Connection closed, session=<1e2lcpxHJOSnXpIy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.173.58.47
country_id: 6252001
description:
2026-01-05 09:57:01 dovecot_plain authenticator failed for H=c-67-173-58-47.hsd1.il.comcast.net (comble) [67.173.58.47]:48230: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.40
country_id: 3469034
description:
Jan  5 09:57:33 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=177.44.71.40, lip=66.85.158.91, TLS, session=<W5UleZxH/OCxLEco>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.72.78.204
country_id: 3469034
description:
Jan  5 09:57:10 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=177.72.78.204, lip=66.85.158.91, TLS, session=<NIbZd5xHJL6xSE7M>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 167.99.122.86
country_id: 6252001
description:
Jan  5 09:58:33 host2 sshd[232839]: Disconnected from invalid user administrator 167.99.122.86 port 57316 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.3.42.126
country_id: 130758
description:
Jan  5 09:59:19 host2 sshd[233501]: Disconnected from invalid user claude 62.3.42.126 port 57506 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.122.86
country_id: 6252001
description:
Jan  5 09:59:33 host2 sshd[233689]: Disconnected from invalid user roy 167.99.122.86 port 41294 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.3.42.126
country_id: 130758
description:
Jan  5 09:59:53 host2 sshd[233904]: Disconnected from invalid user claude 62.3.42.126 port 48194 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.123.109.114
country_id: 732800
description:
Jan  5 10:00:10 host2 sshd[234371]: Invalid user sivagnanamfoundation from 93.123.109.114 port 58492


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 10:01:34 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<Gj+XiJxHzoKOq2dI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.73
country_id: 6252001
description:
Jan  5 10:02:30 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=147.185.132.73, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<OJAQjJxHK8qTuYRJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  5 10:04:08 host2 sshd[238338]: Disconnected from invalid user admin 2.57.121.112 port 44884 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  5 10:04:17 host2 pure-ftpd[238490]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  5 10:09:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@venee.lk>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<f8iRo5xHSsUFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 10:09:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<03bGpZxH0pEjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.226.139.139
country_id: 1643084
description:
Jan  5 10:09:49 host2 sshd[245282]: Disconnected from invalid user fred 103.226.139.139 port 41726 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 10:10:32 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<O2mnqJxHMjuuijvy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.107.180
country_id: 1269750
description:
2026-01-05 10:12:45 dovecot_login authenticator failed for H=(static.ill.117.250.107.180.bsnl.co.in) [117.250.107.180]:37812: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 10:14:26 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<info@seyawin.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<Hrl3tpxHaphCdMzo>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 129.154.42.120
country_id: 1269750
description:
Jan  5 10:16:04 host2 sshd[252417]: Disconnected from invalid user tempuser 129.154.42.120 port 35706 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.154.42.120
country_id: 1269750
description:
Jan  5 10:15:27 host2 sshd[252105]: Disconnected from invalid user appltest 129.154.42.120 port 54684 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.226.139.139
country_id: 1643084
description:
Jan  5 10:15:28 host2 sshd[252077]: Disconnected from invalid user student1 103.226.139.139 port 44256 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.154.42.120
country_id: 1269750
description:
Jan  5 10:16:39 host2 sshd[252748]: Disconnected from invalid user nick 129.154.42.120 port 30394 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.188.0.71
country_id: 3996063
description:
Jan  5 10:16:49 host2 sshd[252850]: Disconnected from invalid user claude 187.188.0.71 port 45142 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.140.19.22
country_id: 1269750
description:
Jan  5 10:17:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<admin@maximsholdings.com>, method=PLAIN, rip=103.140.19.22, lip=66.85.158.91, session=<gKR8wJxH2NFnjBMW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.123.109.114
country_id: 732800
description:
Jan  5 10:16:17 host2 sshd[252483]: Invalid user sivagnanamfoundation from 93.123.109.114 port 39204


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 105.27.148.94
country_id: 192950
description:
Jan  5 10:17:33 host2 sshd[253711]: Disconnected from invalid user kali 105.27.148.94 port 60032 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.226.139.139
country_id: 1643084
description:
Jan  5 10:17:51 host2 sshd[253970]: Disconnected from invalid user zimbra 103.226.139.139 port 57538 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.188.0.71
country_id: 3996063
description:
Jan  5 10:19:01 host2 sshd[255224]: Disconnected from invalid user puppet 187.188.0.71 port 47754 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 130.211.126.21
country_id: 6252001
description:
Jan  5 10:19:36 host2 pure-ftpd[255984]: (?@130.211.126.21) [INFO] New connection from 130.211.126.21


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.103.245.7
country_id: 1819730
description:
Jan  5 10:20:05 host2 sshd[256556]: Disconnected from invalid user claude 103.103.245.7 port 33414 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 105.27.148.94
country_id: 192950
description:
Jan  5 10:20:10 host2 sshd[256606]: Disconnected from invalid user claude 105.27.148.94 port 44530 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.118.150.20
country_id: 3686110
description:
Jan  5 10:20:42 host2 sshd[257134]: Disconnected from invalid user sunil 200.118.150.20 port 40418 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.118.114.22
country_id: 1269750
description:
Jan  5 10:21:36 host2 sshd[257653]: Disconnected from invalid user claude 103.118.114.22 port 38476 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 105.27.148.94
country_id: 192950
description:
Jan  5 10:21:38 host2 sshd[257659]: Disconnected from invalid user ismail 105.27.148.94 port 43874 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 10:23:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 17 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<uUnM1JxHKJRCdMzo>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.118.114.22
country_id: 1269750
description:
Jan  5 10:22:41 host2 sshd[258029]: Disconnected from invalid user comercial 103.118.114.22 port 50186 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.118.114.22
country_id: 1269750
description:
Jan  5 10:24:17 host2 sshd[258849]: Disconnected from invalid user claude 103.118.114.22 port 57106 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 105.27.148.94
country_id: 192950
description:
Jan  5 10:24:18 host2 sshd[258851]: Disconnected from invalid user claude 105.27.148.94 port 42458 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 10:25:14 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 8 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<hc/g3JxHkLpnmud6>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 200.118.150.20
country_id: 3686110
description:
Jan  5 10:28:28 host2 sshd[261476]: Received disconnect from 200.118.150.20 port 60496:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.118.150.20
country_id: 3686110
description:
Jan  5 10:28:28 host2 sshd[261476]: Disconnected from invalid user bitrix 200.118.150.20 port 60496 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 10:28:40 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<f46B6ZxHpuxA46ZK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.103.245.7
country_id: 1819730
description:
Jan  5 10:28:43 host2 sshd[261753]: Disconnected from invalid user tutor 103.103.245.7 port 58818 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 10:30:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<EOPx75xHGOmOq2dI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.123.109.114
country_id: 732800
description:
Jan  5 10:31:49 host2 sshd[264347]: Invalid user sivagnanamfoundation from 93.123.109.114 port 53728


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2026-01-05 10:31:23 dovecot_plain authenticator failed for H=c-73-196-144-25.hsd1.nj.comcast.net (perwor) [73.196.144.25]:59048: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.103.245.7
country_id: 1819730
description:
Jan  5 10:33:29 host2 sshd[265388]: Disconnected from invalid user claude 103.103.245.7 port 33252 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.172.189.13
country_id: 3017382
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 217.172.189.13 - lezzarotech "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 10:40:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<VAhOFZ1HnDIjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 10:41:27 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<8lQ5F51HfPeuijvy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2026-01-05 10:43:12 dovecot_plain authenticator failed for H=c-71-224-169-28.hsd1.pa.comcast.net (liter) [71.224.169.28]:45014: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  5 10:44:42 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<JtvWIp1HqsIFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 10:46:58 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<LzD1Kp1HmOhCdMzo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.123.109.114
country_id: 732800
description:
Jan  5 10:47:41 host2 sshd[279440]: Invalid user sivagnanamfoundation from 93.123.109.114 port 51216


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2026-01-05 10:50:36 dovecot_plain authenticator failed for H=c-24-127-53-61.hsd1.mi.comcast.net (clagly) [24.127.53.61]:37376: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 10:55:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<SKVdSZ1H3oxCdMzo>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  5 10:56:24 host2 sshd[287205]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 11:00:05 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<lRvYWZ1HeKBnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 10:59:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<7Dg4WZ1HFNqOq2dI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.119
country_id: 6252001
description:
Jan  5 10:59:56 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.119, lip=66.85.158.91, TLS: Connection closed, session=<BoVxWZ1HdhJChJl3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2026-01-05 11:00:31 dovecot_plain authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net (subcon) [71.62.34.216]:40396: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.161.55.155
country_id: 6252001
description:
Jan  5 11:02:33 host2 sshd[293193]: Disconnected from invalid user logview 203.161.55.155 port 56032 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 11:02:56 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<MnwIZJ1HTIVA46ZK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.161.55.155
country_id: 6252001
description:
Jan  5 11:04:37 host2 sshd[295436]: Disconnected from invalid user king 203.161.55.155 port 60990 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 203.161.55.155
country_id: 6252001
description:
Jan  5 11:05:12 host2 sshd[296126]: Disconnected from invalid user claude 203.161.55.155 port 59584 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.161.55.155
country_id: 6252001
description:
Jan  5 11:05:45 host2 sshd[296555]: Disconnected from invalid user openproject 203.161.55.155 port 59038 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  5 11:08:08 host2 pure-ftpd[298965]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2026-01-05 11:08:02 dovecot_login authenticator failed for H=([178.250.191.189]) [178.250.191.189]:39350: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.33
country_id: 1819730
description:
2026-01-05 11:08:19 dovecot_login authenticator failed for H=(223-197-145-33.static.imsbiz.com) [223.197.145.33]:61160: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2026-01-05 11:08:52 dovecot_plain authenticator failed for H=c-68-40-189-43.hsd1.mi.comcast.net (culanessis) [68.40.189.43]:33598: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-01-05 11:09:27 dovecot_plain authenticator failed for H=(lasheaed) [102.53.15.17]:37416: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.138
country_id: 6252001
description:
Jan  5 11:09:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 16 secs): user=<>, rip=66.132.153.138, lip=66.85.158.91, TLS handshaking: Connection closed, session=<SVMnfZ1Hus9ChJmK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.222.166.212
country_id: 2077456
description:
2026-01-05 11:10:26 dovecot_login authenticator failed for H=(180-222-166-212.static.dsl.net.au) [180.222.166.212]:53747: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.50
country_id: 1269750
description:
2026-01-05 11:10:49 dovecot_login authenticator failed for H=(nsg-static-145.58.71.182.airtel.in) [27.123.102.50]:51818: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 11:11:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<ZPsDhJ1H2pKuijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 11:12:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<+pPWhZ1HVsojupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-05 11:16:07 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:52675: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 102.54.238.57 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.121.72.162
country_id: 3469034
description:
Jan  5 11:18:36 host2 sshd[308539]: Disconnected from invalid user acct 168.121.72.162 port 42294 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.10.250
country_id: 226074
description:
Jan  5 11:19:59 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@jrdc.lk>, method=PLAIN, rip=196.0.10.250, lip=66.85.158.91, TLS, session=<kv7wn51HWq/EAAr6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.48.181.58
country_id: 719819
description:
Jan  5 11:19:54 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@jrdc.lk>, method=PLAIN, rip=178.48.181.58, lip=66.85.158.91, TLS, session=<n/Pdn51HE8uyMLU6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.93.165.5
country_id: 3469034
description:
Jan  5 11:19:57 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@jrdc.lk>, method=PLAIN, rip=177.93.165.5, lip=66.85.158.91, TLS, session=<DrTtn51Hz56xXaUF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.107.250
country_id: 3469034
description:
Jan  5 11:19:58 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@jrdc.lk>, method=PLAIN, rip=191.53.107.250, lip=66.85.158.91, TLS, session=<CHXwn51H85+/NWv6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.123.109.114
country_id: 732800
description:
Jan  5 11:19:28 host2 sshd[309320]: Invalid user sivagnanamfoundation from 93.123.109.114 port 48018


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.213.195.198
country_id: 1269750
description:
Jan  5 11:19:57 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@jrdc.lk>, method=PLAIN, rip=103.213.195.198, lip=66.85.158.91, TLS, session=<7k/vn51HxNVn1cPG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.11.143
country_id: 690791
description:
Jan  5 11:20:15 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=176.103.11.143, lip=66.85.158.91, TLS, session=<5JQkoZ1HTeCwZwuP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.26
country_id: 3175395
description:
Jan  5 11:20:17 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.197.9.26, lip=66.85.158.91, TLS, session=<OtwyoZ1HiL+5xQka>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.49.198
country_id: 226074
description:
Jan  5 11:20:20 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=196.0.49.198, lip=66.85.158.91, TLS, session=<WFFFoZ1HK+7EADHG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.118.35.3
country_id: 1269750
description:
Jan  5 11:20:33 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info>, method=PLAIN, rip=45.118.35.3, lip=66.85.158.91, TLS, session=<rQbhoZ1HnoktdiMD>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 168.121.72.162
country_id: 3469034
description:
Jan  5 11:21:09 host2 sshd[311340]: Disconnected from invalid user ali 168.121.72.162 port 54438 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.66
country_id: 3865483
description:
Jan  5 11:20:16 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=179.0.251.66, lip=66.85.158.91, TLS, session=<BRYLoZ1HhdqzAPtC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 11:20:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shop@seyawin.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<36E3op1HPulCdMzo>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 96.78.175.36
country_id: 6252001
description:
Jan  5 11:25:06 host2 sshd[315351]: Disconnected from invalid user claude 96.78.175.36 port 39550 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.121.72.162
country_id: 3469034
description:
Jan  5 11:24:24 host2 sshd[314624]: Disconnected from invalid user qendrimellupo 168.121.72.162 port 57242 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 96.78.175.36
country_id: 6252001
description:
Jan  5 11:24:32 host2 sshd[314765]: Disconnected from invalid user acct 96.78.175.36 port 34984 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 96.78.175.36
country_id: 6252001
description:
Jan  5 11:25:43 host2 sshd[316127]: Disconnected from invalid user bot 96.78.175.36 port 48642 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.50.142.82
country_id: 3469034
description:
Jan  5 11:25:56 host2 sshd[316268]: Disconnected from invalid user sysadmin 189.50.142.82 port 56517 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.174.115.91
country_id: 1643084
description:
Jan  5 11:25:29 host2 sshd[315762]: Disconnected from invalid user sysadmin 103.174.115.91 port 46160 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.164
country_id: 6252001
description:
Jan  5 11:27:01 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.164, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<QAZLup1HCMDN0h+k>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.174.115.91
country_id: 1643084
description:
Jan  5 11:27:52 host2 sshd[317747]: Disconnected from invalid user ubuntu 103.174.115.91 port 41464 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 11:28:53 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shop@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<DiTXwJ1HXKdCdMzo>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 66.116.204.232
country_id: 1269750
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[66.116.204.232] [Remote Port]=[42844] [Authentication Database]=[mail] [Username]=[shop@kiriaswanu.com] (10/10 failures) (blocked until [Tue Jan  6 05:58:51 2026 UTC/Tue Jan  6 11:28:51 2026 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.248.243.181
country_id: 2542007
description:
2026-01-05 11:30:02 dovecot_plain authenticator failed for H=(stnes) [41.248.243.181]:51408: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 11:29:26 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<IPjUwp1HxMGOq2dI>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.231.222.161
country_id: 3190538
description:
Jan  5 11:30:32 host2 pure-ftpd[320350]: (?@91.231.222.161) [INFO] New connection from 91.231.222.161


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.57.172
country_id: 1643084
description:
Jan  5 11:32:24 host2 sshd[321834]: Disconnected from invalid user ubuntu 103.179.57.172 port 50282 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.50.142.82
country_id: 3469034
description:
Jan  5 11:32:52 host2 sshd[322465]: Disconnected from invalid user app 189.50.142.82 port 56305 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.163
country_id: 6252001
description:
Jan  5 11:34:16 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=162.216.149.163, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<k4BC1J1HQMCi2JWj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.163
country_id: 6252001
description:
Jan  5 11:35:21 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=162.216.149.163, lip=66.85.158.92, TLS: read(size=429) failed: Connection reset by peer, session=<3+4V2J1HQv+i2JWj>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.50.142.82
country_id: 3469034
description:
Jan  5 11:35:30 host2 sshd[324854]: Disconnected from invalid user acer 189.50.142.82 port 55731 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 11:35:34 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<H5rB2J1HqLxnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 11:37:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<WQq7351H/LNA46ZK>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  5 11:39:11 host2 sshd[327928]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.245.122.12
country_id: 6252001
description:
[2026-01-05 11:38:25 +0530] info [cpaneld] 157.245.122.12 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  5 11:38:56 host2 sshd[327670]: Disconnected from invalid user admin 2.57.121.112 port 15546 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.251.103.9
country_id: 2510769
description:
2026-01-05 11:40:47 dovecot_login authenticator failed for H=85.251.103.9.dyn.user.ono.com [85.251.103.9]:52251: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.150
country_id: 1269750
description:
2026-01-05 11:41:28 dovecot_login authenticator failed for H=(nsg-corporate-73.22.185.122.airtel.in) [182.78.64.150]:51302: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.163
country_id: 6252001
description:
Jan  5 11:41:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.163, lip=66.85.158.92, TLS, session=<zBOW751HPuei2JWj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.255.206.216
country_id: 3469034
description:
Jan  5 11:43:22 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=138.255.206.216, lip=66.85.158.91, TLS, session=<Xf6x851Ha4iK/87Y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 11:43:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<uTr59Z1HeF6uijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.106.156
country_id: 3865483
description:
Jan  5 11:43:43 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw>, method=PLAIN, rip=45.238.106.156, lip=66.85.158.91, TLS, session=<bKDw9J1HaI8t7mqc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 11:43:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<nzqa9p1HKnwjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.189
country_id: 1733045
description:
2026-01-05 11:45:04 dovecot_login authenticator failed for H=([49.124.155.189]) [49.124.155.189]:58202: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.101.146
country_id: 1269750
description:
2026-01-05 11:45:45 dovecot_login authenticator failed for H=([125.22.70.217]) [27.123.101.146]:35046: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.202
country_id: 6252001
description:
Jan  5 11:47:10 host2 pure-ftpd[335685]: (?@198.235.24.202) [INFO] New connection from 198.235.24.202


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.78
country_id: 1733045
description:
2026-01-05 11:52:38 dovecot_login authenticator failed for H=([49.124.151.78]) [49.124.151.78]:57298: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.220.30
country_id: 1269750
description:
2026-01-05 11:52:56 dovecot_login authenticator failed for H=([125.19.220.30]) [125.19.220.30]:60806: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 11:53:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<3RDRGZ5HspZCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.156.8
country_id: 690791
description:
Jan  5 11:56:38 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=37.221.156.8, lip=66.85.158.91, TLS, session=<IF46I55HP8sl3ZwI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.41
country_id: 3865483
description:
Jan  5 11:57:00 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=179.0.251.41, lip=66.85.158.91, TLS, session=<6MtlJJ5HqJOzAPsp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.253.95
country_id: 6252001
description:
Jan  5 11:58:53 host2 sshd[346408]: Disconnected from invalid user claude 199.195.253.95 port 49892 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 11:58:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<cNQ/LJ5HjLuOq2dI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.248.191
country_id: 6252001
description:
Jan  5 12:01:19 host2 sshd[348870]: Disconnected from invalid user student 199.195.248.191 port 40884 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.253.95
country_id: 6252001
description:
Jan  5 12:01:38 host2 sshd[349087]: Disconnected from invalid user user 199.195.253.95 port 39506 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 135.222.40.122
country_id: 6252001
description:
Jan  5 12:02:03 host2 pure-ftpd[349431]: (?@135.222.40.122) [INFO] New connection from 135.222.40.122


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 199.195.248.191
country_id: 6252001
description:
Jan  5 12:02:43 host2 sshd[349916]: Disconnected from invalid user f 199.195.248.191 port 37034 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 12:02:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<ChisOJ5HDOlCdMzo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.253.95
country_id: 6252001
description:
Jan  5 12:04:21 host2 sshd[351434]: Disconnected from invalid user test 199.195.253.95 port 57350 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.253.95
country_id: 6252001
description:
Jan  5 12:06:15 host2 sshd[353190]: Disconnected from invalid user username 199.195.253.95 port 35444 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  5 12:08:04 host2 pure-ftpd[354819]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.91.125.252
country_id: 290557
description:
Jan  5 12:10:08 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=47.91.125.252, lip=66.85.158.91, session=<+PCDVJ5HWqEvW338>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 12:11:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<mltdWJ5HLpFnmud6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 199.195.253.95
country_id: 6252001
description:
Jan  5 12:11:23 host2 sshd[358027]: Disconnected from invalid user claude 199.195.253.95 port 42900 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.210.167
country_id: 6251999
description:
Jan  5 12:11:19 host2 sshd[357991]: Disconnected from invalid user zhang 158.69.210.167 port 56182 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.96.179.9
country_id: 6251999
description:
Jan  5 12:14:03 host2 sshd[360680]: Disconnected from invalid user nagios 172.96.179.9 port 59194 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.254.103.32
country_id: 3017382
description:
Jan  5 12:14:26 host2 sshd[360957]: Disconnected from invalid user claude 51.254.103.32 port 45400 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 12:15:36 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<SR/1Z55H1DEjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 12:15:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<V5UAaZ5HoKSuijvy>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.96.179.9
country_id: 6251999
description:
Jan  5 12:17:27 host2 sshd[364230]: Disconnected from invalid user pranav 172.96.179.9 port 55666 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.254.103.32
country_id: 3017382
description:
Jan  5 12:17:48 host2 sshd[364556]: Disconnected from invalid user vmail 51.254.103.32 port 33508 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.210.167
country_id: 6251999
description:
Jan  5 12:18:04 host2 sshd[364803]: Disconnected from invalid user nagios 158.69.210.167 port 33708 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.254.103.32
country_id: 3017382
description:
Jan  5 12:18:50 host2 sshd[365375]: Disconnected from invalid user smart 51.254.103.32 port 46238 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.254.103.32
country_id: 3017382
description:
Jan  5 12:20:28 host2 sshd[366953]: Disconnected from invalid user ubuntu 51.254.103.32 port 35126 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 172.96.179.9
country_id: 6251999
description:
Jan  5 12:20:33 host2 sshd[367042]: Received disconnect from 172.96.179.9 port 33262:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.96.179.9
country_id: 6251999
description:
Jan  5 12:20:33 host2 sshd[367042]: Disconnected from invalid user headscale 172.96.179.9 port 33262 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 12:27:16 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@seyawin.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<l1yskZ5HYMNCdMzo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.183
country_id: 6252001
description:
Jan  5 12:28:26 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.183, lip=66.85.158.92, TLS, session=<xNL2lZ5HzP+TuYS3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 12:28:42 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<Zw/Ilp5H9KuOq2dI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.123.109.114
country_id: 732800
description:
Jan  5 12:31:25 host2 sshd[377387]: Invalid user sivagnanamfoundation from 93.123.109.114 port 52378


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 12:35:56 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<EY6psJ5HMOpCdMzo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  5 12:36:09 host2 sshd[381793]: Disconnected from invalid user admin 2.57.121.112 port 8123 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.231.222.160
country_id: 3190538
description:
Jan  5 12:37:56 host2 pure-ftpd[383425]: (?@91.231.222.160) [INFO] New connection from 91.231.222.160


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-05 12:44:09 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (spatedner) [87.103.126.54]:38894: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.89.53
country_id: 3932488
description:
Jan  5 12:44:37 host2 sshd[389793]: Disconnected from invalid user ubuntu 161.132.89.53 port 56920 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  5 12:46:19 host2 sshd[391990]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 12:47:02 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<ybRX2J5HFIVnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.89.53
country_id: 3932488
description:
Jan  5 12:46:56 host2 sshd[392950]: Disconnected from invalid user claude 161.132.89.53 port 36362 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 12:47:14 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<X5YL2Z5HYGAjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 12:47:16 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<8pck2Z5HMLGuijvy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.123.109.114
country_id: 732800
description:
Jan  5 12:47:17 host2 sshd[393323]: Invalid user sivagnanamfoundation from 93.123.109.114 port 60902


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 12:47:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<ll1w2Z5HqIZA46ZK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  5 12:47:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<plat2Z5HtoYDhBfJ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.132.89.53
country_id: 3932488
description:
Jan  5 12:48:16 host2 sshd[394197]: Disconnected from invalid user claude 161.132.89.53 port 35650 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  5 12:49:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<6AjZ4J5HYI4DhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.89.53
country_id: 3932488
description:
Jan  5 12:49:33 host2 sshd[395221]: Disconnected from invalid user github 161.132.89.53 port 34930 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  5 12:50:34 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<5NsV5Z5HoMADhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  5 12:51:47 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<C7576Z5HkNwDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.69.233
country_id: 1269750
description:
2026-01-05 12:51:56 dovecot_login authenticator failed for H=([122.160.69.233]) [122.160.69.233]:57822: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 157.230.219.203
country_id: 6252001
description:
Jan  5 12:52:04 host2 pure-ftpd[398147]: (?@157.230.219.203) [INFO] New connection from 157.230.219.203


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.118.138
country_id: 3144096
description:
2026-01-05 12:51:19 dovecot_login authenticator failed for H=(cm-46.212.118.138.get.no) [46.212.118.138]:43969: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.198.42.139
country_id: 6252001
description:
Jan  5 12:51:34 host2 sshd[397679]: Disconnected from invalid user claude 159.198.42.139 port 60388 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  5 12:52:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<0fRU655HFI0DhBfJ>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  5 12:52:23 host2 dovecot[1170291]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<S9OW655HVJsDhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.198.42.139
country_id: 6252001
description:
Jan  5 12:52:40 host2 sshd[398653]: Disconnected from invalid user sonar 159.198.42.139 port 52222 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 159.198.42.139
country_id: 6252001
description:
Jan  5 12:53:15 host2 sshd[399204]: Disconnected from invalid user delete 159.198.42.139 port 40968 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  5 12:53:21 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<D84Q755HWJADhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.46
country_id: 1269750
description:
2026-01-05 12:55:08 dovecot_login authenticator failed for H=([182.79.95.231]) [152.52.244.46]:36848: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2026-01-05 12:55:18 dovecot_login authenticator failed for H=([178.250.191.189]) [178.250.191.189]:37506: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.234.106.215
country_id: 3865483
description:
2026-01-05 12:55:39 dovecot_login authenticator failed for H=(201-234-106-215.static.impsat.net.ar) [201.234.106.215]:45339: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 12:58:26 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<8uYcAZ9HDtmOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 13:01:02 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<A3FrCp9HsIxCdMzo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.230.228.16
country_id: 6252001
description:
2026-01-05 13:01:08 dovecot_plain authenticator failed for H=c-71-230-228-16.hsd1.de.comcast.net (hetwales) [71.230.228.16]:57856: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2026-01-05 13:06:08 dovecot_plain authenticator failed for H=(panoloman) [192.34.128.202]:49844: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.162
country_id: 2993457
description:
Jan  5 13:07:59 host2 pure-ftpd[415355]: (?@194.165.16.162) [INFO] New connection from 194.165.16.162


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 13:09:48 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<5em/KZ9HMohCdMzo>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  5 13:12:12 host2 pure-ftpd[420787]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.36.70.240
country_id: 3175395
description:
Jan  5 13:12:18 host2 sshd[420879]: Disconnected from invalid user deployer 151.36.70.240 port 18534 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.193
country_id: 6252001
description:
Jan  5 13:13:09 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.193, lip=66.85.158.92, TLS, session=<uMblNZ9HVObG6xjB>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.36.70.240
country_id: 3175395
description:
Jan  5 13:15:00 host2 sshd[424273]: Disconnected from invalid user claude 151.36.70.240 port 18664 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.87.18
country_id: 1269750
description:
2026-01-05 13:16:11 dovecot_login authenticator failed for H=([182.79.87.18]) [182.79.87.18]:33292: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.219
country_id: 798544
description:
2026-01-05 13:16:28 dovecot_login authenticator failed for H=89-67-37-219.dynamic.play.pl [89.67.37.219]:41624: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.36.70.240
country_id: 3175395
description:
Jan  5 13:16:49 host2 sshd[426722]: Disconnected from invalid user ubuntu 151.36.70.240 port 18446 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-05 13:17:37 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (asswale) [87.103.126.54]:37724: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.120
country_id: 6252001
description:
Jan  5 13:17:46 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.120, lip=66.85.158.91, TLS: Connection closed, session=<n0VeRp9HkC9ChJl4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 13:18:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<bbwuSJ9HOsKuijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 13:18:58 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<h8mPSp9H9JUjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 13:22:32 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<UdRPV59HNs1A46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 13:23:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<FPgHWp9H1KRnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 13:28:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<Has+bJ9H4tOOq2dI>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  5 13:29:13 host2 sshd[440454]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 13:35:08 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@seyawin.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<9EVlhJ9HgIxCdMzo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  5 13:37:35 host2 sshd[449054]: Disconnected from invalid user user 2.57.121.25 port 31419 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.123.109.114
country_id: 732800
description:
Jan  5 13:41:30 host2 sshd[453167]: Invalid user sivagnanamfoundation from 93.123.109.114 port 38866


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 13:43:56 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<d67Ro59H5NxCdMzo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.32.33.161
country_id: 3686110
description:
Jan  5 13:44:22 host2 sshd[455414]: Disconnected from invalid user claude 179.32.33.161 port 54058 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.81.211.221
country_id: 6252001
description:
2026-01-05 13:46:01 dovecot_login authenticator failed for H=vps-45907be8.vps.ovh.us [51.81.211.221]:37672: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.32.33.161
country_id: 3686110
description:
Jan  5 13:45:31 host2 sshd[456654]: Disconnected from invalid user scanner 179.32.33.161 port 44366 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.186.40.250
country_id: 3895114
description:
Jan  5 13:45:40 host2 sshd[456767]: Disconnected from invalid user loki 201.186.40.250 port 33234 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.32.33.161
country_id: 3686110
description:
Jan  5 13:46:13 host2 sshd[457774]: Disconnected from invalid user holu 179.32.33.161 port 57824 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.40.63
country_id: 1819730
description:
2026-01-05 13:46:20 dovecot_login authenticator failed for H=063.40.246.220.static.netvigator.com [220.246.40.63]:57839: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.186.40.250
country_id: 3895114
description:
Jan  5 13:46:59 host2 sshd[458452]: Disconnected from invalid user al 201.186.40.250 port 55904 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.32.33.161
country_id: 3686110
description:
Jan  5 13:48:04 host2 sshd[459521]: Disconnected from invalid user test1 179.32.33.161 port 41742 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.186.40.250
country_id: 3895114
description:
Jan  5 13:48:47 host2 sshd[460242]: Disconnected from invalid user salon 201.186.40.250 port 33442 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.186.40.250
country_id: 3895114
description:
Jan  5 13:48:11 host2 sshd[459607]: Disconnected from invalid user claude 201.186.40.250 port 50342 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 13:49:32 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<CDjmt59HmJiuijvy>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 87.236.176.202
country_id: 2635167
description:
Jan  5 13:50:02 host2 pure-ftpd[461727]: (?@87.236.176.202) [INFO] New connection from 87.236.176.202


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 13:51:02 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<BkI3vZ9HmlsjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  5 13:50:51 host2 sshd[462619]: Disconnected from invalid user admin 2.57.121.112 port 14226 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.123.109.114
country_id: 732800
description:
Jan  5 13:57:19 host2 sshd[470504]: Invalid user sivagnanamfoundation from 93.123.109.114 port 42184


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 13:58:02 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<FoVD1p9HfudA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 13:58:42 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<Mpqh2J9HEpeOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 13:59:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<DadF3J9HMMNnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.36.254
country_id: 3469034
description:
Jan  5 14:00:14 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=191.240.36.254, lip=66.85.158.91, TLS, session=<iusj3Z9HXNS/8CT+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.32
country_id: 3175395
description:
Jan  5 14:00:31 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<charanaw>, method=PLAIN, rip=185.197.9.32, lip=66.85.158.91, TLS, session=<XPZR3p9Hp565xQkg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  5 14:04:09 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<+7Y97J9HMOMDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  5 14:06:46 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<u7Kg9Z9HrKADgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.152
country_id: 6252001
description:
Jan  5 14:07:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.152, lip=66.85.158.92, session=<iXHC959H7YlAPsWY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  5 14:08:01 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<nwIf+p9HJOUDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  5 14:08:12 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<GoC/+p9Hoo4DgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 14:09:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<SF8c/p9H2o9CdMzo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  5 14:10:35 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<LTVCA6BHGMEDgmBb>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  5 14:10:37 host2 dovecot[1170291]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<JQNhA6BHJMEDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2026-01-05 14:10:41 dovecot_plain authenticator failed for H=c-98-227-25-115.hsd1.il.comcast.net (sessenne) [98.227.25.115]:58746: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  5 14:13:31 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<ALq/DaBHsI4DgmBb>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  5 14:16:17 host2 pure-ftpd[489039]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.202.108.124
country_id: 798544
description:
Jan  5 14:17:15 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=85.202.108.124, lip=66.85.158.91, TLS, session=<3+YhGqBH485Vymx8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.151
country_id: 3469034
description:
Jan  5 14:17:36 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=177.44.96.151, lip=66.85.158.91, TLS, session=<ZwhFG6BHqpyxLGCX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 14:17:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<aKZLHaBHjIlCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 14:21:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<mzVpKKBHlviuijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Jan  5 14:21:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<tu3TKKBHGNAFhH+s>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  5 14:21:34 host2 sshd[494167]: Disconnected from invalid user user 2.57.121.25 port 38671 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 14:23:05 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<aS3WL6BHQmAjupN+>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.83.39.144
country_id: 690791
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 77.83.39.144 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 77.83.39.144
country_id: 690791
description:
Jan  5 14:24:27 host2 sshd[497170]: Invalid user cloudtourssrilan_travel from 77.83.39.144 port 60374


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.174.244.235
country_id: 6252001
description:
Jan  5 14:25:52 host2 pure-ftpd[498906]: (?@172.174.244.235) [INFO] New connection from 172.174.244.235


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2026-01-05 14:28:10 dovecot_plain authenticator failed for H=c-73-168-136-150.hsd1.il.comcast.net (kupanemism) [73.168.136.150]:39394: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 14:29:01 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<rEwZRaBHAqmOq2dI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-05 14:30:09 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:52181: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.22
country_id: 1733045
description:
2026-01-05 14:32:30 dovecot_login authenticator failed for H=([49.124.153.22]) [49.124.153.22]:55014: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 14:33:35 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<gV9iVaBHypxA46ZK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.123.109.114
country_id: 732800
description:
Jan  5 14:34:36 host2 sshd[507845]: Invalid user sivagnanamfoundation from 93.123.109.114 port 60118


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  5 14:35:50 host2 sshd[509030]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 14:35:42 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<TaTzXKBHIoFnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 14:43:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<qlqbd6BHCp5CdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 14:51:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<6SVdlqBH2rxCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 14:52:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<GD+kmKBHfmquijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 14:55:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<7xWwo6BHeNUjupN+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.161
country_id: 2993457
description:
Jan  5 14:57:27 host2 pure-ftpd[530102]: (?@194.165.16.161) [INFO] New connection from 194.165.16.161


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2026-01-05 14:57:45 dovecot_plain authenticator failed for H=c-73-196-144-25.hsd1.nj.comcast.net (nousher) [73.196.144.25]:45290: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.63
country_id: 1733045
description:
2026-01-05 14:58:16 dovecot_login authenticator failed for H=([49.124.153.63]) [49.124.153.63]:41308: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.199.168.119
country_id: 1880251
description:
Jan  5 14:58:28 host2 sshd[531082]: Disconnected from invalid user test 128.199.168.119 port 59216 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.3.203.151
country_id: 1694008
description:
2026-01-05 14:58:40 dovecot_login authenticator failed for H=(122.3.203.151.static.pldt.net) [122.3.203.151]:58807: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 14:59:40 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<+WytsqBHdr+Oq2dI>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 128.199.168.119
country_id: 1880251
description:
Jan  5 14:59:18 host2 sshd[531965]: Disconnected from invalid user test 128.199.168.119 port 44444 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.213.160.153
country_id: 1269750
description:
Jan  5 15:01:05 host2 sshd[533976]: Disconnected from invalid user claude 4.213.160.153 port 47780 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.199.168.119
country_id: 1880251
description:
Jan  5 15:00:53 host2 sshd[533774]: Disconnected from invalid user claude 128.199.168.119 port 43142 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.213.160.153
country_id: 1269750
description:
Jan  5 15:01:43 host2 sshd[534490]: Disconnected from invalid user test 4.213.160.153 port 50436 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 4.213.160.153
country_id: 1269750
description:
Jan  5 15:03:08 host2 sshd[535888]: Disconnected from invalid user admin 4.213.160.153 port 32878 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.213.160.153
country_id: 1269750
description:
Jan  5 15:05:16 host2 sshd[538048]: Disconnected from invalid user claude 4.213.160.153 port 55846 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.123.109.114
country_id: 732800
description:
Jan  5 15:05:59 host2 sshd[538615]: Invalid user sivagnanamfoundation from 93.123.109.114 port 59466


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2026-01-05 15:08:14 dovecot_plain authenticator failed for H=c-73-183-74-177.hsd1.pa.comcast.net (thodionis) [73.183.74.177]:58236: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
country_id: 290557
description:
2026-01-05 15:08:12 dovecot_plain authenticator failed for H=(snamy) [94.206.93.90]:51185: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 15:09:39 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<cnxf1qBHfs5A46ZK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.54.99.236
country_id: 294640
description:
2026-01-05 15:10:42 dovecot_login authenticator failed for H=(2-54-99-236.orange.net.il) [2.54.99.236]:34275: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.110
country_id: 1269750
description:
2026-01-05 15:10:56 dovecot_login authenticator failed for H=(dsl-ncr-dynamic-169.179.23.125.airtelbroadband.in) [125.23.155.110]:40312: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 15:12:26 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<Rl1U4KBHNIZnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.237.113.106
country_id: 587116
description:
2026-01-05 15:14:50 dovecot_login authenticator failed for H=([109.237.113.106]) [109.237.113.106]:55649: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2026-01-05 15:15:15 dovecot_login authenticator failed for H=([189.59.210.1]) [186.215.245.175]:50926: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.219.54
country_id: 1269750
description:
2026-01-05 15:15:45 dovecot_login authenticator failed for H=([125.21.200.57]) [128.185.219.54]:35770: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.194
country_id: 1269750
description:
2026-01-05 15:15:50 dovecot_login authenticator failed for H=([182.95.115.194]) [182.95.115.194]:36338: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.139.77
country_id: 3144096
description:
2026-01-05 15:16:22 dovecot_login authenticator failed for H=([188.124.139.77]) [188.124.139.77]:34827: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.102
country_id: 1269750
description:
2026-01-05 15:16:42 dovecot_login authenticator failed for H=(nsg-corporate-9.90.186.122.airtel.in) [182.95.228.102]:60926: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 15:17:49 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<shop@seyawin.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<d46Q86BHRKtCdMzo>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  5 15:18:36 host2 sshd[552149]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 119.18.52.5
country_id: 1269750
description:
Jan  5 15:18:41 host2 sshd[552205]: Disconnected from invalid user claude 119.18.52.5 port 37790 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  5 15:20:23 host2 pure-ftpd[554023]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.70.82.95
country_id: 1282988
description:
Jan  5 15:20:44 host2 sshd[554277]: Disconnected from invalid user claude 202.70.82.95 port 62882 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.70.82.95
country_id: 1282988
description:
Jan  5 15:21:29 host2 sshd[554865]: Disconnected from invalid user javad 202.70.82.95 port 32608 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.123.109.114
country_id: 732800
description:
Jan  5 15:22:01 host2 sshd[555304]: Invalid user sivagnanamfoundation from 93.123.109.114 port 49284


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.70.82.95
country_id: 1282988
description:
Jan  5 15:22:17 host2 sshd[555503]: Disconnected from invalid user debian 202.70.82.95 port 24128 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 15:23:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<Vi/GB6FHBOyuijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 15:26:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shop@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<inehEaFHiI9CdMzo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2026-01-05 15:27:19 dovecot_plain authenticator failed for H=c-73-168-136-150.hsd1.il.comcast.net (sking) [73.168.136.150]:40868: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 15:27:47 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<rY0rF6FHWJIjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 15:29:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<AouvHqFHVquOq2dI>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.206.225.82
country_id: 6252001
description:
Jan  5 15:39:52 host2 pure-ftpd[572143]: (?@172.206.225.82) [INFO] New connection from 172.206.225.82


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 15:45:37 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<BvjxVqFHiMBA46ZK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.72
country_id: 2186224
description:
2026-01-05 15:46:57 dovecot_login authenticator failed for H=([121.73.163.72]) [121.73.163.72]:55086: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.30.170
country_id: 3144096
description:
2026-01-05 15:47:14 dovecot_login authenticator failed for H=([178.232.30.170]) [178.232.30.170]:40887: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2026-01-05 15:48:05 dovecot_plain authenticator failed for H=(scousnon) [102.53.15.180]:20852: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 15:48:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<nYkBYKFHBsVnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2026-01-05 15:50:34 dovecot_plain authenticator failed for H=c-24-1-200-187.hsd1.il.comcast.net (adjus) [24.1.200.187]:58074: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 15:50:34 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<9bq2aKFHgqNCdMzo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2026-01-05 15:53:27 dovecot_plain authenticator failed for H=c-73-195-211-98.hsd1.nj.comcast.net (myxont) [73.195.211.98]:43254: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 15:54:05 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<AgJKdaFHmt6uijvy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.185.233
country_id: 6252001
description:
Jan  5 15:57:05 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=44.220.185.233, lip=66.85.158.91, TLS handshaking: Connection closed, session=<DZwsgKFHzpks3Lnp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.185.233
country_id: 6252001
description:
Jan  5 15:57:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=44.220.185.233, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Z795gKFHFuIs3Lnp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2026-01-05 15:57:55 dovecot_plain authenticator failed for H=(taragenes) [90.161.217.228]:57028: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 15:59:02 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<bzYAh6FHoIBCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 15:59:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<GZq8iaFHaoOOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 15:59:27 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<PbCDiKFHOksjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  5 15:59:48 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<ZAy3iaFHyt4FhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.242.2
country_id: 1269750
description:
Jan  5 16:08:43 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=103.18.242.2, lip=66.85.158.91, TLS, session=<WZGpqKFHNtZnEvIC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.216.88.150
country_id: 3469034
description:
Jan  5 16:09:05 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=186.216.88.150, lip=66.85.158.91, TLS, session=<z+rqqaFHupi62FiW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 16:21:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<Kpsb2KFHdJBA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 16:23:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<yMzm3aFHbpdCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 16:23:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<yY7y36FHEotnmud6>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  5 16:25:24 host2 sshd[614787]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 16:25:48 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<sy255qFH6oSuijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 16:30:05 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<UcAJ9qFHUOyOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 16:30:58 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<mYs3+aFHdpsjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 16:31:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<XCn8+6FHdspCdMzo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  5 16:36:33 host2 sshd[625292]: Disconnected from invalid user admin 2.57.121.112 port 37225 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.192.123.12
country_id: 6252001
description:
2026-01-05 16:48:31 dovecot_plain authenticator failed for H=(tonst) [199.192.123.12]:43216: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.40.117.9
country_id: 357994
description:
Jan  5 16:50:47 host2 sshd[640748]: Disconnected from invalid user staging 41.40.117.9 port 10080 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.40.117.9
country_id: 357994
description:
Jan  5 16:51:48 host2 sshd[641704]: Disconnected from invalid user dev 41.40.117.9 port 64591 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.40.117.9
country_id: 357994
description:
Jan  5 16:53:29 host2 sshd[643325]: Disconnected from invalid user vijay 41.40.117.9 port 9265 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.40.117.9
country_id: 357994
description:
Jan  5 16:54:17 host2 sshd[644566]: Disconnected from invalid user postgres 41.40.117.9 port 51814 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 16:55:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<M+dsUaJH5JZCdMzo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.108.134
country_id: 1819730
description:
Jan  5 16:55:20 host2 sshd[645677]: Disconnected from invalid user simon 101.36.108.134 port 38804 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 16:57:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<s0D3WKJH0KlA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 16:57:32 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<tXc9WKJHNO+uijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 16:58:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<cQVvWqJHKIRnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.130.148.217
country_id: 1512440
description:
2026-01-05 16:58:21 dovecot_login authenticator failed for H=([45.130.148.217]) [45.130.148.217]:59222: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.246.106
country_id: 1269750
description:
2026-01-05 16:58:51 dovecot_login authenticator failed for H=([125.16.255.97]) [125.20.246.106]:50198: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.108.134
country_id: 1819730
description:
Jan  5 16:58:58 host2 sshd[648842]: Disconnected from invalid user smbuser 101.36.108.134 port 55484 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-05 16:59:28 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (imathet) [87.103.126.54]:24948: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 17:00:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<fxKGYqJHTuWOq2dI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.108.134
country_id: 1819730
description:
Jan  5 17:01:09 host2 sshd[651170]: Disconnected from invalid user tutor 101.36.108.134 port 43628 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 17:03:02 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<MeDna6JHkpojupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 17:03:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<BQ3XbqJHYrVCdMzo>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  5 17:08:28 host2 sshd[658125]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.54
country_id: 1269750
description:
2026-01-05 17:16:43 dovecot_login authenticator failed for H=(nsg-corporate-54.202.186.122.airtel.in) [122.186.202.54]:36072: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
country_id: 99237
description:
2026-01-05 17:16:27 dovecot_login authenticator failed for H=([65.20.191.12]) [65.20.191.12]:54854: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.192.85.86
country_id: 3175395
description:
2026-01-05 17:18:25 dovecot_login authenticator failed for H=([2.192.85.86]) [2.192.85.86]:57364: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.111.140
country_id: 1269750
description:
2026-01-05 17:18:54 dovecot_login authenticator failed for H=(abts-mum-static-140.111.170.122.airtelbroadband.in) [122.170.111.140]:44074: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  5 17:21:29 host2 sshd[671971]: Disconnected from invalid user user 2.57.121.25 port 27337 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.135.131
country_id: 6252001
description:
Jan  5 17:24:29 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=71.6.135.131, lip=66.85.158.92, session=<5u60uKJHAupHBoeD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.66
country_id: 6252001
description:
Jan  5 17:25:36 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=216.218.206.66, lip=66.85.158.92, TLS handshaking: Connection closed, session=<fL6uvKJHYLjY2s5C>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.66
country_id: 6252001
description:
Jan  5 17:26:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=216.218.206.66, lip=66.85.158.92, TLS: Connection closed, session=<nyjvvqJHEqrY2s5C>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 17:27:42 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<jhgTxKJHWplCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 17:29:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<pxJlyqJH9KWuijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 17:30:51 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<R6Niz6JHSumOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 17:31:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=</p9K0KJHxphnmud6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 13.86.113.214
country_id: 6252001
description:
Jan  5 17:31:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=13.86.113.214, lip=66.85.158.92, session=<3nge06JH4McNVnHW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  5 17:32:09 host2 sshd[682270]: Disconnected from invalid user admin 2.57.121.112 port 25779 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  5 17:32:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<w6Lv1KJHyJQFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 17:34:17 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<q6mi26JHcsVA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 17:35:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=</+qY36JH1iwjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 17:36:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<y8zu4aJH0OdCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.114
country_id: 3865483
description:
Jan  5 17:39:32 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=179.0.252.114, lip=66.85.158.91, TLS, session=<bfVO7aJHVdWzAPxy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.248.32
country_id: 798544
description:
Jan  5 17:39:50 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<charanaw>, method=PLAIN, rip=109.125.248.32, lip=66.85.158.91, TLS, session=<5sOi7qJHnuFtffgg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 119.18.55.118
country_id: 1269750
description:
Jan  5 17:41:28 host2 sshd[691468]: Disconnected from invalid user localuser 119.18.55.118 port 38408 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.132.68.222
country_id: 3932488
description:
Jan  5 17:43:58 host2 sshd[693522]: Disconnected from invalid user claude 161.132.68.222 port 50562 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.68.222
country_id: 3932488
description:
Jan  5 17:43:11 host2 sshd[692939]: Disconnected from invalid user admin 161.132.68.222 port 40502 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.68.222
country_id: 3932488
description:
Jan  5 17:44:40 host2 sshd[694241]: Disconnected from invalid user compiler 161.132.68.222 port 33646 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.68.222
country_id: 3932488
description:
Jan  5 17:45:22 host2 sshd[695127]: Disconnected from invalid user abc 161.132.68.222 port 60008 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.247.47.169
country_id: 3175395
description:
2026-01-05 17:45:28 dovecot_login authenticator failed for H=host-95-247-47-169.retail.telecomitalia.it [95.247.47.169]:45478: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 57.128.182.5
country_id: 2635167
description:
Jan  5 17:45:48 host2 sshd[695938]: Disconnected from invalid user support 57.128.182.5 port 47158 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.89.227.161
country_id: 192950
description:
Jan  5 17:46:30 host2 sshd[696485]: Disconnected from invalid user rocky 41.89.227.161 port 58918 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.89.227.161
country_id: 192950
description:
Jan  5 17:48:01 host2 sshd[697839]: Disconnected from invalid user amir 41.89.227.161 port 51344 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-05 17:52:39 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:51661: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 18:00:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<iUEgOaNHOoBCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 18:00:14 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<401yOKNHYFauijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 18:01:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<2eGOPKNHxOyOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 18:04:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<vZMNR6NHGJZnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.239.41.74
country_id: 3469034
description:
2026-01-05 18:07:22 dovecot_login authenticator failed for H=(201-28-33-49.customer.tdatabrasil.net.br) [186.239.41.74]:39581: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.129.57.71
country_id: 6252001
description:
2026-01-05 18:07:22 dovecot_plain authenticator failed for H=c-73-129-57-71.hsd1.md.comcast.net (oushiturop) [73.129.57.71]:52024: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 18:07:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<iJQOUqNHhKQjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.56
country_id: 99237
description:
2026-01-05 18:07:38 dovecot_login authenticator failed for H=([65.20.133.56]) [65.20.133.56]:47605: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.19.165.90
country_id: 3469034
description:
2026-01-05 18:08:08 dovecot_login authenticator failed for H=(secovi-rs.pae.gvt.net.br) [177.19.165.90]:33067: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 18:08:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<4dfPVqNH/uxCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 18:10:34 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shop@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<gGJhXaNHvq5A46ZK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.129.57.71
country_id: 6252001
description:
2026-01-05 18:11:07 dovecot_plain authenticator failed for H=c-73-129-57-71.hsd1.md.comcast.net (pleaton) [73.129.57.71]:44326: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  5 18:15:29 host2 sshd[728803]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.44.40
country_id: 1522867
description:
2026-01-05 18:16:38 dovecot_plain authenticator failed for H=(detally) [5.76.44.40]:34980: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.144.27.228
country_id: 6252001
description:
2026-01-05 18:22:10 dovecot_plain authenticator failed for H=c-73-144-27-228.hsd1.mi.comcast.net (bizessess) [73.144.27.228]:45268: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Jan  5 18:23:49 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.91, TLS: Connection closed, session=<6d/jjKNH6pqLonHU>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  5 18:27:55 host2 sshd[740224]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.172
country_id: 1733045
description:
2026-01-05 18:27:34 dovecot_login authenticator failed for H=([49.124.154.172]) [49.124.154.172]:40930: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.66
country_id: 1733045
description:
2026-01-05 18:28:14 dovecot_login authenticator failed for H=([49.125.201.66]) [49.125.201.66]:41652: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 18:30:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<nOfJo6NH2Pyuijvy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2026-01-05 18:30:53 dovecot_login authenticator failed for H=(visaotur.sdr.gvt.net.br) [186.215.245.175]:36013: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 18:31:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<vSJSqKNHlJqOq2dI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.19.112
country_id: 298795
description:
2026-01-05 18:31:50 dovecot_login authenticator failed for H=([188.59.19.112]) [188.59.19.112]:52682: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.38
country_id: 1269750
description:
2026-01-05 18:31:19 dovecot_login authenticator failed for H=(nsg-corporate-38.230.187.122.airtel.in) [122.187.230.38]:34340: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 18:32:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<haHNrKNHwNVCdMzo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.192.66
country_id: 6252001
description:
Jan  5 18:37:06 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.65.192.66, lip=66.85.158.91, session=<3vpovKNHzuoUQcBC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 18:37:14 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<rJzBvKNHlodnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 18:39:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<Kde6xKNHjOojupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan  5 18:40:02 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<6lfrxqNHqK4DlTsa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 18:40:58 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<Js8cyqNHeo9CdMzo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan  5 18:41:07 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<Pg/ByqNHgLUDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan  5 18:42:06 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: Connection closed, session=<lXBFzqNHXMkDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan  5 18:42:53 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<ujgU0aNH8rYDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan  5 18:43:22 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS, session=<2yrZ0qNHstIDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan  5 18:44:24 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS, session=<DsJ/1qNHkrQDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan  5 18:45:55 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<B2P426NHZKEDlTsa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 18:46:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<nrqJ3aNHgt9A46ZK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan  5 18:46:26 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: Connection closed, session=<bdfF3aNHVLkDlTsa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.231.121.22
country_id: 798544
description:
Jan  5 18:47:17 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=91.231.121.22, lip=66.85.158.91, TLS, session=<TAfX36NHxsxb53kW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.230.228.16
country_id: 6252001
description:
2026-01-05 18:47:30 dovecot_plain authenticator failed for H=c-71-230-228-16.hsd1.de.comcast.net (ratercines) [71.230.228.16]:58656: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.201.109
country_id: 3469034
description:
Jan  5 18:47:38 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw>, method=PLAIN, rip=179.189.201.109, lip=66.85.158.91, TLS, session=<5Uj64KNHg+Wzvclt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan  5 18:47:46 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS, session=<KrqQ4qNHQLMDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan  5 18:48:39 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS, session=<0yaz5aNH8IADlTsa>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  5 18:54:10 host2 sshd[766535]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 216.218.206.68
country_id: 6252001
description:
Jan  5 18:55:47 host2 pure-ftpd[768482]: (?@216.218.206.68) [INFO] New connection from 216.218.206.68


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.52
country_id: 6252001
description:
Jan  5 18:56:39 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.52, lip=66.85.158.92, TLS: Connection closed, session=<F2pNAqRHsEOnXpI0>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  5 18:58:45 host2 sshd[771222]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 19:01:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<9CHHEaRHlKSuijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.5.89
country_id: 690791
description:
Jan  5 19:01:05 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=176.103.5.89, lip=66.85.158.91, TLS, session=<qU0ZEaRHd7mwZwVZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 19:02:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<pqqBFaRHnr2Oq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.167.160
country_id: 99237
description:
Jan  5 19:01:24 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=65.20.167.160, lip=66.85.158.91, TLS, session=<2mJBEqRHOOFBFKeg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.135
country_id: 6252001
description:
Jan  5 19:02:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.135, lip=66.85.158.92, TLS: Connection closed, session=<nhU4FqRHnsVChJmH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 19:05:04 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<XANIIKRHiNdCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 19:10:39 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<32xINKRH5q1nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 19:11:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<P2sfOKRHhjMjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.255.45
country_id: 597427
description:
2026-01-05 19:13:04 dovecot_plain authenticator failed for H=(yN3pxYynSq_mail.txt) [104.28.255.45]:19332: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 19:13:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<Xm0aPqRHALxCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 19:22:49 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<R7PFX6RHZoBA46ZK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.144.27.228
country_id: 6252001
description:
2026-01-05 19:31:51 dovecot_plain authenticator failed for H=c-73-144-27-228.hsd1.mi.comcast.net (defeatia) [73.144.27.228]:48276: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 19:31:59 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<CC2RgKRHZp+uijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 19:32:41 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<iQ0Yg6RHQLqOq2dI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2026-01-05 19:35:32 dovecot_plain authenticator failed for H=c-24-1-200-187.hsd1.il.comcast.net (hyped) [24.1.200.187]:40134: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-05 19:36:39 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (ivellfics) [87.103.126.54]:42549: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 19:37:35 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<ciKTlKRHfJVCdMzo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.164.134.19
country_id: 1835841
description:
Jan  5 19:38:32 host2 sshd[816030]: Disconnected from invalid user claude 43.164.134.19 port 41756 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.38.101.192
country_id: 130758
description:
Jan  5 19:38:38 host2 sshd[816140]: Disconnected from invalid user ali 95.38.101.192 port 51544 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.164.134.19
country_id: 1835841
description:
Jan  5 19:39:14 host2 sshd[816912]: Disconnected from invalid user nikola 43.164.134.19 port 55510 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.194.4.255
country_id: 1880251
description:
Jan  5 19:39:24 host2 sshd[817162]: Disconnected from invalid user nikola 4.194.4.255 port 55430 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.144.233.139
country_id: 2921044
description:
Jan  5 19:40:45 host2 sshd[819241]: Disconnected from invalid user qadmin 45.144.233.139 port 47428 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.164.134.19
country_id: 1835841
description:
Jan  5 19:41:26 host2 sshd[819969]: Disconnected from invalid user cesar 43.164.134.19 port 40344 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.144.233.139
country_id: 2921044
description:
Jan  5 19:42:24 host2 sshd[821041]: Disconnected from invalid user administrator 45.144.233.139 port 36334 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.144.233.139
country_id: 2921044
description:
Jan  5 19:43:27 host2 sshd[822021]: Disconnected from invalid user ftpuser 45.144.233.139 port 56304 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.38.101.192
country_id: 130758
description:
Jan  5 19:43:40 host2 sshd[822230]: Disconnected from invalid user newuser 95.38.101.192 port 51778 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 19:43:53 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<LY0Xq6RH1uMjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 19:43:58 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<jkFpq6RHlJBnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.38.101.192
country_id: 130758
description:
Jan  5 19:44:42 host2 sshd[823504]: Disconnected from invalid user claude 95.38.101.192 port 51874 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.165
country_id: 6252001
description:
Jan  5 19:44:51 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 22 secs): user=<>, rip=147.185.133.165, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<JWCzrqRH6NmTuYWl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.165
country_id: 6252001
description:
Jan  5 19:45:48 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 15 secs): user=<>, rip=147.185.133.165, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<0ecZsqRHCPWTuYWl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  5 19:46:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<eErdsqRHHsAFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 19:46:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<nQTcsqRHrqJCdMzo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.154
country_id: 1269750
description:
2026-01-05 19:46:06 dovecot_login authenticator failed for H=([128.185.223.87]) [182.95.178.154]:48862: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.165
country_id: 6252001
description:
Jan  5 19:46:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 13 secs): user=<>, rip=147.185.133.165, lip=66.85.158.92, TLS: read(size=429) failed: Connection reset by peer, session=<8oyzs6RH7vCTuYWl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2026-01-05 19:46:33 dovecot_login authenticator failed for H=(163.pool90-160-139.dynamic.orange.es) [90.160.139.163]:56549: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 4.194.4.255
country_id: 1880251
description:
Jan  5 19:48:34 host2 sshd[828823]: Disconnected from invalid user joseph 4.194.4.255 port 51364 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.194.4.255
country_id: 1880251
description:
Jan  5 19:49:17 host2 sshd[829751]: Disconnected from invalid user ubuntu 4.194.4.255 port 38592 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.202.9.133
country_id: 6252001
description:
Jan  5 19:50:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.202.9.133, lip=66.85.158.92, TLS: Connection closed, session=<A+H6wqRH2tsjygmF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.165
country_id: 6252001
description:
Jan  5 19:52:59 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.133.165, lip=66.85.158.92, TLS, session=<b/jDy6RHsPmTuYWl>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  5 20:00:02 host2 sshd[841143]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 19:59:35 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<FIFN46RHyKpA46ZK>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 159.65.206.235
country_id: 2750405
description:
Jan  5 20:01:11 host2 pure-ftpd[842566]: (?@159.65.206.235) [INFO] New connection from 159.65.206.235


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 20:03:29 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<WLw48aRHGtiOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 20:03:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<CihI8aRHlnauijvy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.199.210.33
country_id: 130758
description:
2026-01-05 20:05:48 dovecot_plain authenticator failed for H=(T31NGXPI6836) [185.199.210.33]:50436: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 212.87.243.85
country_id: 798544
description:
Jan  5 20:09:00 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<hr>, method=PLAIN, rip=212.87.243.85, lip=66.85.158.91, TLS, session=<c1IPBKVHiLLUV/NV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.130.168.211
country_id: 3469034
description:
Jan  5 20:09:05 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<hr>, method=PLAIN, rip=177.130.168.211, lip=66.85.158.91, TLS, session=<gMQSBKVHOoOxgqjT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.39.39
country_id: 953987
description:
Jan  5 20:08:41 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=102.64.39.39, lip=66.85.158.91, TLS, session=<GyDAAqVHI5lmQCcn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.42.59
country_id: 953987
description:
Jan  5 20:08:42 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=102.64.42.59, lip=66.85.158.91, TLS, session=<tP+/AqVH165mQCo7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 20:10:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<zULJCqVHTrhCdMzo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  5 20:15:56 host2 sshd[858859]: Disconnected from invalid user admin 2.57.121.112 port 31498 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 20:15:59 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<kqrlHaVH3p8jupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 20:17:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<HQWII6VHLoRnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 20:19:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<1rdEKaVH4LNCdMzo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.21
country_id: 6252001
description:
Jan  5 20:21:01 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=162.216.149.21, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<VO8GMKVHbsyi2JUV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.21
country_id: 6252001
description:
Jan  5 20:21:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 10 secs): user=<>, rip=162.216.149.21, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<JKFZMaVH4v2i2JUV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.21
country_id: 6252001
description:
Jan  5 20:27:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.21, lip=66.85.158.91, TLS, session=<4E0ERqVHyvei2JUV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 20:34:01 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<w09dXqVHApKuijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 20:34:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<HOoYX6VH0KqOq2dI>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  5 20:36:18 host2 sshd[880054]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 20:36:17 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<qQWDZqVHIINA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 20:44:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@seyawin.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<dw6ygqVHbJxCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 20:47:57 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<m1pGkKVHtm4jupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 20:50:42 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<Rn4NmqVHHqZnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.47.162.51
country_id: 719819
description:
Jan  5 20:51:08 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=185.47.162.51, lip=66.85.158.91, TLS, session=<MkSzmqVHZ6C5L6Iz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.45.167.121
country_id: 2510769
description:
Jan  5 20:51:25 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<charanaw>, method=PLAIN, rip=5.45.167.121, lip=66.85.158.91, TLS, session=<c6DOm6VHQ7QFLad5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 20:52:57 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<zVIloqVHqM1CdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 21:04:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<C5jizKVH1uCOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.66.114.43
country_id: 1269750
description:
Jan  5 21:05:00 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=103.66.114.43, lip=66.85.158.91, TLS, session=<rAU6zKVH0ONnQnIr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.200.26.39
country_id: 3175395
description:
Jan  5 21:05:20 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=193.200.26.39, lip=66.85.158.91, TLS, session=<Sft3zaVH+c3ByBon>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 21:05:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<i/MDz6VHAG2uijvy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-05 21:13:21 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:51141: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 21:13:37 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<sfcH7KVHAshA46ZK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.221.87
country_id: 1880251
description:
Jan  5 21:17:36 host2 sshd[924260]: Disconnected from invalid user claude 45.78.221.87 port 58616 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 207.90.244.14
country_id: 6252001
description:
Jan  5 21:17:41 host2 dovecot[1170291]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=207.90.244.14, lip=66.85.158.92, session=<aea0+qVHIMHPWvQO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.14
country_id: 6252001
description:
Jan  5 21:17:43 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=207.90.244.14, lip=66.85.158.92, session=<lbjL+qVH4OLPWvQO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.202.9.133
country_id: 6252001
description:
Jan  5 21:18:34 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.202.9.133, lip=66.85.158.92, TLS: Connection closed, session=<5ZjY/aVHAN4jygmF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 21:18:35 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<03/O/aVHaolCdMzo>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  5 21:19:43 host2 sshd[926750]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.198.215.66
country_id: 241170
description:
Jan  5 21:19:56 host2 sshd[926995]: Disconnected from invalid user deploy 154.198.215.66 port 59406 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 21:20:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<UVN6A6ZH/pcjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.198.215.66
country_id: 241170
description:
Jan  5 21:20:39 host2 sshd[927906]: Disconnected from invalid user claude 154.198.215.66 port 43004 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.198.215.66
country_id: 241170
description:
Jan  5 21:21:51 host2 sshd[929420]: Disconnected from invalid user claude 154.198.215.66 port 38392 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.190.11.45
country_id: 1210997
description:
Jan  5 21:22:29 host2 sshd[930051]: Disconnected from invalid user soc 203.190.11.45 port 35386 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.144.167
country_id: 1861060
description:
Jan  5 21:22:22 host2 sshd[929953]: Disconnected from invalid user bitrix 152.32.144.167 port 45144 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.198.215.66
country_id: 241170
description:
Jan  5 21:22:26 host2 sshd[930011]: Disconnected from invalid user patrick 154.198.215.66 port 50194 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.190.11.45
country_id: 1210997
description:
Jan  5 21:24:09 host2 sshd[932223]: Disconnected from invalid user elasticsearch 203.190.11.45 port 46862 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.144.167
country_id: 1861060
description:
Jan  5 21:23:42 host2 sshd[931576]: Disconnected from invalid user pzuser 152.32.144.167 port 34054 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.198.215.66
country_id: 241170
description:
Jan  5 21:24:13 host2 sshd[932310]: Disconnected from invalid user milad 154.198.215.66 port 57386 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 21:24:16 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<LishEqZHbMhnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.144.167
country_id: 1861060
description:
Jan  5 21:24:19 host2 sshd[932575]: Disconnected from invalid user claude 152.32.144.167 port 60886 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.131.63
country_id: 99237
description:
2026-01-05 21:25:05 dovecot_login authenticator failed for H=([65.20.131.63]) [65.20.131.63]:53868: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.17.38
country_id: 3469034
description:
2026-01-05 21:25:24 dovecot_login authenticator failed for H=([186.239.246.145]) [187.8.17.38]:33589: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.144.35
country_id: 1643084
description:
Jan  5 21:26:26 host2 sshd[934847]: Disconnected from invalid user hi 103.217.144.35 port 49370 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.190.11.45
country_id: 1210997
description:
Jan  5 21:27:20 host2 sshd[935912]: Disconnected from invalid user patrick 203.190.11.45 port 58542 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 21:27:17 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<kl/lHKZHRoFCdMzo>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 203.190.11.45
country_id: 1210997
description:
Jan  5 21:29:55 host2 sshd[938985]: Disconnected from invalid user dev1 203.190.11.45 port 44996 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.190.11.45
country_id: 1210997
description:
Jan  5 21:30:37 host2 sshd[940361]: Disconnected from invalid user postgres 203.190.11.45 port 60014 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.221.87
country_id: 1880251
description:
Jan  5 21:33:06 host2 sshd[943179]: Disconnected from invalid user daisy 45.78.221.87 port 58624 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.221.232.44
country_id: 878675
description:
Jan  5 21:33:26 host2 sshd[943516]: Disconnected from invalid user claude 197.221.232.44 port 36888 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.144.35
country_id: 1643084
description:
Jan  5 21:35:00 host2 sshd[947906]: Disconnected from invalid user claude 103.217.144.35 port 51214 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.221.89
country_id: 1880251
description:
Jan  5 21:34:15 host2 sshd[944358]: Disconnected from invalid user claude 45.78.221.89 port 57286 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.221.87
country_id: 1880251
description:
Jan  5 21:34:17 host2 sshd[944428]: Disconnected from invalid user claude 45.78.221.87 port 51888 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.154.125.60
country_id: 6251999
description:
Jan  5 21:35:33 host2 sshd[954847]: Disconnected from invalid user claude 66.154.125.60 port 57154 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 21:35:47 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<cU1OO6ZHtseOq2dI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.47.217
country_id: 6252001
description:
Jan  5 21:36:44 host2 sshd[959934]: Disconnected from invalid user dev 209.141.47.217 port 34786 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.221.87
country_id: 1880251
description:
Jan  5 21:36:48 host2 sshd[959847]: Disconnected from invalid user elasticsearch 45.78.221.87 port 54188 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 21:37:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<7S+6QKZHxCuuijvy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.47.217
country_id: 6252001
description:
Jan  5 21:38:45 host2 sshd[962487]: Disconnected from invalid user claude 209.141.47.217 port 58500 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.221.232.44
country_id: 878675
description:
Jan  5 21:38:47 host2 sshd[962491]: Disconnected from invalid user claude 197.221.232.44 port 55576 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 66.154.125.60
country_id: 6251999
description:
Jan  5 21:39:01 host2 sshd[962805]: Disconnected from invalid user cmm 66.154.125.60 port 57310 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.144.35
country_id: 1643084
description:
Jan  5 21:38:12 host2 sshd[961781]: Disconnected from invalid user soc 103.217.144.35 port 33780 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.154.125.60
country_id: 6251999
description:
Jan  5 21:38:25 host2 sshd[962084]: Disconnected from invalid user postgres 66.154.125.60 port 57242 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.122.23
country_id: 1819730
description:
Jan  5 21:39:18 host2 sshd[963079]: Disconnected from invalid user claude 101.36.122.23 port 42312 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.132.137
country_id: 1819730
description:
Jan  5 21:40:28 host2 sshd[965032]: Disconnected from invalid user vijay 128.1.132.137 port 44624 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.221.232.44
country_id: 878675
description:
Jan  5 21:40:16 host2 sshd[964674]: Disconnected from invalid user claude 197.221.232.44 port 43810 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 18.224.184.103
country_id: 6252001
description:
Jan  5 21:40:27 host2 pure-ftpd[965021]: (?@18.224.184.103) [INFO] New connection from 18.224.184.103


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.224.184.103
country_id: 6252001
description:
Jan  5 21:40:27 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=18.224.184.103, lip=66.85.158.91, TLS handshaking: Connection closed, session=<vNAjTKZHrpkS4Lhn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.14
country_id: 6252001
description:
Jan  5 21:40:33 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=207.90.244.14, lip=66.85.158.91, session=<a1+BTKZHxuDPWvQO>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 207.90.244.14
country_id: 6252001
description:
Jan  5 21:40:33 host2 dovecot[1170291]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 2 secs): user=<>, rip=207.90.244.14, lip=66.85.158.91, session=<B9t1TKZHrODPWvQO>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.122.23
country_id: 1819730
description:
Jan  5 21:40:43 host2 sshd[965319]: Disconnected from invalid user claude 101.36.122.23 port 50956 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.47.217
country_id: 6252001
description:
Jan  5 21:41:32 host2 sshd[966431]: Disconnected from invalid user claude 209.141.47.217 port 48728 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.221.232.44
country_id: 878675
description:
Jan  5 21:41:43 host2 sshd[966659]: Disconnected from invalid user claude 197.221.232.44 port 37400 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.154.125.60
country_id: 6251999
description:
Jan  5 21:41:24 host2 sshd[966199]: Disconnected from invalid user dev 66.154.125.60 port 57578 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 128.1.132.137
country_id: 1819730
description:
Jan  5 21:43:15 host2 sshd[968559]: Disconnected from invalid user staging 128.1.132.137 port 47756 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 21:50:59 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<9QapcaZH1NxA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 21:52:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@seyawin.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<VrZ6dqZHJJ9CdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 21:52:26 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<+7jbdqZHnFcjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.5.189.129
country_id: 241170
description:
Jan  5 21:54:16 host2 sshd[994891]: Disconnected from invalid user tester 69.5.189.129 port 44734 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.45.100.0
country_id: 3469034
description:
Jan  5 21:54:25 host2 sshd[995034]: Disconnected from invalid user ftpuser 187.45.100.0 port 54116 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.73.135.75
country_id: 3865483
description:
Jan  5 21:55:31 host2 sshd[996275]: Disconnected from invalid user ubuntu 200.73.135.75 port 55060 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 72.240.125.133
country_id: 6252001
description:
Jan  5 21:55:21 host2 sshd[996094]: Disconnected from invalid user claude 72.240.125.133 port 47198 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.226.65
country_id: 1880251
description:
Jan  5 21:55:30 host2 sshd[996269]: Disconnected from invalid user admin 45.78.226.65 port 35640 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.73.135.75
country_id: 3865483
description:
Jan  5 21:56:52 host2 sshd[997684]: Disconnected from invalid user claude 200.73.135.75 port 49640 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 72.240.125.133
country_id: 6252001
description:
Jan  5 21:56:58 host2 sshd[997773]: Disconnected from invalid user vpnuser 72.240.125.133 port 54010 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.5.189.129
country_id: 241170
description:
Jan  5 21:58:28 host2 sshd[999295]: Disconnected from invalid user deploy 69.5.189.129 port 52122 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.3.182
country_id: 1269750
description:
Jan  5 21:58:48 host2 sshd[999615]: Disconnected from invalid user claude 139.59.3.182 port 54878 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 21:58:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<FJfPi6ZH/s5nmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.73.135.75
country_id: 3865483
description:
Jan  5 21:58:23 host2 sshd[999234]: Disconnected from invalid user claude 200.73.135.75 port 44226 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.3.182
country_id: 1269750
description:
Jan  5 21:59:28 host2 sshd[1000224]: Disconnected from invalid user oracle 139.59.3.182 port 59730 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 69.5.189.129
country_id: 241170
description:
Jan  5 21:59:32 host2 sshd[1000287]: Disconnected from invalid user john 69.5.189.129 port 60062 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 72.240.125.133
country_id: 6252001
description:
Jan  5 22:00:09 host2 sshd[1001203]: Received disconnect from 72.240.125.133 port 39390:11: Bye Bye [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 22:00:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<uE92lKZHpMZCdMzo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.33.210.213
country_id: 3686110
description:
Jan  5 22:00:58 host2 sshd[1002056]: Disconnected from invalid user claude 179.33.210.213 port 43386 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.21.178
country_id: 1880251
description:
Jan  5 22:01:19 host2 sshd[1002429]: Disconnected from invalid user michael 103.210.21.178 port 47720 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.33.210.213
country_id: 3686110
description:
Jan  5 22:01:42 host2 sshd[1002733]: Disconnected from invalid user claude 179.33.210.213 port 56954 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.202.197.108
country_id: 6252001
description:
2026-01-05 22:01:09 dovecot_plain authenticator failed for H=(asted) [50.202.197.108]:48131: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 72.240.125.133
country_id: 6252001
description:
Jan  5 22:01:10 host2 sshd[1002291]: Disconnected from invalid user claude 72.240.125.133 port 34522 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.3.182
country_id: 1269750
description:
Jan  5 22:02:53 host2 sshd[1003876]: Disconnected from invalid user ubuntu 139.59.3.182 port 54506 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.21.178
country_id: 1880251
description:
Jan  5 22:03:34 host2 sshd[1004700]: Disconnected from invalid user claude 103.210.21.178 port 33634 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 208.69.84.112
country_id: 6252001
description:
Jan  5 22:03:42 host2 sshd[1004900]: Disconnected from invalid user git 208.69.84.112 port 41320 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.45.100.0
country_id: 3469034
description:
Jan  5 22:04:24 host2 sshd[1005734]: Disconnected from invalid user ubuntu 187.45.100.0 port 58927 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.210.21.178
country_id: 1880251
description:
Jan  5 22:04:41 host2 sshd[1005946]: Disconnected from invalid user bruno 103.210.21.178 port 58878 [preauth]


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 43.241.36.24
country_id: 1269750
description:
[2026-01-05 22:05:26 +0530] info [cpaneld] 43.241.36.24 - yashiholdings "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yashiholdings (has_cpuser_file failed)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 43.241.36.24
country_id: 1269750
description:
Login Blocked: IP reached maximum auth failures [Service]=[cpaneld] [Local IP Address]=[66.85.158.91] [Local Port]=[2083] [Remote IP Address]=[43.241.36.24] [Remote Port]=[11647] [Authentication Database]=[system] [Username]=[yashiholdings] (5/5 failures) (blocked until [Mon Jan  5 16:50:23 2026 UTC/Mon Jan  5 22:20:23 2026 LOCAL])


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.241.36.24
country_id: 1269750
description:
[2026-01-05 22:05:19 +0530] info [cpaneld] 43.241.36.24 - yashiholdings "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yashiholdings (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 22:06:32 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<LcpGqaZHtJGOq2dI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.182.83.231
country_id: 2510769
description:
Jan  5 22:07:25 host2 sshd[1009312]: Disconnected from invalid user test 5.182.83.231 port 40220 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 5.182.83.231
country_id: 2510769
description:
Jan  5 22:08:23 host2 sshd[1010566]: Disconnected from invalid user ftptest 5.182.83.231 port 45730 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 208.69.84.112
country_id: 6252001
description:
Jan  5 22:08:48 host2 sshd[1011041]: Disconnected from invalid user ts 208.69.84.112 port 34610 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 22:09:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<GwvcsqZH8vWuijvy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.160.152
country_id: 6252001
description:
Jan  5 22:09:45 host2 sshd[1012289]: Disconnected from invalid user claude 107.173.160.152 port 42398 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 105.247.69.196
country_id: 953987
description:
Jan  5 22:09:49 host2 sshd[1012263]: Disconnected from invalid user yang 105.247.69.196 port 36000 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.182.83.231
country_id: 2510769
description:
Jan  5 22:10:13 host2 sshd[1013175]: Disconnected from invalid user ec2-user 5.182.83.231 port 49276 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 208.69.84.112
country_id: 6252001
description:
Jan  5 22:11:06 host2 sshd[1014474]: Disconnected from invalid user jerry 208.69.84.112 port 52582 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.226.65
country_id: 1880251
description:
Jan  5 22:10:11 host2 sshd[1013121]: Disconnected from invalid user toto 45.78.226.65 port 43592 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 208.69.84.112
country_id: 6252001
description:
Jan  5 22:13:31 host2 sshd[1017584]: Disconnected from invalid user asep 208.69.84.112 port 52018 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.45.100.0
country_id: 3469034
description:
Jan  5 22:14:26 host2 sshd[1018543]: Disconnected from invalid user support 187.45.100.0 port 49317 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.173.160.152
country_id: 6252001
description:
Jan  5 22:15:15 host2 sshd[1019659]: Disconnected from invalid user myuser 107.173.160.152 port 57352 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 71.75.43.232
country_id: 6252001
description:
Jan  5 22:16:33 host2 dovecot[1170291]: imap-login: Disconnected: Aborted login by logging out (auth failed, 1 attempts in 2 secs): user=<training@v-deploy.com>, method=PLAIN, rip=71.75.43.232, lip=66.85.158.91, TLS, session=<9DIbzaZHJOhHSyvo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.164.81.65
country_id: 1819730
description:
Jan  5 22:18:38 host2 sshd[1022707]: Disconnected from invalid user claude 103.164.81.65 port 51442 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.161.56.210
country_id: 6252001
description:
Jan  5 22:18:56 host2 sshd[1023094]: Disconnected from invalid user test 203.161.56.210 port 54466 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 203.161.56.210
country_id: 6252001
description:
Jan  5 22:19:35 host2 sshd[1023621]: Disconnected from invalid user openstack 203.161.56.210 port 46980 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.164.81.65
country_id: 1819730
description:
Jan  5 22:21:29 host2 sshd[1025676]: Disconnected from invalid user alex 103.164.81.65 port 42584 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.161.56.210
country_id: 6252001
description:
Jan  5 22:21:51 host2 sshd[1025991]: Disconnected from invalid user carla 203.161.56.210 port 55236 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.80.200.216
country_id: 6252001
description:
Jan  5 22:22:14 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=40.80.200.216, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<txGG4aZH0qUoUMjY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.19
country_id: 798549
description:
Jan  5 22:22:48 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.19, lip=66.85.158.92, session=<wgSO46ZHjqhV2ZUT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.202.197.108
country_id: 6252001
description:
2026-01-05 22:23:11 dovecot_plain authenticator failed for H=(thess) [50.202.197.108]:35016: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.118
country_id: 6252001
description:
Jan  5 22:23:23 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.118, lip=66.85.158.92, TLS: Connection closed, session=<cOyr5aZHKqFChJl2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 22:24:39 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<kGAY6qZHPEQjupN+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.196.9.133
country_id: 2635167
description:
Jan  5 22:24:42 host2 sshd[1028935]: Disconnected from invalid user gitlab-runner 185.196.9.133 port 49876 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 22:25:06 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<JoCq66ZHpK1CdMzo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.9.133
country_id: 2635167
description:
Jan  5 22:24:14 host2 sshd[1028488]: Disconnected from invalid user claude 185.196.9.133 port 58114 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-05 22:24:38 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (sanes) [87.103.126.54]:48302: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.9.133
country_id: 2635167
description:
Jan  5 22:25:17 host2 sshd[1029867]: Disconnected from invalid user postgres 185.196.9.133 port 46826 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.9.133
country_id: 2635167
description:
Jan  5 22:26:19 host2 sshd[1031086]: Disconnected from invalid user example 185.196.9.133 port 42098 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.202
country_id: 1149361
description:
2026-01-05 22:27:05 dovecot_login authenticator failed for H=([180.94.75.202]) [180.94.75.202]:43721: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  5 22:27:27 host2 sshd[1032020]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 22:27:51 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<CC+B9aZHUtVA46ZK>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.94.210.79
country_id: 2750405
description:
Jan  5 22:33:04 host2 pure-ftpd[1037623]: (?@158.94.210.79) [INFO] New connection from 158.94.210.79


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 22:32:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<iWOKBadHvuhnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 22:33:32 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<UvrPCadH/KZCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.140.123.15
country_id: 6290252
description:
Jan  5 22:35:51 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=95.140.123.15, lip=66.85.158.91, TLS, session=<InczEadHIJNfjHsP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.109.166.27
country_id: 3469034
description:
Jan  5 22:36:11 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw>, method=PLAIN, rip=187.109.166.27, lip=66.85.158.91, TLS, session=<tmxbEqdH6J+7baYb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 22:37:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<9xIDGKdHttuOq2dI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.195.121
country_id: 6252001
description:
Jan  5 22:37:30 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.65.195.121, lip=66.85.158.91, TLS handshaking: Connection closed, session=<A0kkGKdH1qAUQcN5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  5 22:39:44 host2 sshd[1043980]: Disconnected from invalid user user 2.57.121.25 port 38918 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.164.76
country_id: 2661886
description:
2026-01-05 22:39:41 dovecot_login authenticator failed for H=ip076.net-81-16-164.koping.net [81.16.164.76]:58726: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.22.140
country_id: 1269750
description:
2026-01-05 22:40:32 dovecot_login authenticator failed for H=([103.68.22.140]) [103.68.22.140]:40588: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 22:41:04 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<dkTJJKdHOmuuijvy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.70
country_id: 6252001
description:
Jan  5 22:45:03 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.139.70, lip=66.85.158.92, session=<iEwnM6dHCO+4aYtG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.57
country_id: 6252001
description:
Jan  5 22:45:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.57, lip=66.85.158.91, TLS: Connection closed, session=<WjWyM6dHBOenXpI5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.70
country_id: 6252001
description:
Jan  5 22:45:17 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=184.105.139.70, lip=66.85.158.92, TLS: Connection closed, session=<Ol37M6dHaBu4aYtG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-01-05 22:46:52 dovecot_plain authenticator failed for H=(stathial) [154.144.243.93]:47600: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.46.45.121
country_id: 290557
description:
2026-01-05 22:52:47 dovecot_login authenticator failed for H=([20.46.45.121]) [20.46.45.121]:54641: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.34
country_id: 1269750
description:
2026-01-05 22:54:05 dovecot_login authenticator failed for H=(nsg-corporate-34.230.187.122.airtel.in) [122.187.230.34]:51711: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 22:57:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<H0WFYKdHoNMjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 22:58:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shop@seyawin.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<ABv/YqdHWthCdMzo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2026-01-05 22:58:43 dovecot_login authenticator failed for H=([189.59.210.1]) [186.215.245.175]:57063: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.27.139
country_id: 6252001
description:
2026-01-05 22:59:02 dovecot_login authenticator failed for H=c-71-235-27-139.hsd1.vt.comcast.net [71.235.27.139]:35370: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.208.42
country_id: 1269750
description:
2026-01-05 22:59:37 dovecot_login authenticator failed for H=([128.185.208.42]) [128.185.208.42]:35610: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.102
country_id: 1269750
description:
2026-01-05 23:04:37 dovecot_login authenticator failed for H=([27.123.104.102]) [27.123.104.102]:38598: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.245
country_id: 6252001
description:
Jan  5 23:04:45 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 1 secs): user=<>, rip=172.236.228.245, lip=66.85.158.92, session=<CTaWeadH6tGs7OT1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.105.128.11
country_id: 6252001
description:
Jan  5 23:04:45 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 1 secs): user=<>, rip=172.105.128.11, lip=66.85.158.91, session=<ck2TeadH5PasaYAL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.134
country_id: 1269750
description:
2026-01-05 23:04:58 dovecot_login authenticator failed for H=([182.95.230.134]) [182.95.230.134]:56618: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.79
country_id: 6252001
description:
Jan  5 23:05:10 host2 pure-ftpd[1071269]: (?@205.210.31.79) [INFO] New connection from 205.210.31.79


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 23:06:02 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<IgQNfqdHqKpA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 23:07:04 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shop@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<zbTDgadH3olCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 23:07:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<6wzmgqdH+Olnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 23:09:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=</+zNiadHCOuOq2dI>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  5 23:10:33 host2 sshd[1076723]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 23:14:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<MjW+mqdHwnuuijvy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.137
country_id: 6252001
description:
Jan  5 23:19:56 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.137, lip=66.85.158.91, TLS: Connection closed, session=<Jrvtr6dH9oFChJmJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 23:31:01 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<ELNq16dHEEYjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 23:31:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<hlp52qdHxt1CdMzo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  5 23:38:05 host2 sshd[1102241]: Disconnected from invalid user admin 2.57.121.112 port 54587 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.230.55.55
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 157.230.55.55 - info@cloudtourssrilanka.com "POST /login HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  5 23:40:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<Sm/a+KdHvpBCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 23:40:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<lLs++qdHXOiOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 23:40:56 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<Ykni+qdH8IJnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.214.49.194
country_id: 6252001
description:
2026-01-05 23:43:09 dovecot_login authenticator failed for H=wsip-72-214-49-194.hr.hr.cox.net [72.214.49.194]:35716: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.122
country_id: 1269750
description:
2026-01-05 23:42:50 dovecot_login authenticator failed for H=([59.145.116.161]) [182.95.230.122]:39354: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 23:44:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<xfrVBahH/odA46ZK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2026-01-05 23:44:24 dovecot_plain authenticator failed for H=c-98-193-112-85.hsd1.il.comcast.net (symicia) [98.193.112.85]:57056: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2026-01-05 23:44:27 dovecot_plain authenticator failed for H=(thomelle) [50.217.40.11]:49184: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 23:46:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<Q3DFDahHzkCuijvy>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.253.27.219
country_id: 1880251
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 103.253.27.219 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.185.231
country_id: 6252001
description:
Jan  5 23:51:22 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.220.185.231, lip=66.85.158.91, TLS handshaking: Connection closed, session=<gGpMIKhHbOgs3Lnn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  5 23:55:31 host2 sshd[1121963]: Disconnected from invalid user admin 2.57.121.112 port 62066 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.203.34.136
country_id: 6252001
description:
2026-01-05 23:59:27 dovecot_plain authenticator failed for H=c-98-203-34-136.hsd1.fl.comcast.net (dotomyst) [98.203.34.136]:37092: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.106.188
country_id: 3865483
description:
Jan  6 00:04:10 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=45.238.106.188, lip=66.85.158.91, TLS, session=<xIwCTahHAaIt7mq8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 84.234.125.38
country_id: 798544
description:
Jan  6 00:03:50 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=84.234.125.38, lip=66.85.158.91, TLS, session=<Uv7ZS6hH+LdU6n0m>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  6 00:03:58 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<wPM6TahHYFcjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 00:05:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<LuJ9UahHQKhCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  6 00:12:06 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<uslYaqhHApOOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 00:13:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<X+c8cKhHdrVCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  6 00:14:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<Hurcc6hHUJxnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  6 00:16:49 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<eSwze6hHbFWuijvy>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 00:17:51 host2 sshd[1147083]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2026-01-06 00:22:40 dovecot_login authenticator failed for H=([185.255.212.178]) [185.255.212.178]:61729: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.121.193.126
country_id: 3595528
description:
2026-01-06 00:22:48 dovecot_login authenticator failed for H=(126.193.121.190.ispguatemala.com.gt) [190.121.193.126]:39594: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.14.36
country_id: 3144096
description:
2026-01-06 00:23:47 dovecot_login authenticator failed for H=(cm-84.211.14.36.get.no) [84.211.14.36]:58383: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.21
country_id: 1733045
description:
2026-01-06 00:24:04 dovecot_login authenticator failed for H=([49.124.151.21]) [49.124.151.21]:42970: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.199.118.234
country_id: 1880251
description:
2026-01-06 00:23:24 dovecot_login authenticator failed for H=(448990.cloudwaysapps.com) [128.199.118.234]:53740: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.116.220.11
country_id: 3865483
description:
Jan  6 00:30:17 host2 sshd[1160863]: Disconnected from invalid user claude 181.116.220.11 port 50943 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.188.172.6
country_id: 3923057
description:
Jan  6 00:33:18 host2 sshd[1163665]: Disconnected from invalid user claude 181.188.172.6 port 53526 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.188.172.6
country_id: 3923057
description:
Jan  6 00:34:12 host2 sshd[1164651]: Disconnected from invalid user minecraft 181.188.172.6 port 60306 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.116.220.11
country_id: 3865483
description:
Jan  6 00:36:12 host2 sshd[1166575]: Disconnected from invalid user wan 181.116.220.11 port 33400 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.49.129.67
country_id: 3175395
description:
Jan  6 00:38:52 host2 sshd[1169077]: Disconnected from invalid user claude 151.49.129.67 port 36712 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.49.129.67
country_id: 3175395
description:
Jan  6 00:38:20 host2 sshd[1168665]: Disconnected from invalid user claude 151.49.129.67 port 48210 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.49.129.67
country_id: 3175395
description:
Jan  6 00:39:24 host2 sshd[1169570]: Disconnected from invalid user oracle 151.49.129.67 port 50470 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.49.129.67
country_id: 3175395
description:
Jan  6 00:40:25 host2 sshd[1170987]: Disconnected from invalid user ljsoft 151.49.129.67 port 54344 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Jan  6 00:40:50 host2 sshd[1171426]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 53635


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Jan  6 00:41:11 host2 sshd[1171702]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 57131


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.116.220.11
country_id: 3865483
description:
Jan  6 00:43:55 host2 sshd[1174093]: Disconnected from invalid user ts3 181.116.220.11 port 46816 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  6 00:46:47 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@melanifinefood.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<zxxf5qhH3K4yBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  6 00:46:56 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<M0Hk5qhHkO+i8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-06 00:47:56 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (perto) [87.103.126.54]:40539: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 00:47:57 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<OauR6qhHPq6i8KbF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.116.220.11
country_id: 3865483
description:
Jan  6 00:49:26 host2 sshd[1179723]: Disconnected from invalid user rocketmq 181.116.220.11 port 46857 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  6 00:49:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@lankaherbalsolutions.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<ip+I8ahHMoSygBt7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  6 00:49:13 host2 sshd[1179526]: Disconnected from invalid user admin 2.57.121.112 port 38567 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.196
country_id: 6252001
description:
Jan  6 00:51:42 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.196, lip=66.85.158.91, TLS, session=<f8gO+KhHxPvN0h/E>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.236.66
country_id: 6252001
description:
2026-01-06 00:51:24 dovecot_plain authenticator failed for H=c-73-213-236-66.hsd1.va.comcast.net (penated) [73.213.236.66]:45166: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  6 00:51:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<d9Me96hH9Mai8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-06 00:51:30 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:50748: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.116.220.11
country_id: 3865483
description:
Jan  6 00:53:29 host2 sshd[1183700]: Disconnected from invalid user claude 181.116.220.11 port 58097 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Jan  6 00:53:41 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<7PcG/6hHEUZetwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Jan  6 00:54:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<6DHwAalHbrCPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.63.133.243
country_id: 3175395
description:
Jan  6 00:54:51 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=185.63.133.243, lip=66.85.158.91, TLS, session=<r7lPAqlHZrO5P4Xz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 00:54:51 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<5pE6A6lHmMii8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.58.65.156
country_id: 1269750
description:
Jan  6 00:55:12 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<env_eng>, method=PLAIN, rip=103.58.65.156, lip=66.85.158.91, TLS, session=<fq98A6lHSZtnOkGc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 00:55:16 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<69ayBKlHuLAyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  6 00:56:27 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@lankaherbalsolutions.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<IhzwCKlHJqkvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Jan  6 00:58:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@venee.lk>, method=PLAIN, rip=157.230.24.207, lip=66.85.158.91, session=<oY4FEalHoMad5hjP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 00:59:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<GZYQFKlHdMxCdMzo>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 01:01:04 host2 sshd[1191142]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  6 01:00:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@sobaherbal.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<JTPGFqlHSr0vWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 01:01:48 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<8B0OHKlH1Ltm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  6 01:04:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@sobaherbal.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<3xi7JalHWM+ygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 01:05:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<zCKzKKlHlrQIijoY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  6 01:06:36 host2 sshd[1196319]: Disconnected from invalid user admin 2.57.121.112 port 23325 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Jan  6 01:06:37 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=129.226.64.141, lip=66.85.158.91, session=<LINULalH8JWB4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan  6 01:08:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<WAMCM6lHYp0v/lVz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Jan  6 01:08:37 host2 sshd[1198444]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 56646


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.14.169.244
country_id: 3017382
description:
2026-01-06 01:09:52 dovecot_plain authenticator failed for H=lstlambert-656-1-118-244.w80-14.abo.wanadoo.fr (unacul) [80.14.169.244]:58790: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-01-06 01:09:57 dovecot_plain authenticator failed for H=(hemegon) [24.187.213.29]:43512: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 01:11:36 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<VLwbP6lH4IIifrCV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 01:12:06 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<xybnQKlHQI0IijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 01:14:06 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<hCUQSKlHus8vWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 01:14:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<uoFjSalHzoAvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 01:14:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<zg/5SalH3NF100Db>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.5
country_id: 6252001
description:
Jan  6 01:14:19 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=74.82.47.5, lip=66.85.158.91, session=<DxD7SKlHXpFKUi8F>


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 69.66.133.89
country_id: 6252001
description:
Jan  6 01:14:27 host2 sshd[1205246]: error: maximum authentication attempts exceeded for root from 69.66.133.89 port 56775 ssh2 [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 69.66.133.89
country_id: 6252001
description:
Jan  6 01:14:27 host2 sshd[1205246]: Disconnecting authenticating user root 69.66.133.89 port 56775: Too many authentication failures [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 61.23.38.245
country_id: 1861060
description:
Jan  6 01:16:03 host2 sshd[1206789]: Disconnected from invalid user postgres 61.23.38.245 port 53278 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 01:16:26 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<WBJnUKlHVJlm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 01:16:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<vle1UKlHTs9A46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  6 01:17:58 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@bostonlanka.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<23TqValH5Nei8Jp9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 61.23.38.245
country_id: 1861060
description:
Jan  6 01:17:31 host2 sshd[1208129]: Disconnected from invalid user claude 61.23.38.245 port 46970 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  6 01:18:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<EqqTWKlHDK4yBvlc>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 61.23.38.245
country_id: 1861060
description:
Jan  6 01:18:12 host2 sshd[1208829]: Disconnected from invalid user postgres 61.23.38.245 port 60898 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 01:19:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<2Yc2WqlHhN4IhpC/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 01:19:34 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<yZeiW6lH2Iui8KbF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.155.171.171
country_id: 1835841
description:
Jan  6 01:19:46 host2 sshd[1210377]: Disconnected from invalid user prueba 43.155.171.171 port 37720 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2026-01-06 01:22:04 dovecot_plain authenticator failed for H=c-73-168-136-150.hsd1.il.comcast.net (ephessic) [73.168.136.150]:34592: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  6 01:22:05 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<9lGgZKlHAtqygBt7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.155.171.171
country_id: 1835841
description:
Jan  6 01:21:18 host2 sshd[1212065]: Disconnected from invalid user lenovo 43.155.171.171 port 48388 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-01-06 01:21:23 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:42562: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.201.62
country_id: 1269750
description:
2026-01-06 01:21:48 dovecot_login authenticator failed for H=(nsg-corporate-226.215.186.122.airtel.in) [122.186.201.62]:57262: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.155.171.171
country_id: 1835841
description:
Jan  6 01:21:56 host2 sshd[1212945]: Disconnected from invalid user minecraft 43.155.171.171 port 44238 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  6 01:22:35 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@nsteeleng.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<gkVlZqlHspOi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Jan  6 01:23:39 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<1BI5aqlHYI2PbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.155.171.171
country_id: 1835841
description:
Jan  6 01:23:47 host2 sshd[1214571]: Disconnected from invalid user testuser 43.155.171.171 port 36070 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Jan  6 01:23:53 host2 sshd[1214634]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 57819


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 01:24:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<ReM5bqlHVJai8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Jan  6 01:25:02 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<q24lb6lHmGJetwuC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Jan  6 01:25:02 host2 sshd[1215518]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 56760


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.155.171.171
country_id: 1835841
description:
Jan  6 01:24:24 host2 sshd[1215102]: Disconnected from invalid user rdp 43.155.171.171 port 43652 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 01:25:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<YKrvb6lH4pkyBsPO>


