# incident

plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.206.225.242
country_id: 6252001
description:
Jan  4 00:38:26 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=172.206.225.242, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<8hzxjIBHurKszuHy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.105.156.165
country_id: 3923057
description:
Jan  4 00:39:40 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@seyawin.com>, method=PLAIN, rip=200.105.156.165, lip=66.85.158.91, session=<UVc2kYBHDpHIaZyl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 00:39:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<VK8hkoBHiD4jupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.112.106.236
country_id: 3175395
description:
Jan  4 00:39:54 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=217.112.106.236, lip=66.85.158.91, TLS, session=<q0YwkYBHworZcGrs>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 174.138.59.242
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[174.138.59.242] [Remote Port]=[39476] [Authentication Database]=[mail] [Username]=[test@anandaobauae.org] (10/10 failures) (blocked until [Sun Jan  4 19:09:17 2026 UTC/Mon Jan  5 00:39:17 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 00:39:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<eR8DkIBHNJquijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.215
country_id: 3865483
description:
Jan  4 00:40:19 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<charanaw>, method=PLAIN, rip=179.0.250.215, lip=66.85.158.91, TLS, session=<9c1vkoBH66mzAPrX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 105.174.17.50
country_id: 3351879
description:
Jan  4 00:41:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@kiriaswanu.com>, method=PLAIN, rip=105.174.17.50, lip=66.85.158.91, session=<+phhl4BH+oxprhEy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 202.93.247.247
country_id: 1643084
description:
Jan  4 00:41:42 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=202.93.247.247, lip=66.85.158.91, session=<rI2BmIBHVp/KXff3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 00:45:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<nwxPpoBHuoBnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 105.174.17.50
country_id: 3351879
description:
Jan  4 00:45:40 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@seyawin.com>, method=PLAIN, rip=105.174.17.50, lip=66.85.158.91, session=<03y6poBHYbJprhEy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Jan  4 00:46:21 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@kiriaswanu.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<uFkhqYBHxq6kXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Jan  4 00:48:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@seyawin.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=</DM8r4BHGNqkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.223.83.53
country_id: 2510769
description:
Jan  4 00:48:56 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=82.223.83.53, lip=66.85.158.91, session=<485psoBHfpNS31M1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.105.156.165
country_id: 3923057
description:
Jan  4 00:52:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=200.105.156.165, lip=66.85.158.91, session=<QhG5voBHiLrIaZyl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.242.226.33
country_id: 6252001
description:
Jan  4 00:53:46 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=185.242.226.33, lip=66.85.158.92, TLS handshaking: Connection closed, session=<AeXPw4BHUOi58uIh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.239.77.14
country_id: 3996063
description:
Jan  4 00:53:52 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=45.239.77.14, lip=66.85.158.91, TLS, session=<C3UUw4BH/7ot700O>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 202.93.247.247
country_id: 1643084
description:
Jan  4 00:54:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=202.93.247.247, lip=66.85.158.91, session=<ZpssxYBH6MzKXff3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.96.195
country_id: 3469034
description:
Jan  4 00:54:12 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=191.240.96.195, lip=66.85.158.91, TLS, session=<twFDxIBHXqe/8GDD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.177.158
country_id: 6252001
description:
Jan  4 00:54:36 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.65.177.158, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<DHnIxoBH5LMUQbGe>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 00:57:19 host2 sshd[2217508]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.11.89.19
country_id: 6252001
description:
[2026-01-04 00:58:08 +0530] info [cpaneld] 45.11.89.19 - kamechot "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.153.188.246
country_id: 6252001
description:
Jan  4 00:58:23 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=148.153.188.246, lip=66.85.158.91, session=<ah1M1IBHIqeUmbz2>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.141
country_id: 6252001
description:
Jan  4 00:58:28 host2 pure-ftpd[2218813]: (?@66.132.153.141) [INFO] New connection from 66.132.153.141


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  4 00:58:51 host2 pure-ftpd[2219321]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 00:58:59 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<copS1oBHjKBA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 163.182.174.251
country_id: 6252001
description:
Jan  4 00:59:26 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=163.182.174.251, lip=66.85.158.91, session=<h47v14BHcLGjtq77>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 01:00:48 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<vW/Q3IBHgueOq2dI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.5.11
country_id: 6252001
description:
Jan  4 01:03:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 19 secs): user=<>, rip=45.79.5.11, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<3f/85IBH87UtTwUL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.223.83.53
country_id: 2510769
description:
Jan  4 01:03:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=82.223.83.53, lip=66.85.158.91, session=<9FrV5YBHbOZS31M1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 163.182.174.251
country_id: 6252001
description:
Jan  4 01:05:04 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=163.182.174.251, lip=66.85.158.91, session=<kn8P7IBHhuKjtq77>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 01:06:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<+S0E8IBHeDiuijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.105.156.165
country_id: 3923057
description:
Jan  4 01:09:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=200.105.156.165, lip=66.85.158.91, session=<5YaL+oBH6NXIaZyl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 01:08:49 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<MQ9/+YBHprkjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.51.216.210
country_id: 1269750
description:
Jan  4 01:09:59 host2 sshd[2232715]: Disconnected from invalid user claude 103.51.216.210 port 42936 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 202.93.247.247
country_id: 1643084
description:
Jan  4 01:11:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=202.93.247.247, lip=66.85.158.91, session=<PLlMAYFHGOHKXff3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 105.174.17.50
country_id: 3351879
description:
Jan  4 01:11:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=105.174.17.50, lip=66.85.158.91, session=<7LW3AoFHcr9prhEy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.41
country_id: 2750405
description:
2026-01-04 01:13:00 dovecot_login authenticator failed for H=(Copy-of-VM-2022) [45.94.31.41]:58286: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.147.24
country_id: 1643084
description:
Jan  4 01:13:27 host2 sshd[2237154]: Disconnected from invalid user github 103.187.147.24 port 55746 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.146.90
country_id: 1643084
description:
Jan  4 01:13:57 host2 sshd[2237617]: Disconnected from invalid user soporte 103.187.146.90 port 40646 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.187.146.90
country_id: 1643084
description:
Jan  4 01:14:36 host2 sshd[2238314]: Disconnected from invalid user devops 103.187.146.90 port 43848 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.138.75.244
country_id: 1733045
description:
Jan  4 01:14:44 host2 sshd[2238477]: Disconnected from invalid user dtl 175.138.75.244 port 45286 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.102.40.218
country_id: 6252001
description:
Jan  4 01:14:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=212.102.40.218, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<XCjUDoFHZtvUZija>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.49.117.132
country_id: 3686110
description:
Jan  4 01:14:13 host2 sshd[2237875]: Disconnected from invalid user webuser 181.49.117.132 port 41688 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Jan  4 01:14:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@kiriaswanu.com>, method=PLAIN, rip=164.92.94.204, lip=66.85.158.91, session=<rav+DYFHytukXF7M>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.203.166
country_id: 1880251
description:
Jan  4 01:14:11 host2 sshd[2237654]: Disconnected from invalid user www 45.78.203.166 port 58386 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.147.24
country_id: 1643084
description:
Jan  4 01:15:21 host2 sshd[2239422]: Disconnected from invalid user claude 103.187.147.24 port 35366 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.207.4.157
country_id: 2635167
description:
Jan  4 01:15:46 host2 sshd[2239957]: Disconnected from invalid user bitrix 92.207.4.157 port 54224 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.51.216.210
country_id: 1269750
description:
Jan  4 01:16:10 host2 sshd[2240368]: Disconnected from invalid user claude 103.51.216.210 port 51696 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.187.147.24
country_id: 1643084
description:
Jan  4 01:16:39 host2 sshd[2240877]: Disconnected from invalid user user 103.187.147.24 port 39312 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.189.29.175
country_id: 2960313
description:
Jan  4 01:17:08 host2 sshd[2241331]: Disconnected from invalid user claude 107.189.29.175 port 38836 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.207.4.157
country_id: 2635167
description:
Jan  4 01:16:21 host2 sshd[2240574]: Disconnected from invalid user claude 92.207.4.157 port 39564 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.146.90
country_id: 1643084
description:
Jan  4 01:17:05 host2 sshd[2241267]: Disconnected from invalid user claude 103.187.146.90 port 36150 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.138.75.244
country_id: 1733045
description:
Jan  4 01:17:09 host2 sshd[2241355]: Disconnected from invalid user bitrix 175.138.75.244 port 58060 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.51.216.210
country_id: 1269750
description:
Jan  4 01:17:21 host2 sshd[2241613]: Disconnected from invalid user claude 103.51.216.210 port 36612 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.207.4.157
country_id: 2635167
description:
Jan  4 01:17:28 host2 sshd[2241723]: Disconnected from invalid user pz 92.207.4.157 port 38464 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.146.90
country_id: 1643084
description:
Jan  4 01:17:40 host2 sshd[2241935]: Disconnected from invalid user ivan 103.187.146.90 port 44094 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.49.117.132
country_id: 3686110
description:
Jan  4 01:17:43 host2 sshd[2241922]: Disconnected from invalid user claude 181.49.117.132 port 54644 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.138.75.244
country_id: 1733045
description:
Jan  4 01:17:45 host2 sshd[2242037]: Disconnected from invalid user debian 175.138.75.244 port 41922 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.189.29.175
country_id: 2960313
description:
Jan  4 01:18:11 host2 sshd[2242534]: Disconnected from invalid user ftpuser 107.189.29.175 port 56314 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.51.216.210
country_id: 1269750
description:
Jan  4 01:18:31 host2 sshd[2242867]: Disconnected from invalid user www 103.51.216.210 port 53112 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.147.24
country_id: 1643084
description:
Jan  4 01:19:07 host2 sshd[2243510]: Disconnected from invalid user test 103.187.147.24 port 47008 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 175.138.75.244
country_id: 1733045
description:
Jan  4 01:18:20 host2 sshd[2242683]: Disconnected from invalid user mc 175.138.75.244 port 54020 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.138.75.244
country_id: 1733045
description:
Jan  4 01:19:34 host2 sshd[2243988]: Disconnected from invalid user test 175.138.75.244 port 49978 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2026-01-04 01:19:35 dovecot_plain authenticator failed for H=c-73-197-236-163.hsd1.nj.comcast.net (coarshew) [73.197.236.163]:47460: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 01:20:17 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<K/aBIoFHEoxnmud6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.66
country_id: 6252001
description:
Jan  4 01:20:29 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.20.66, lip=66.85.158.91, session=<AbVPI4FHTvZBMRRC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.49.117.132
country_id: 3686110
description:
Jan  4 01:20:55 host2 sshd[2246009]: Disconnected from invalid user dtl 181.49.117.132 port 33702 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.203.166
country_id: 1880251
description:
Jan  4 01:21:42 host2 sshd[2246783]: Disconnected from invalid user claude 45.78.203.166 port 42218 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.189.29.175
country_id: 2960313
description:
Jan  4 01:21:49 host2 sshd[2246911]: Disconnected from invalid user test 107.189.29.175 port 49826 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.192
country_id: 6252001
description:
Jan  4 01:21:36 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.192, lip=66.85.158.92, TLS handshaking: Connection closed, session=<CGZPJ4FHCOZAPpzA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.27
country_id: 798549
description:
Jan  4 01:21:29 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.27, lip=66.85.158.92, session=<ek3tJoFHhspV2ZUb>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 49.228.103.72
country_id: 1605651
description:
Jan  4 01:21:31 host2 sshd[2246622]: Disconnected from invalid user webuser 49.228.103.72 port 37310 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.228.103.72
country_id: 1605651
description:
Jan  4 01:21:17 host2 sshd[2246401]: Disconnected from invalid user claude 49.228.103.72 port 48708 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.197
country_id: 6252001
description:
Jan  4 01:21:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.197, lip=66.85.158.92, TLS handshaking: Connection closed, session=<ZcI7JoFHY0BAPpzF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.228.103.72
country_id: 1605651
description:
Jan  4 01:25:13 host2 sshd[2250810]: Disconnected from invalid user vivek 49.228.103.72 port 44448 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 01:28:08 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<mgSTPoFHFLJA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 01:27:56 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<OMzXPYFHeLmOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 01:32:59 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<5n3qT4FHwpyuijvy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.67
country_id: 6252001
description:
Jan  4 01:33:01 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.20.67, lip=66.85.158.92, session=<o10mUIFH1hJBMRRD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.3
country_id: 6252001
description:
Jan  4 01:34:02 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=74.82.47.3, lip=66.85.158.92, TLS handshaking: Connection closed, session=<7TrJU4FHpAxKUi8D>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.67
country_id: 6252001
description:
Jan  4 01:33:13 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=65.49.20.67, lip=66.85.158.92, TLS: Connection closed, session=<5QDbUIFHyItBMRRD>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.203.166
country_id: 1880251
description:
Jan  4 01:34:45 host2 sshd[2263064]: Disconnected from invalid user composeruser 45.78.203.166 port 41010 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.3
country_id: 6252001
description:
Jan  4 01:34:23 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=74.82.47.3, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Y/IIVYFHYDRKUi8D>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2026-01-04 01:35:50 dovecot_plain authenticator failed for H=c-174-161-27-82.hsd1.tn.comcast.net (bundum) [174.161.27.82]:42073: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 01:37:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<I4YbYIFHAmUjupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.99.128.35
country_id: 2921044
description:
Jan  4 01:40:04 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=167.99.128.35, lip=66.85.158.92, TLS handshaking: Connection closed, session=<OARkaYFHOs+nY4Aj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.223.31.123
country_id: 2921044
description:
Jan  4 01:39:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=159.223.31.123, lip=66.85.158.92, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<wjlAZ4FH7zqf3x97>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2026-01-04 01:47:20 dovecot_plain authenticator failed for H=(oviouss) [23.30.11.253]:44540: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.181.179
country_id: 6252001
description:
Jan  4 01:48:26 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=45.79.181.179, lip=66.85.158.91, TLS, session=<og1Nh4FHIsItT7Wz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  4 01:50:06 host2 sshd[2281658]: Disconnected from invalid user admin 2.57.121.112 port 30262 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.140.19.22
country_id: 1269750
description:
Jan  4 01:53:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=103.140.19.22, lip=66.85.158.91, session=<YKUEmYFHZpZnjBMW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 01:54:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<GEounIFHCOxnmud6>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 38.148.242.232
country_id: 6252001
description:
Jan  4 01:55:01 host2 pure-ftpd[2288188]: (?@38.148.242.232) [INFO] New connection from 38.148.242.232


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 01:55:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<56Rsn4FHbMWOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 01:57:27 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<NPJpp4FH5IJA46ZK>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.119.99.179
country_id: 1831722
description:
Jan  4 01:59:41 host2 pure-ftpd[2293630]: (?@103.119.99.179) [INFO] New connection from 103.119.99.179


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 02:00:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<ynOFsoFHNoquijvy>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  4 02:02:17 host2 pure-ftpd[2297173]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.86
country_id: 6252001
description:
Jan  4 02:04:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.86, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=</juAwYFHUsjG6xhW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Jan  4 02:06:06 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.92, TLS: Connection closed, session=<QnJ+xoFHhIWLonHU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 02:06:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<d1vXx4FHpsEjupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.172
country_id: 6252001
description:
Jan  4 02:12:03 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.172, lip=66.85.158.91, TLS handshaking: Connection closed, session=<H1a+24FHto1APpys>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2026-01-04 02:12:04 dovecot_plain authenticator failed for H=c-73-145-107-251.hsd1.mi.comcast.net (agnagis) [73.145.107.251]:34054: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.227.254.152
country_id: 3703430
description:
Jan  4 02:17:36 host2 pure-ftpd[2313891]: (?@45.227.254.152) [INFO] New connection from 45.227.254.152


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
country_id: 1269750
description:
2026-01-04 02:19:20 dovecot_login authenticator failed for H=(nsg-static-82.71.76.182-airtel.com) [182.76.71.82]:58716: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.10
country_id: 1269750
description:
2026-01-04 02:19:44 dovecot_login authenticator failed for H=([125.20.249.192]) [27.123.113.10]:37056: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 02:20:33 host2 sshd[2317085]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.94.106.254
country_id: 6252001
description:
Jan  4 02:20:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.94.106.254, lip=66.85.158.91, session=<W+X8+YFHOLVCXmr+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  4 02:21:29 host2 sshd[2318046]: Disconnected from invalid user admin 2.57.121.112 port 65261 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 02:22:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<eN+EAIJHjJSOq2dI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2026-01-04 02:23:17 dovecot_plain authenticator failed for H=c-73-145-107-251.hsd1.mi.comcast.net (nones) [73.145.107.251]:39460: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.156.129.83
country_id: 2264397
description:
Jan  4 02:23:23 host2 pure-ftpd[2320110]: (?@45.156.129.83) [INFO] New connection from 45.156.129.83


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.156.129.82
country_id: 2264397
description:
Jan  4 02:23:24 host2 pure-ftpd[2320127]: (?@45.156.129.82) [INFO] New connection from 45.156.129.82


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.156.129.80
country_id: 2264397
description:
Jan  4 02:23:26 host2 pure-ftpd[2320178]: (?@45.156.129.80) [INFO] New connection from 45.156.129.80


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.70
country_id: 6252001
description:
Jan  4 02:25:16 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.70, lip=66.85.158.91, TLS handshaking: Connection closed, session=<JAH/CoJHl7RBMQFG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.66
country_id: 6252001
description:
Jan  4 02:25:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.66, lip=66.85.158.91, TLS handshaking: Connection closed, session=<skMKDIJHDN9BMQFC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.140.19.22
country_id: 1269750
description:
Jan  4 02:26:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.140.19.22, lip=66.85.158.91, session=<FQeAD4JHgrFnjBMW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 02:27:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<k4WgEYJHurxA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 02:28:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<Jj11FYJHSu+uijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 02:28:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<08DcFYJH4udnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2026-01-04 02:30:54 dovecot_plain authenticator failed for H=c-73-137-7-97.hsd1.ga.comcast.net (terolave) [73.137.7.97]:44182: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.58.87.108
country_id: 6252001
description:
2026-01-04 02:35:02 dovecot_plain authenticator failed for H=c-174-58-87-108.hsd1.fl.comcast.net (plaracoace) [174.58.87.108]:55294: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 02:35:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<RP9dMIJH7rUjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.0.19
country_id: 3469034
description:
2026-01-04 02:36:23 dovecot_login authenticator failed for H=(189-56-0-19.customer.tdatabrasil.net.br) [189.56.0.19]:48054: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.112.146
country_id: 1269750
description:
2026-01-04 02:36:37 dovecot_login authenticator failed for H=([125.18.67.17]) [182.95.112.146]:54946: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.233.160
country_id: 2993457
description:
Jan  4 02:38:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=95.181.233.160, lip=66.85.158.91, session=<vxysO4JHlMhftemg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 37.19.223.216
country_id: 2782113
description:
Jan  4 02:38:52 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=37.19.223.216, lip=66.85.158.91, session=<H1CvO4JHSp8lE9/Y>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.239.201.132
country_id: 1643084
description:
Jan  4 02:38:52 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=173.239.201.132, lip=66.85.158.91, session=<TgqoO4JHosit78mE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 178.175.130.252
country_id: 617790
description:
Jan  4 02:38:52 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=178.175.130.252, lip=66.85.158.91, session=<YvurO4JHUJ+yr4L8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 154.47.30.3
country_id: 953987
description:
Jan  4 02:38:52 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=154.47.30.3, lip=66.85.158.91, TLS handshaking: Connection closed, session=<kaWqO4JHUL6aLx4D>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.90.124.154
country_id: 3042225
description:
Jan  4 02:38:50 host2 pure-ftpd[2337377]: (?@91.90.124.154) [INFO] New connection from 91.90.124.154


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.231.182.147
country_id: 453733
description:
Jan  4 02:38:52 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=165.231.182.147, lip=66.85.158.91, TLS, session=<y6uoO4JHWL6l57aT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 84.247.105.104
country_id: 6251999
description:
Jan  4 02:38:53 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=84.247.105.104, lip=66.85.158.91, TLS handshaking: Connection closed, session=<NaO2O4JH+LBU92lo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.67
country_id: 99237
description:
2026-01-04 02:44:06 dovecot_plain authenticator failed for H=(chrogictst) [65.20.129.67]:36271: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2026-01-04 02:44:09 dovecot_plain authenticator failed for H=c-73-197-194-98.hsd1.nj.comcast.net (sphypoid) [73.197.194.98]:45374: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.168.113.8
country_id: 3469034
description:
[2026-01-04 02:46:46 +0530] info [cpaneld] 45.168.113.8 - lezzarotech "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 02:47:40 host2 sshd[2346513]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.212.64
country_id: 1819730
description:
Jan  4 02:47:51 host2 sshd[2346639]: Disconnected from invalid user ronaldo 123.58.212.64 port 57590 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.254
country_id: 6252001
description:
Jan  4 02:50:04 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.247.254, lip=66.85.158.91, session=<ln+3Y4JHsoO4aff+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.254
country_id: 6252001
description:
Jan  4 02:50:17 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.247.254, lip=66.85.158.91, TLS: Connection closed, session=<DmR+ZIJHkqu4aff+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.94.106.254
country_id: 6252001
description:
Jan  4 02:50:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.94.106.254, lip=66.85.158.91, session=<avIiZYJH3uJCXmr+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 02:50:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<fSAjZIJHfsmOq2dI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.87.117.147
country_id: 6252001
description:
Jan  4 02:52:27 host2 sshd[2351213]: Disconnected from invalid user pt 74.87.117.147 port 20422 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.189.130.118
country_id: 1269750
description:
Jan  4 02:52:47 host2 sshd[2351436]: Disconnected from invalid user opennms 206.189.130.118 port 41642 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.55.249.98
country_id: 6252001
description:
Jan  4 02:53:26 host2 sshd[2352056]: Disconnected from invalid user claude 45.55.249.98 port 55642 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.87.117.147
country_id: 6252001
description:
Jan  4 02:53:40 host2 sshd[2352277]: Disconnected from invalid user opennms 74.87.117.147 port 50485 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.245.55.32
country_id: 6251999
description:
Jan  4 02:53:56 host2 sshd[2352580]: Disconnected from invalid user claude 198.245.55.32 port 52674 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.87.117.147
country_id: 6252001
description:
Jan  4 02:54:14 host2 sshd[2353223]: Disconnected from invalid user zs 74.87.117.147 port 65399 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.189.130.118
country_id: 1269750
description:
Jan  4 02:54:36 host2 sshd[2353613]: Disconnected from invalid user user 206.189.130.118 port 40370 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 59.98.148.5
country_id: 1269750
description:
Jan  4 02:54:59 host2 sshd[2353911]: Disconnected from invalid user claude 59.98.148.5 port 35378 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.55.249.98
country_id: 6252001
description:
Jan  4 02:55:22 host2 sshd[2354480]: Disconnected from invalid user user 45.55.249.98 port 57814 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 02:55:57 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<4mWkeIJHloGuijvy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.87.117.147
country_id: 6252001
description:
Jan  4 02:56:01 host2 sshd[2355081]: Disconnected from invalid user mostafa 74.87.117.147 port 33041 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.15.119.12
country_id: 1605651
description:
Jan  4 02:56:31 host2 sshd[2355714]: Disconnected from invalid user test 209.15.119.12 port 45772 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 02:56:58 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<46VEfIJHTMZA46ZK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.251.120
country_id: 2921044
description:
Jan  4 02:57:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=164.92.251.120, lip=66.85.158.92, TLS handshaking: Connection closed, session=<xLfWfYJHMtykXPt4>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 59.98.148.5
country_id: 1269750
description:
Jan  4 02:57:22 host2 sshd[2356424]: Disconnected from invalid user ashish 59.98.148.5 port 48868 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.193
country_id: 6252001
description:
Jan  4 02:57:25 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.193, lip=66.85.158.92, session=<xtYFfoJHqOWs7OTB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.235.40.131
country_id: 6252001
description:
Jan  4 02:57:37 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=172.235.40.131, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<LBO2foJHyEGs6yiD>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.15.119.12
country_id: 1605651
description:
Jan  4 02:58:23 host2 sshd[2357369]: Disconnected from invalid user user 209.15.119.12 port 49290 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  4 02:59:57 host2 sshd[2358816]: Disconnected from invalid user admin 2.57.121.112 port 10372 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Jan  4 03:00:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<bsIgh4JHhLUFhH+s>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.128.205
country_id: 6252001
description:
Jan  4 03:00:18 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=45.79.128.205, lip=66.85.158.92, session=<WPxIiIJH4H4tT4DN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 03:02:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<uwbpjoJHfplnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 03:05:01 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<4u4JmYJHpnQjupN+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  4 03:05:37 host2 pure-ftpd[2364629]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 45.156.129.65
country_id: 2264397
description:
Jan  4 03:06:09 host2 dovecot[1170291]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=45.156.129.65, lip=66.85.158.91, session=<KSk1nYJHh9ctnIFB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.129.68
country_id: 2264397
description:
Jan  4 03:06:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=45.156.129.68, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Wd9tnYJHUdwtnIFE>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 45.156.129.68
country_id: 2264397
description:
Jan  4 03:06:11 host2 dovecot[1170291]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=45.156.129.68, lip=66.85.158.91, TLS, session=<IUhenYJHndctnIFE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.129.65
country_id: 2264397
description:
Jan  4 03:06:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=45.156.129.65, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher, session=<9suXnYJH3aItnIFB>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 45.156.129.66
country_id: 2264397
description:
Jan  4 03:06:16 host2 dovecot[1170291]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=45.156.129.66, lip=66.85.158.91, TLS, session=<7S2jnYJHrbYtnIFC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  4 03:08:27 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<2uVVpYJHyt8FhXlo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.120
country_id: 6252001
description:
Jan  4 03:16:20 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.120, lip=66.85.158.92, TLS: Connection closed, session=<LxWiwYJHcndChJl4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 03:18:16 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<WTVvyIJH/tqOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 03:24:04 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<R9Io3YJHyMWuijvy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.62.224.44
country_id: 3017382
description:
2026-01-04 03:25:29 dovecot_plain authenticator failed for H=ftp-mutu001.plug-it.com (hirighth) [185.62.224.44]:42932: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.133.156.119
country_id: 294640
description:
2026-01-04 03:26:40 dovecot_plain authenticator failed for H=(mantize) [195.133.156.119]:43570: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 03:27:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<BABH6oJHZI1A46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.29.19
country_id: 798544
description:
Jan  4 03:27:12 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=178.216.29.19, lip=66.85.158.91, TLS, session=<5a+E54JHHKCy2B0T>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 168.205.223.249
country_id: 3469034
description:
Jan  4 03:27:33 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=168.205.223.249, lip=66.85.158.91, TLS, session=<sweo6IJHY7+ozd/5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.134
country_id: 6252001
description:
Jan  4 03:29:05 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.134, lip=66.85.158.92, TLS: Connection closed, session=<8jo/74JHEsNChJmG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.134
country_id: 6252001
description:
Jan  4 03:29:09 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=66.132.153.134, lip=66.85.158.92, session=<yI6C74JHmCVChJmG>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.220.185.209
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.220.185.209: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.202.9.133
country_id: 6252001
description:
Jan  4 03:32:40 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.202.9.133, lip=66.85.158.92, TLS: Connection closed, session=<OAgS/IJHNL0jygmF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.164
country_id: 2186224
description:
2026-01-04 03:32:51 dovecot_login authenticator failed for H=([121.73.163.164]) [121.73.163.164]:56154: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.122
country_id: 1269750
description:
2026-01-04 03:33:59 dovecot_login authenticator failed for H=([128.185.253.122]) [128.185.253.122]:38282: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 03:34:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<shop@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<6bUrAoNHDqojupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Jan  4 03:35:48 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<QwooB4NHjuIFhH+s>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 03:36:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<E+ChCYNHdJ1nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.151
country_id: 3865483
description:
Jan  4 03:39:41 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=179.0.250.151, lip=66.85.158.91, TLS, session=<lcrcE4NHE7ezAPqX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.63.5.195
country_id: 2215636
description:
Jan  4 03:40:17 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 27 secs): user=<charanaw>, method=PLAIN, rip=5.63.5.195, lip=66.85.158.91, TLS, session=<R9apFYNHe+0FPwXD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 03:46:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<926CLINHxouOq2dI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.24.64.209
country_id: 2635167
description:
Jan  4 03:48:04 host2 sshd[2411547]: Disconnected from invalid user claude 82.24.64.209 port 35614 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.55.72
country_id: 6252001
description:
Jan  4 03:48:49 host2 sshd[2412266]: Disconnected from invalid user claude 107.174.55.72 port 42556 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2026-01-04 03:48:56 dovecot_plain authenticator failed for H=217-215-74-195-no2620.tbcn.telia.com (kands) [217.215.74.195]:38104: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.109.56.72
country_id: 6252001
description:
2026-01-04 03:49:50 dovecot_login authenticator failed for H=(dfw-206-109-56-72.ip4.99.network) [206.109.56.72]:20260: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.58.255.251
country_id: 1522867
description:
Jan  4 03:50:19 host2 sshd[2414448]: Disconnected from invalid user VPN 95.58.255.251 port 53788 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.6.31
country_id: 1880251
description:
2026-01-04 03:50:26 dovecot_login authenticator failed for H=(31.6.245.49.unknown.m1.com.sg) [49.245.6.31]:37776: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 95.58.255.251
country_id: 1522867
description:
Jan  4 03:50:51 host2 sshd[2415202]: Disconnected from invalid user admin 95.58.255.251 port 42782 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.58.255.251
country_id: 1522867
description:
Jan  4 03:51:23 host2 sshd[2415794]: Disconnected from invalid user claude 95.58.255.251 port 35660 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.55.72
country_id: 6252001
description:
Jan  4 03:52:10 host2 sshd[2416621]: Disconnected from invalid user VPN 107.174.55.72 port 55898 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.24.64.209
country_id: 2635167
description:
Jan  4 03:52:58 host2 sshd[2417625]: Disconnected from invalid user debian 82.24.64.209 port 57570 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 03:53:05 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<cFb0RINHtoKuijvy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.58.255.251
country_id: 1522867
description:
Jan  4 03:53:33 host2 sshd[2418247]: Disconnected from invalid user user 95.58.255.251 port 46034 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.24.64.209
country_id: 2635167
description:
Jan  4 03:53:33 host2 sshd[2418255]: Disconnected from invalid user claude 82.24.64.209 port 47410 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.55.72
country_id: 6252001
description:
Jan  4 03:54:10 host2 sshd[2419107]: Disconnected from invalid user roots 107.174.55.72 port 49664 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.79.178
country_id: 1643084
description:
Jan  4 03:54:23 host2 sshd[2419410]: Disconnected from invalid user claude 27.112.79.178 port 53082 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.55.72
country_id: 6252001
description:
Jan  4 03:56:07 host2 sshd[2421576]: Disconnected from invalid user user 107.174.55.72 port 57782 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 82.24.64.209
country_id: 2635167
description:
Jan  4 03:55:14 host2 sshd[2420325]: Disconnected from invalid user vpn 82.24.64.209 port 45008 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.79.178
country_id: 1643084
description:
Jan  4 03:56:28 host2 sshd[2421908]: Disconnected from invalid user pp 27.112.79.178 port 57520 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.60.48.197
country_id: 3686110
description:
Jan  4 03:56:41 host2 sshd[2422169]: Disconnected from invalid user claude 190.60.48.197 port 51470 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.60.48.197
country_id: 3686110
description:
Jan  4 03:57:18 host2 sshd[2422933]: Disconnected from invalid user claude 190.60.48.197 port 48288 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.60.48.197
country_id: 3686110
description:
Jan  4 03:57:53 host2 sshd[2423733]: Disconnected from invalid user cisco 190.60.48.197 port 53908 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 03:58:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<ufITWYNH7q1A46ZK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.55.72
country_id: 6252001
description:
Jan  4 03:58:53 host2 sshd[2424926]: Disconnected from invalid user admin 107.174.55.72 port 42916 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.79.178
country_id: 1643084
description:
Jan  4 03:58:22 host2 sshd[2424267]: Disconnected from invalid user ubuntu 27.112.79.178 port 52812 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 04:00:23 host2 sshd[2426612]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.211.84.189
country_id: 3017382
description:
Jan  4 04:00:22 host2 sshd[2426632]: Disconnected from invalid user claude 4.211.84.189 port 58850 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 4.211.84.189
country_id: 3017382
description:
Jan  4 04:01:58 host2 sshd[2428643]: Disconnected from invalid user gourav 4.211.84.189 port 56870 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.94.106.254
country_id: 6252001
description:
Jan  4 04:02:06 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.94.106.254, lip=66.85.158.91, session=<sjxPZYNHeOdCXmr+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.211.84.189
country_id: 3017382
description:
Jan  4 04:01:26 host2 sshd[2428116]: Disconnected from invalid user claude 4.211.84.189 port 60126 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.0.19
country_id: 1643084
description:
Jan  4 04:01:36 host2 sshd[2428246]: Disconnected from invalid user vncuser 103.186.0.19 port 58040 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.94.106.254
country_id: 6252001
description:
Jan  4 04:02:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.94.106.254, lip=66.85.158.91, session=<6RW+ZoNHGuhCXmr+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 04:03:53 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<4YeZa4NHlsAjupN+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.58.118.29
country_id: 6252001
description:
Jan  4 04:03:12 host2 sshd[2430337]: Disconnected from invalid user crypto 198.58.118.29 port 43438 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.0.19
country_id: 1643084
description:
Jan  4 04:03:28 host2 sshd[2430743]: Disconnected from invalid user fy 103.186.0.19 port 50650 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.58.118.29
country_id: 6252001
description:
Jan  4 04:04:15 host2 sshd[2431901]: Disconnected from invalid user claude 198.58.118.29 port 47078 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.186.0.19
country_id: 1643084
description:
Jan  4 04:04:46 host2 sshd[2432808]: Disconnected from invalid user joao 103.186.0.19 port 55986 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.70
country_id: 6252001
description:
Jan  4 04:06:43 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.70, lip=66.85.158.92, session=<dKzSdYNHpvvG6xhG>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  4 04:08:44 host2 pure-ftpd[2438540]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 04:10:31 host2 sshd[2442216]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 04:11:41 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<V9R/h4NHAJtnmud6>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.207.59.236
country_id: 6251999
description:
[2026-01-04 04:14:26 +0530] info [cpaneld] 104.207.59.236 - simpleengineerin "GET /execute/Variables/get_user_information HTTP/1.1" FAILED LOGIN cpaneld: User simpleengineerin has their account suspended. Login blocked.


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 142.171.103.72
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[142.171.103.72] [Remote Port]=[60062] [Authentication Database]=[mail] [Username]=[no-reply@anandaobauae.org] (10/10 failures) (blocked until [Sun Jan  4 22:44:44 2026 UTC/Mon Jan  5 04:14:44 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 04:14:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<OPJ5koNHnuqOq2dI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.54.40
country_id: 453733
description:
2026-01-04 04:20:55 dovecot_login authenticator failed for H=40-54-166-83.dyn.estpak.ee [83.166.54.40]:52967: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2026-01-04 04:20:28 dovecot_login authenticator failed for H=([152.52.234.46]) [182.95.176.194]:46656: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 04:22:08 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<Jy/arINHsreuijvy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2026-01-04 04:21:08 dovecot_plain authenticator failed for H=c-73-208-81-125.hsd1.in.comcast.net (hodinguant) [73.208.81.125]:56942: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 04:30:01 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<dKUPyYNH3ONA46ZK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.159
country_id: 6252001
description:
Jan  4 04:31:57 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.159, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<V+gO0INHad6TuYSf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 04:33:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<q3d91INHwr0jupN+>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 35.186.147.126
country_id: 1880251
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[35.186.147.126] [Remote Port]=[48578] [Authentication Database]=[mail] [Username]=[sales@anandaobauae.org] (10/10 failures) (blocked until [Sun Jan  4 23:03:11 2026 UTC/Mon Jan  5 04:33:11 2026 LOCAL])


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.207.49.68
country_id: 3469034
description:
[2026-01-04 04:33:27 +0530] info [cpaneld] 104.207.49.68 - simpleengineerin "GET /execute/Variables/get_user_information HTTP/1.1" FAILED LOGIN cpaneld: User simpleengineerin has their account suspended. Login blocked.


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 04:37:41 host2 sshd[2483152]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  4 04:38:08 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<n0EV5oNHWO0FhXlo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  4 04:37:29 host2 sshd[2482960]: Disconnected from invalid user admin 2.57.121.112 port 35200 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 04:43:16 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<C6Nt+INHAOKOq2dI>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.50.174.106
country_id: 6252001
description:
[2026-01-04 04:45:56 +0530] info [cpaneld] 209.50.174.106 - simpleengineerin "GET /execute/Variables/get_user_information HTTP/1.1" FAILED LOGIN cpaneld: User simpleengineerin has their account suspended. Login blocked.


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 164.90.235.157
country_id: 2921044
description:
Jan  4 04:46:25 host2 pure-ftpd[2494669]: (?@164.90.235.157) [INFO] New connection from 164.90.235.157


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 164.90.235.157
country_id: 2921044
description:
Jan  4 04:46:27 host2 pure-ftpd[2494708]: (?@164.90.235.157) [INFO] New connection from 164.90.235.157


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 04:46:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<2Sl6BYRH1IJnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 04:50:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<o6R7E4RHHHGuijvy>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 102.204.223.84
country_id: 2328926
description:
Jan  4 05:00:16 host2 pure-ftpd[2510037]: (?@102.204.223.84) [INFO] New connection from 102.204.223.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.192.123.12
country_id: 6252001
description:
2026-01-04 05:00:23 dovecot_plain authenticator failed for H=(yeams) [199.192.123.12]:40688: 535 Incorrect authentication data (set_id=sales@ksoft.lk)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 64.227.166.74
country_id: 1269750
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[64.227.166.74] [Remote Port]=[54546] [Authentication Database]=[mail] [Username]=[test@anandaobauae.org] (10/10 failures) (blocked until [Sun Jan  4 23:31:24 2026 UTC/Mon Jan  5 05:01:24 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 05:01:26 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<x5BjOYRHEtVA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 05:03:08 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<PFt/P4RHND8jupN+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.163
country_id: 6252001
description:
Jan  4 05:05:54 host2 pure-ftpd[2516119]: (?@205.210.31.163) [INFO] New connection from 205.210.31.163


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.94.106.254
country_id: 6252001
description:
Jan  4 05:11:41 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.94.106.254, lip=66.85.158.91, session=<AaEvXoRHQuJCXmr+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  4 05:11:50 host2 pure-ftpd[2524078]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 05:12:08 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<YX6lX4RHrM+Oq2dI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2026-01-04 05:14:17 dovecot_plain authenticator failed for H=c-73-137-7-97.hsd1.ga.comcast.net (homartic) [73.137.7.97]:36426: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.36.71
country_id: 6252001
description:
Jan  4 05:15:32 host2 sshd[2529628]: Disconnected from invalid user bot 165.154.36.71 port 42556 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.36.71
country_id: 6252001
description:
Jan  4 05:16:05 host2 sshd[2530223]: Disconnected from invalid user claude 165.154.36.71 port 54156 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.178.106
country_id: 3175395
description:
Jan  4 05:16:36 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=217.26.178.106, lip=66.85.158.91, TLS, session=<HPu/boRHu8jZGrJq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.215.165
country_id: 732800
description:
Jan  4 05:16:54 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.255.215.165, lip=66.85.158.91, TLS, session=<IrPTb4RHhIe5/9el>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.36.71
country_id: 6252001
description:
Jan  4 05:16:35 host2 sshd[2530797]: Disconnected from invalid user claude 165.154.36.71 port 10754 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 05:19:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<HrgDeYRHYsauijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 05:22:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<NECehYRHOq5nmud6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.231.14.54
country_id: 1819730
description:
Jan  4 05:23:34 host2 sshd[2538952]: Disconnected from invalid user tom 103.231.14.54 port 56672 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.82
country_id: 2635167
description:
Jan  4 05:24:17 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.82, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<v3g5i4RH2alX7LBS>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.150
country_id: 2635167
description:
Jan  4 05:24:16 host2 dovecot[1170291]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.150, lip=66.85.158.91, TLS, session=<0fEoi4RHr+C594mW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.86
country_id: 2635167
description:
Jan  4 05:25:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.86, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<Wzcwj4RH462594lW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.82
country_id: 2635167
description:
Jan  4 05:24:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.82, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<Krk0jYRH3bO594lS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.231.14.54
country_id: 1819730
description:
Jan  4 05:25:45 host2 sshd[2542133]: Disconnected from invalid user frappe 103.231.14.54 port 40292 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.100
country_id: 2635167
description:
Jan  4 05:25:57 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.100, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<HIArkYRHkZxX7LBk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.77
country_id: 2635167
description:
Jan  4 05:26:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.77, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<1Kgmk4RHm9O594lN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.106
country_id: 2635167
description:
Jan  4 05:27:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.106, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<1R4glYRHf+ZX7LBq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.102
country_id: 2635167
description:
Jan  4 05:28:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.102, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<4LkYmYRHA4JX7LBm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.87
country_id: 2635167
description:
Jan  4 05:27:36 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.87, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<5GYdl4RH/bJX7LBX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.93
country_id: 2635167
description:
Jan  4 05:28:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.93, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<oiUSm4RH6bm594ld>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.105
country_id: 2635167
description:
Jan  4 05:29:16 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.105, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<I2cNnYRHsalX7LBp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-04 05:31:28 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:57191: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 05:31:56 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<G/VxpoRHwuFA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 05:33:05 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<7zCPqoRHrNcjupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.127
country_id: 6252001
description:
Jan  4 05:34:32 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.127, lip=66.85.158.92, TLS: Connection closed, session=<40zir4RH+k9ChJl/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 05:40:04 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<Zz6Nw4RHIouOq2dI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.224.171.101
country_id: 6252001
description:
2026-01-04 05:43:34 dovecot_plain authenticator failed for H=c-73-224-171-101.hsd1.fl.comcast.net (alicha) [73.224.171.101]:54988: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.99.14
country_id: 290557
description:
2026-01-04 05:43:39 dovecot_plain authenticator failed for H=(baritimper) [5.32.99.14]:36567: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.241.90
country_id: 3469034
description:
2026-01-04 05:44:22 dovecot_login authenticator failed for H=(ccabv.org9.static.gvt.net.br) [187.58.241.90]:52236: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2026-01-04 05:44:50 dovecot_login authenticator failed for H=bb121-6-81-59.singnet.com.sg [121.6.81.59]:58886: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 05:45:25 host2 sshd[2563797]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.65.99
country_id: 3144096
description:
2026-01-04 05:47:18 dovecot_login authenticator failed for H=(cm-178.232.65.99.get.no) [178.232.65.99]:60507: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.141.74
country_id: 298795
description:
2026-01-04 05:46:54 dovecot_plain authenticator failed for H=(sanninisma) [5.11.141.74]:49024: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.196.9.141
country_id: 2635167
description:
Jan  4 05:46:58 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<root@anandaobauae.org>, method=PLAIN, rip=185.196.9.141, lip=66.85.158.91, session=<nRM73IRH7pu5xAmN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 05:47:34 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<Kp1i3oRHRqmuijvy>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 107.173.201.172
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 107.173.201.172: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.255.45
country_id: 597427
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 104.28.255.45 - dragon "GET /execute/DomainInfo/domains_data?format=json&return_https_redirect_status=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  4 05:58:11 host2 sshd[2577347]: Disconnected from invalid user admin 2.57.121.112 port 43498 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 05:58:27 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<nhJOBYVHvrhnmud6>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 103.154.231.122
country_id: 1643084
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[103.154.231.122] [Remote Port]=[47294] [Authentication Database]=[mail] [Username]=[support@anandaobauae.org] (10/10 failures) (blocked until [Mon Jan  5 00:28:25 2026 UTC/Mon Jan  5 05:58:25 2026 LOCAL])


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 06:00:31 host2 sshd[2579805]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 06:02:29 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<FK7BE4VHUOxA46ZK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.39.179
country_id: 6252001
description:
Jan  4 06:04:18 host2 sshd[2583772]: Disconnected from invalid user server 162.240.39.179 port 38468 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 06:03:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<dsgxGIVHMrMjupN+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.139
country_id: 6252001
description:
Jan  4 06:04:30 host2 pure-ftpd[2583939]: (?@66.132.153.139) [INFO] New connection from 66.132.153.139


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.112.0.11
country_id: 3469034
description:
Jan  4 06:04:57 host2 sshd[2584336]: Disconnected from invalid user amit 189.112.0.11 port 47084 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.39.179
country_id: 6252001
description:
Jan  4 06:06:05 host2 sshd[2585655]: Disconnected from invalid user public 162.240.39.179 port 35124 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.112.0.11
country_id: 3469034
description:
Jan  4 06:06:17 host2 sshd[2585827]: Disconnected from invalid user bruce 189.112.0.11 port 39346 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.112.0.11
country_id: 3469034
description:
Jan  4 06:07:02 host2 sshd[2586629]: Disconnected from invalid user oracle 189.112.0.11 port 53180 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.39.179
country_id: 6252001
description:
Jan  4 06:07:11 host2 sshd[2586787]: Disconnected from invalid user amit 162.240.39.179 port 58374 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.29.11
country_id: 1880251
description:
Jan  4 06:06:34 host2 sshd[2586081]: Disconnected from invalid user justin 165.154.29.11 port 56670 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.39.179
country_id: 6252001
description:
Jan  4 06:08:17 host2 sshd[2587748]: Disconnected from invalid user user 162.240.39.179 port 53392 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.112.0.11
country_id: 3469034
description:
Jan  4 06:07:46 host2 sshd[2587248]: Disconnected from invalid user surya 189.112.0.11 port 38780 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.187.9.8
country_id: 1880251
description:
Jan  4 06:07:50 host2 sshd[2587317]: Disconnected from invalid user postgres 52.187.9.8 port 57942 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.240.39.179
country_id: 6252001
description:
Jan  4 06:09:21 host2 sshd[2589107]: Disconnected from invalid user bruce 162.240.39.179 port 48408 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.112.0.11
country_id: 3469034
description:
Jan  4 06:08:25 host2 sshd[2587861]: Disconnected from invalid user user 189.112.0.11 port 52612 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 06:09:02 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<hUknK4VHeoaOq2dI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.29.11
country_id: 1880251
description:
Jan  4 06:09:33 host2 sshd[2589360]: Disconnected from invalid user lars 165.154.29.11 port 35544 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.29.11
country_id: 1880251
description:
Jan  4 06:10:50 host2 sshd[2590926]: Disconnected from invalid user test 165.154.29.11 port 34966 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.11.64.162
country_id: 241170
description:
Jan  4 06:11:17 host2 sshd[2591375]: Disconnected from invalid user hassan 212.11.64.162 port 34898 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.176
country_id: 3175395
description:
Jan  4 06:12:02 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=185.15.171.176, lip=66.85.158.91, TLS, session=<qtYJNYVH7a+5D6uw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.28.99
country_id: 2300660
description:
Jan  4 06:12:24 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<charanaw>, method=PLAIN, rip=41.139.28.99, lip=66.85.158.91, TLS, session=<wWkqNoVHAqIpixxj>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 52.187.9.8
country_id: 1880251
description:
Jan  4 06:13:48 host2 sshd[2593714]: Disconnected from invalid user pablo 52.187.9.8 port 52654 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  4 06:14:56 host2 pure-ftpd[2594896]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.145.10.140
country_id: 6252001
description:
2026-01-04 06:15:22 dovecot_plain authenticator failed for H=c-76-145-10-140.hsd1.ga.comcast.net (diaripbor) [76.145.10.140]:43018: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.11.64.162
country_id: 241170
description:
Jan  4 06:16:41 host2 sshd[2596983]: Disconnected from invalid user claude 212.11.64.162 port 51534 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 06:18:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<k+39S4VHXGOuijvy>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 212.11.64.162
country_id: 241170
description:
Jan  4 06:18:33 host2 sshd[2598702]: Disconnected from invalid user zs 212.11.64.162 port 34058 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.129.57.71
country_id: 6252001
description:
2026-01-04 06:18:46 dovecot_plain authenticator failed for H=c-73-129-57-71.hsd1.md.comcast.net (coness) [73.129.57.71]:41824: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.53.94.242
country_id: 1269750
description:
2026-01-04 06:21:09 dovecot_login authenticator failed for H=([202.53.94.242]) [202.53.94.242]:54546: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.151.46.98
country_id: 1861060
description:
2026-01-04 06:20:42 dovecot_login authenticator failed for H=(fp5cca5266.gifg408.ap.nuro.jp) [45.151.46.98]:64738: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.176.157.57
country_id: 6252001
description:
2026-01-04 06:23:51 dovecot_plain authenticator failed for H=c-73-176-157-57.hsd1.il.comcast.net (uncepal) [73.176.157.57]:47000: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 06:27:38 host2 sshd[2607288]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.113
country_id: 6252001
description:
Jan  4 06:27:48 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 9 secs): user=<>, rip=66.132.153.113, lip=66.85.158.91, TLS: Connection closed, session=<uaNhboVHlPpChJlx>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.64
country_id: 6252001
description:
Jan  4 06:29:37 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.64, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<IYrpdIVHxMbG6xhA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.130
country_id: 6252001
description:
Jan  4 06:33:13 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=66.132.153.130, lip=66.85.158.92, session=<Vai/gYVHzPVChJmC>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.250
country_id: 2635167
description:
Jan  4 06:33:25 host2 dovecot[1170291]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.250, lip=66.85.158.91, TLS, session=<z7R/goVH36pX7LD6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.103
country_id: 2635167
description:
Jan  4 06:33:26 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.103, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<4piPgoVHIY9X7LBn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.99
country_id: 2635167
description:
Jan  4 06:34:00 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.99, lip=66.85.158.91, TLS handshaking: Connection closed, session=<3dOKhIVHMZ9X7LBj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.106
country_id: 2635167
description:
Jan  4 06:34:33 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.106, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<JUSGhoVHtbK594lq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.91
country_id: 2635167
description:
Jan  4 06:35:06 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.91, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<r7aBiIVH8Zm594lb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.104
country_id: 2635167
description:
Jan  4 06:36:13 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (disconnected before auth was ready, waited 0 secs): user=<>, rip=185.247.137.104, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Nll2jIVHg9K594lo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.100
country_id: 2635167
description:
Jan  4 06:35:39 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.100, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<Nfx8ioVHo4e594lk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.96
country_id: 2635167
description:
Jan  4 06:36:46 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.96, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<OXVzjoVHM99X7LBg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.84
country_id: 2635167
description:
Jan  4 06:37:19 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.84, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<DOFukIVHS6G594lU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.99
country_id: 2635167
description:
Jan  4 06:37:52 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.99, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<KGZokoVH0blX7LBj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 06:38:05 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<tIkIk4VHLuhnmud6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.82
country_id: 2635167
description:
Jan  4 06:38:26 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.82, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<UcRjlIVHR7C594lS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.208
country_id: 2542007
description:
2026-01-04 06:39:45 dovecot_plain authenticator failed for H=(unead) [154.144.255.208]:39280: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.94.106.254
country_id: 6252001
description:
Jan  4 06:40:04 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.94.106.254, lip=66.85.158.91, session=<vdBAmoVHMI5CXmr+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 06:41:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<H8CVnoVHzMtA46ZK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.130.206
country_id: 3144096
description:
2026-01-04 06:40:49 dovecot_login authenticator failed for H=(cm-178.232.130.206.get.no) [178.232.130.206]:38258: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.245.38
country_id: 1269750
description:
2026-01-04 06:41:10 dovecot_login authenticator failed for H=([152.52.245.38]) [152.52.245.38]:51422: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.185
country_id: 6252001
description:
Jan  4 06:41:13 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=71.6.146.185, lip=66.85.158.91, session=<kfRgnoVH5LlHBpK5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.185
country_id: 6252001
description:
Jan  4 06:41:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=545) failed: Connection reset by peer (no auth attempts in 10 secs): user=<>, rip=71.6.146.185, lip=66.85.158.91, TLS: read(size=545) failed: Connection reset by peer, session=<NFHjnoVH3LhHBpK5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 06:43:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<iT0jpYVHOoUjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 06:47:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<IA50s4VHjN+Oq2dI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.94.106.254
country_id: 6252001
description:
Jan  4 06:51:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.94.106.254, lip=66.85.158.91, session=<5BYMw4VHVJ5CXmr+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  4 06:51:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<0YrQw4VHCsgFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 07:00:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<eTLd4oVH8kOuijvy>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.227.3.79
country_id: 6252001
description:
Jan  4 07:02:54 host2 sshd[2642234]: Disconnected from invalid user eric 165.227.3.79 port 57551 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.251
country_id: 6252001
description:
Jan  4 07:03:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.251, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ZCXy7IVHVMTN0h/7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.227.3.79
country_id: 6252001
description:
Jan  4 07:02:25 host2 sshd[2641741]: Disconnected from invalid user glass 165.227.3.79 port 51882 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.227.3.79
country_id: 6252001
description:
Jan  4 07:03:23 host2 sshd[2642819]: Disconnected from invalid user jamesm 165.227.3.79 port 34986 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan  4 07:04:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<Vbgj8YVHkKoDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan  4 07:05:49 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: Connection closed, session=<bfZS9oVHKOwDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan  4 07:07:02 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<11+x+oVHLMADlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan  4 07:08:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS, session=<9+A5/4VHvtMDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan  4 07:08:29 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS, session=<QyDg/4VHwsQDlTsa>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.64.123.41
country_id: 3895114
description:
Jan  4 07:08:26 host2 sshd[2648422]: Disconnected from invalid user ts 186.64.123.41 port 40819 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 136.119.213.208
country_id: 6252001
description:
Jan  4 07:09:49 host2 sshd[2649837]: Disconnected from invalid user thomas 136.119.213.208 port 45800 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan  4 07:09:53 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: Connection closed, session=<1g/iBIZHfK0DlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.94.106.254
country_id: 6252001
description:
Jan  4 07:10:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.94.106.254, lip=66.85.158.91, session=<Jue/BYZHurxCXmr+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.64.123.41
country_id: 3895114
description:
Jan  4 07:11:14 host2 sshd[2651840]: Disconnected from invalid user yang 186.64.123.41 port 59605 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan  4 07:10:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<u8CoBoZH3p8DlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.252
country_id: 6252001
description:
Jan  4 07:10:29 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.252, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<v10HB4ZHncCTuYT8>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.64.123.41
country_id: 3895114
description:
Jan  4 07:10:30 host2 sshd[2650813]: Disconnected from invalid user backupuser 186.64.123.41 port 53564 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan  4 07:11:40 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS, session=<KsFIC4ZH0MgDlTsa>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.64.123.41
country_id: 3895114
description:
Jan  4 07:12:00 host2 sshd[2652642]: Disconnected from invalid user hadoopuser 186.64.123.41 port 37415 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.239.201.21
country_id: 1605651
description:
Jan  4 07:13:08 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=173.239.201.21, lip=66.85.158.91, session=<XjKAEIZHvJWt78kV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 156.146.55.171
country_id: 732800
description:
Jan  4 07:13:08 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=156.146.55.171, lip=66.85.158.91, session=</H+EEIZHNKickjer>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 37.46.115.52
country_id: 6290252
description:
Jan  4 07:13:08 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=37.46.115.52, lip=66.85.158.91, TLS handshaking: Connection closed, session=<yzqAEIZHlqUlLnM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.226.88.121
country_id: 2661886
description:
2026-01-04 07:12:49 dovecot_plain authenticator failed for H=81-226-88-121-no600.tbcn.telia.com (cless) [81.226.88.121]:43554: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 173.244.33.15
country_id: 1282988
description:
Jan  4 07:13:05 host2 pure-ftpd[2653868]: (?@173.244.33.15) [INFO] New connection from 173.244.33.15


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.64.123.41
country_id: 3895114
description:
Jan  4 07:12:44 host2 sshd[2653396]: Disconnected from invalid user claude 186.64.123.41 port 43456 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 154.16.105.34
country_id: 6252001
description:
Jan  4 07:13:05 host2 pure-ftpd[2653852]: (?@154.16.105.34) [INFO] New connection from 154.16.105.34


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.154.155.30
country_id: 3932488
description:
Jan  4 07:13:08 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.154.155.30, lip=66.85.158.91, TLS, session=<NRWAEIZHSt4tmpse>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.83.46.40
country_id: 3017382
description:
Jan  4 07:13:25 host2 sshd[2654256]: Disconnected from invalid user web1 51.83.46.40 port 57908 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 136.119.213.208
country_id: 6252001
description:
Jan  4 07:13:26 host2 sshd[2654276]: Disconnected from invalid user wyf 136.119.213.208 port 43872 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.195.41
country_id: 6252001
description:
Jan  4 07:13:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.65.195.41, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<VrkfE4ZH0KgUQcMp>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.83.46.40
country_id: 3017382
description:
Jan  4 07:14:51 host2 sshd[2655778]: Disconnected from invalid user webadm 51.83.46.40 port 37886 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.239.45.43
country_id: 241170
description:
Jan  4 07:15:19 host2 sshd[2656525]: Disconnected from invalid user syncuser 156.239.45.43 port 54342 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.124.97.102
country_id: 2245662
description:
Jan  4 07:15:33 host2 sshd[2656748]: Disconnected from invalid user admin 154.124.97.102 port 42009 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.124.97.102
country_id: 2245662
description:
Jan  4 07:16:47 host2 sshd[2658296]: Disconnected from invalid user claude 154.124.97.102 port 45578 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.239.45.43
country_id: 241170
description:
Jan  4 07:17:41 host2 sshd[2659209]: Disconnected from invalid user admin 156.239.45.43 port 54470 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.124.97.102
country_id: 2245662
description:
Jan  4 07:18:01 host2 sshd[2659628]: Disconnected from invalid user administrador 154.124.97.102 port 45365 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  4 07:18:09 host2 pure-ftpd[2659832]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.124.97.102
country_id: 2245662
description:
Jan  4 07:19:04 host2 sshd[2660738]: Disconnected from invalid user tao 154.124.97.102 port 36107 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.239.45.43
country_id: 241170
description:
Jan  4 07:19:18 host2 sshd[2661005]: Disconnected from invalid user ubuntu 156.239.45.43 port 54648 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.189.36.4
country_id: 3469034
description:
[2026-01-04 07:18:56 +0530] info [cpaneld] 181.189.36.4 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.239.45.43
country_id: 241170
description:
Jan  4 07:20:20 host2 sshd[2662239]: Disconnected from invalid user k3 156.239.45.43 port 54774 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 07:27:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<Kum0RIZHlOpnmud6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.52
country_id: 6252001
description:
Jan  4 07:28:59 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.52, lip=66.85.158.91, TLS handshaking: Connection closed, session=<wycwSYZHBHNBMQE0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.68
country_id: 6252001
description:
Jan  4 07:29:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.139.68, lip=66.85.158.92, session=<zp2MSoZH9la4aYtE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.52
country_id: 6252001
description:
Jan  4 07:29:31 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.52, lip=66.85.158.91, TLS: Connection closed, session=<EoAhS4ZHAIVBMQE0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2026-01-04 07:30:19 dovecot_plain authenticator failed for H=c-73-213-237-28.hsd1.va.comcast.net (herined) [73.213.237.28]:45838: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 07:30:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<PEZsT4ZHWrNA46ZK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.85.43.89
country_id: 6252001
description:
Jan  4 07:30:55 host2 sshd[2673830]: Disconnected from invalid user claude 47.85.43.89 port 41776 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 102.204.223.100
country_id: 2328926
description:
Jan  4 07:34:02 host2 pure-ftpd[2676764]: (?@102.204.223.100) [INFO] New connection from 102.204.223.100


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 07:34:26 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<efiJXIZHZjQjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.89.166.236
country_id: 2635167
description:
Jan  4 07:36:12 host2 sshd[2679015]: Disconnected from invalid user admin 51.89.166.236 port 39264 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.95.82.21
country_id: 1861060
description:
Jan  4 07:36:11 host2 sshd[2678984]: Disconnected from invalid user guest 150.95.82.21 port 59144 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.187.2
country_id: 1269750
description:
2026-01-04 07:36:40 dovecot_login authenticator failed for H=(nsg-corporate-2.187.185.122.airtel.in) [122.185.187.2]:50372: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.89.166.236
country_id: 2635167
description:
Jan  4 07:36:44 host2 sshd[2679566]: Disconnected from invalid user user 51.89.166.236 port 37774 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 07:37:02 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<Ec/eZYZHpN2Oq2dI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.202
country_id: 1269750
description:
2026-01-04 07:37:08 dovecot_login authenticator failed for H=([128.185.247.100]) [182.95.222.202]:46922: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.170.15
country_id: 241170
description:
Jan  4 07:37:48 host2 sshd[2680773]: Disconnected from invalid user esuser 154.91.170.15 port 50452 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.95.82.21
country_id: 1861060
description:
Jan  4 07:39:19 host2 sshd[2682285]: Disconnected from invalid user esuser 150.95.82.21 port 34906 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-01-04 07:39:42 dovecot_plain authenticator failed for H=(cureeze) [154.144.243.93]:60200: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.170.15
country_id: 241170
description:
Jan  4 07:39:51 host2 sshd[2682711]: Disconnected from invalid user claude 154.91.170.15 port 41006 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.89.166.236
country_id: 2635167
description:
Jan  4 07:40:13 host2 sshd[2683319]: Disconnected from invalid user sysadmin 51.89.166.236 port 59566 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.95.82.21
country_id: 1861060
description:
Jan  4 07:41:06 host2 sshd[2684225]: Disconnected from invalid user claude 150.95.82.21 port 42942 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.91.170.15
country_id: 241170
description:
Jan  4 07:40:23 host2 sshd[2683579]: Disconnected from invalid user claude 154.91.170.15 port 48326 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 51.89.166.236
country_id: 2635167
description:
Jan  4 07:40:42 host2 sshd[2683876]: Received disconnect from 51.89.166.236 port 53278:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.89.166.236
country_id: 2635167
description:
Jan  4 07:40:42 host2 sshd[2683876]: Disconnected from invalid user dev 51.89.166.236 port 53278 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.170.15
country_id: 241170
description:
Jan  4 07:41:51 host2 sshd[2684821]: Disconnected from invalid user claude 154.91.170.15 port 41676 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.95.82.21
country_id: 1861060
description:
Jan  4 07:41:41 host2 sshd[2684714]: Disconnected from invalid user claude 150.95.82.21 port 55034 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.90
country_id: 3865483
description:
Jan  4 07:43:00 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=179.0.250.90, lip=66.85.158.91, TLS, session=<D8kjeoZHHZmzAPpa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.118
country_id: 1269750
description:
Jan  4 07:43:20 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<charanaw>, method=PLAIN, rip=103.18.166.118, lip=66.85.158.91, TLS, session=<PJp5e4ZHVtdnEqZ2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.185
country_id: 6252001
description:
Jan  4 07:43:55 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=71.6.146.185, lip=66.85.158.92, session=<j2+efoZHdKlHBpK5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.93.168.35
country_id: 298795
description:
Jan  4 07:47:05 host2 sshd[2690740]: Disconnected from invalid user cronuser 45.93.168.35 port 47502 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.93.168.35
country_id: 298795
description:
Jan  4 07:48:03 host2 sshd[2691555]: Disconnected from invalid user alex 45.93.168.35 port 29732 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.93.168.35
country_id: 298795
description:
Jan  4 07:48:31 host2 sshd[2692031]: Disconnected from invalid user deployer 45.93.168.35 port 26980 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.93.168.35
country_id: 298795
description:
Jan  4 07:49:31 host2 sshd[2693006]: Disconnected from invalid user github 45.93.168.35 port 51804 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.104.231.161
country_id: 1227603
description:
[2026-01-04 07:50:12 +0530] info [webmaild] 212.104.231.161 - chiranthana.rajapaksha@saara.lk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.104.231.161
country_id: 1227603
description:
[2026-01-04 07:51:00 +0530] info [webmaild] 212.104.231.161 - chiranthana.rajapaksha@saara.lk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.191
country_id: 3996063
description:
2026-01-04 07:51:34 dovecot_login authenticator failed for H=([177.236.146.191]) [177.236.146.191]:45299: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.163.187
country_id: 3144096
description:
2026-01-04 07:51:47 dovecot_login authenticator failed for H=([62.97.163.187]) [62.97.163.187]:57894: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.59.223.190
country_id: 6252001
description:
2026-01-04 07:51:59 dovecot_login authenticator failed for H=syn-045-059-223-190.biz.spectrum.com ([65.76.121.8]) [45.59.223.190]:17902: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 07:52:08 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<SJjhm4ZHJuCuijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 212.104.231.161
country_id: 1227603
description:
Jan  4 07:53:50 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<chiranthana.rajapaksha@saara.lk>, method=PLAIN, rip=212.104.231.161, lip=66.85.158.91, TLS: Connection closed, session=<EQTjoYZHAxbUaOeh>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.189.36.4
country_id: 3469034
description:
[2026-01-04 07:54:49 +0530] info [cpaneld] 181.189.36.4 - vdeploy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.199.112
country_id: 3469034
description:
Jan  4 07:56:54 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=179.189.199.112, lip=66.85.158.91, TLS, session=<qMnRq4ZHSs+zvcdw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.118.183.160
country_id: 3865483
description:
Jan  4 07:56:20 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=181.118.183.160, lip=66.85.158.91, TLS, session=<uPPNqYZHbuK1dreg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 212.104.231.161
country_id: 1227603
description:
Jan  4 07:54:39 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 36 secs): user=<chiranthana.rajapaksha@saara.lk>, method=PLAIN, rip=212.104.231.161, lip=66.85.158.91, TLS: Connection closed, session=<3jHeooZHBBbUaOeh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.5.189.180
country_id: 241170
description:
Jan  4 07:58:37 host2 sshd[2701471]: Disconnected from invalid user nidhi 69.5.189.180 port 37700 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.178.35.212
country_id: 3017382
description:
Jan  4 07:58:47 host2 sshd[2701576]: Disconnected from invalid user ubuntu 51.178.35.212 port 42160 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.159.83
country_id: 2921044
description:
Jan  4 07:59:58 host2 sshd[2702760]: Disconnected from invalid user devuser 54.38.159.83 port 38540 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.35.212
country_id: 3017382
description:
Jan  4 08:00:47 host2 sshd[2703828]: Disconnected from invalid user ubuntu 51.178.35.212 port 43324 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.159.83
country_id: 2921044
description:
Jan  4 08:00:57 host2 sshd[2703996]: Disconnected from invalid user hamza 54.38.159.83 port 45384 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.5.189.180
country_id: 241170
description:
Jan  4 08:00:58 host2 sshd[2704010]: Disconnected from invalid user ubuntu 69.5.189.180 port 58276 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 37.59.110.4
country_id: 3017382
description:
Jan  4 08:01:08 host2 sshd[2704254]: Disconnected from invalid user qiyuesuo 37.59.110.4 port 35710 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.59.110.4
country_id: 3017382
description:
Jan  4 08:00:39 host2 sshd[2703700]: Disconnected from invalid user lily 37.59.110.4 port 59904 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.5.189.180
country_id: 241170
description:
Jan  4 08:01:29 host2 sshd[2704592]: Disconnected from invalid user claude 69.5.189.180 port 50958 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 54.38.159.83
country_id: 2921044
description:
Jan  4 08:02:33 host2 sshd[2705578]: Received disconnect from 54.38.159.83 port 55794:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.159.83
country_id: 2921044
description:
Jan  4 08:02:33 host2 sshd[2705578]: Disconnected from invalid user vijay 54.38.159.83 port 55794 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.188.252.208
country_id: 6252001
description:
2026-01-04 08:02:37 dovecot_plain authenticator failed for H=c-73-188-252-208.hsd1.pa.comcast.net (wortum) [73.188.252.208]:48754: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.37.253.93
country_id: 6252001
description:
2026-01-04 08:03:39 dovecot_plain authenticator failed for H=([169.254.167.31]) [193.37.253.93]:44545: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 193.37.253.93
country_id: 6252001
description:
Jan  4 08:03:58 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=193.37.253.93, lip=66.85.158.91, TLS handshaking: Connection closed, session=<LdBMxoZHoXfBJf1d>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.106.19
country_id: 6252001
description:
Jan  4 08:06:39 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.64.106.19, lip=66.85.158.92, TLS handshaking: Connection closed, session=<GBflz4ZHcNQUQGoT>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 44.251.203.105
country_id: 6252001
description:
Jan  4 08:36:24 host2 pure-ftpd[2711434]: (?@44.251.203.105) [INFO] New connection from 44.251.203.105


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 142.171.103.72
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[142.171.103.72] [Remote Port]=[50882] [Authentication Database]=[mail] [Username]=[support@anandaobauae.org] (10/10 failures) (blocked until [Mon Jan  5 03:06:38 2026 UTC/Mon Jan  5 08:36:38 2026 LOCAL])


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 08:36:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<office@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<tQDOKodHVlojupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.140.19.22
country_id: 1269750
description:
Jan  4 08:36:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@ceylondigest.com>, method=PLAIN, rip=103.140.19.22, lip=66.85.158.91, session=<rLjMKodHbspnjBMW>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 35.186.147.126
country_id: 1880251
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[35.186.147.126] [Remote Port]=[23126] [Authentication Database]=[mail] [Username]=[office@anandaobauae.org] (10/10 failures) (blocked until [Mon Jan  5 03:06:38 2026 UTC/Mon Jan  5 08:36:38 2026 LOCAL])


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 64.227.166.74
country_id: 1269750
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[64.227.166.74] [Remote Port]=[37214] [Authentication Database]=[mail] [Username]=[finance@anandaobauae.org] (10/10 failures) (blocked until [Mon Jan  5 03:06:38 2026 UTC/Mon Jan  5 08:36:38 2026 LOCAL])


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.16
country_id: 798549
description:
Jan  4 08:36:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.16, lip=66.85.158.91, session=<I8zJKodHer9V2ZUQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 08:36:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<finance@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<5+nPKodHXpFA46ZK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 08:36:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<support@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<6Yp2M4dHwsaOq2dI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.151
country_id: 6252001
description:
Jan  4 08:36:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low (no auth attempts in 0 secs): user=<>, rip=162.216.149.151, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<pcmz74ZHAuWi2JWX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 08:36:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<test@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<vqLQKodHQOZnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-04 08:40:16 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (chulls) [87.103.126.54]:17709: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-04 08:46:43 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:56550: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.212.202
country_id: 99237
description:
Jan  4 08:46:47 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<hr>, method=PLAIN, rip=65.20.212.202, lip=66.85.158.91, TLS, session=<x+JhXodHTKpBFNTK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.215.24
country_id: 732800
description:
Jan  4 08:46:24 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=185.255.215.24, lip=66.85.158.91, TLS, session=<tBT8XIdHNYu5/9cY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 197.234.202.100
country_id: 953987
description:
Jan  4 08:46:28 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=197.234.202.100, lip=66.85.158.91, TLS, session=<X+8JXYdHzJrF6spk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.177.113.48
country_id: 3175395
description:
Jan  4 08:46:43 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<hr>, method=PLAIN, rip=195.177.113.48, lip=66.85.158.91, TLS, session=<uyUnXodH25bDsXEw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 08:49:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<IqbuaIdHRpyuijvy>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 08:55:41 host2 sshd[2731139]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  4 08:56:34 host2 sshd[2731846]: Disconnected from invalid user admin 2.57.121.112 port 9215 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2026-01-04 08:56:53 dovecot_plain authenticator failed for H=c-73-208-81-125.hsd1.in.comcast.net (ulcal) [73.208.81.125]:34514: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.179
country_id: 6252001
description:
Jan  4 08:57:01 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.179, lip=66.85.158.92, TLS, session=<MykBhIdHXPfG6xiz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.5.238.101
country_id: 3175395
description:
2026-01-04 08:59:52 dovecot_login authenticator failed for H=host-87-5-238-101.retail.telecomitalia.it [87.5.238.101]:58444: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.170
country_id: 1269750
description:
2026-01-04 09:00:11 dovecot_login authenticator failed for H=([182.95.52.170]) [182.95.52.170]:55576: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  4 09:02:17 host2 sshd[2737201]: Disconnected from invalid user user 2.57.121.25 port 34371 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 68.183.214.199
country_id: 2921044
description:
Jan  4 09:03:04 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=68.183.214.199, lip=66.85.158.92, session=<PkmtmYdHV71Et9bH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 161.35.79.234
country_id: 2921044
description:
Jan  4 09:03:05 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=161.35.79.234, lip=66.85.158.92, session=<E2u5mYdHxPOhI0/q>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.53.44.125
country_id: 1643084
description:
Jan  4 09:05:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=117.53.44.125, lip=66.85.158.91, session=<B/PEoYdHGo91NSx9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 98.80.4.34
country_id: 6252001
description:
Jan  4 09:06:27 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=98.80.4.34, lip=66.85.158.92, session=<JYS8pYdHeN1iUAQi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.128
country_id: 6252001
description:
Jan  4 09:07:45 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=704) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=66.132.153.128, lip=66.85.158.91, TLS: read(size=704) failed: Connection reset by peer, session=<D+RiqodHZoJChJmA>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 09:15:17 host2 sshd[2749387]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.140.19.22
country_id: 1269750
description:
Jan  4 09:20:08 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=103.140.19.22, lip=66.85.158.91, session=<MtyR1odHyNlnjBMW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.105
country_id: 6252001
description:
Jan  4 09:22:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=205.210.31.105, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<XLkl4IdHA8TN0h9p>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.99
country_id: 6252001
description:
Jan  4 09:24:02 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.99, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<lLSe5IdHitOTuYRj>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  4 09:25:51 host2 pure-ftpd[2760264]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 09:26:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<3xtn7YdHtpFA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 09:28:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<0Rl884dHNoZnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 09:28:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<Vgbd84dH9DYjupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.94.106.254
country_id: 6252001
description:
Jan  4 09:30:53 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.94.106.254, lip=66.85.158.91, session=<x10o/YdHBLZCXmr+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 09:31:06 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<qh3M/YdHHuSOq2dI>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.64.215.64
country_id: 298795
description:
[2026-01-04 09:31:35 +0530] info [cpaneld] 212.64.215.64 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.116
country_id: 6252001
description:
Jan  4 09:33:26 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=66.132.153.116, lip=66.85.158.91, session=<fFZKBohHpKBChJl0>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 18.222.201.82
country_id: 6252001
description:
Jan  4 09:40:25 host2 pure-ftpd[2776196]: (?@18.222.201.82) [INFO] New connection from 18.222.201.82


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.222.201.82
country_id: 6252001
description:
Jan  4 09:40:25 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=18.222.201.82, lip=66.85.158.92, session=<rDhBH4hH8KUS3slS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 09:42:53 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<wNPvJ4hHWKWuijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.70.126.239
country_id: 1269750
description:
Jan  4 09:43:12 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=103.70.126.239, lip=66.85.158.91, TLS, session=<k4ztJ4hHnKZnRn7v>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 78.31.145.91
country_id: 798544
description:
Jan  4 09:43:29 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<charanaw>, method=PLAIN, rip=78.31.145.91, lip=66.85.158.91, TLS, session=<i4M/KYhH/9hOH5Fb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.1.117.220
country_id: 6252001
description:
Jan  4 09:44:11 host2 sshd[2779994]: Disconnected from invalid user clock 198.1.117.220 port 56178 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.1.117.220
country_id: 6252001
description:
Jan  4 09:49:26 host2 sshd[2785722]: Disconnected from invalid user claude 198.1.117.220 port 43834 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Jan  4 09:49:57 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<G/UvQYhH9IgFhH+s>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.191.239.155
country_id: 6252001
description:
Jan  4 09:49:04 host2 sshd[2785395]: Disconnected from invalid user paulo 172.191.239.155 port 46982 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.98.176.164
country_id: 1643084
description:
Jan  4 09:49:19 host2 sshd[2785605]: Disconnected from invalid user max 103.98.176.164 port 50646 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.213.170
country_id: 1819730
description:
Jan  4 09:50:40 host2 sshd[2787024]: Disconnected from invalid user user1 152.32.213.170 port 32792 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.98.176.164
country_id: 1643084
description:
Jan  4 09:49:59 host2 sshd[2786185]: Disconnected from invalid user paulo 103.98.176.164 port 50032 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.1.117.220
country_id: 6252001
description:
Jan  4 09:51:12 host2 sshd[2787641]: Disconnected from invalid user claude 198.1.117.220 port 50828 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.191.239.155
country_id: 6252001
description:
Jan  4 09:52:26 host2 sshd[2788825]: Disconnected from invalid user claude 172.191.239.155 port 49550 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.213.170
country_id: 1819730
description:
Jan  4 09:52:29 host2 sshd[2788862]: Disconnected from invalid user hans 152.32.213.170 port 54402 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.191.239.155
country_id: 6252001
description:
Jan  4 09:54:52 host2 sshd[2791880]: Disconnected from invalid user administrator 172.191.239.155 port 36598 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.191.239.155
country_id: 6252001
description:
Jan  4 09:56:08 host2 sshd[2793399]: Disconnected from invalid user eric 172.191.239.155 port 55796 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.221.101.27
country_id: 3469034
description:
Jan  4 09:56:38 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=177.221.101.27, lip=66.85.158.91, TLS, session=<arILWIhH25qx3WUb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.149
country_id: 3175395
description:
Jan  4 09:56:56 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=217.26.179.149, lip=66.85.158.91, TLS, session=<hfpUWYhHL+nZGrOV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-04 10:01:26 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (orgalis) [87.103.126.54]:32072: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.105.224.72
country_id: 1861060
description:
Jan  4 10:03:56 host2 pure-ftpd[2800751]: (?@172.105.224.72) [INFO] New connection from 172.105.224.72


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 10:12:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<0kahkohHZohA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 10:13:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<pRftlYhHpoQjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 10:14:08 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<vZKxl4hH8I+Oq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 10:15:57 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<pNgtnohHor9nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 10:22:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<9/UNt4hHaG+uijvy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.43.123
country_id: 6252001
description:
2026-01-04 10:23:09 dovecot_plain authenticator failed for H=c-71-229-43-123.hsd1.ga.comcast.net (handism) [71.229.43.123]:34208: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.230.86.50
country_id: 6252001
description:
2026-01-04 10:24:11 dovecot_plain authenticator failed for H=c-73-230-86-50.hsd1.pa.comcast.net (cleadyine) [73.230.86.50]:54106: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.80.35.45
country_id: 192950
description:
Jan  4 10:26:37 host2 sshd[2823306]: Disconnected from invalid user sajjad 41.80.35.45 port 54402 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.80.35.45
country_id: 192950
description:
Jan  4 10:27:16 host2 sshd[2823856]: Disconnected from invalid user claude 41.80.35.45 port 34344 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.20.32.220
country_id: 1643084
description:
Jan  4 10:27:31 host2 sshd[2824076]: Disconnected from invalid user webmin 157.20.32.220 port 39154 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.167.105
country_id: 2635167
description:
Jan  4 10:27:53 host2 sshd[2824434]: Disconnected from invalid user ubuntu 178.128.167.105 port 46402 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 109.206.241.199
country_id: 453733
description:
Jan  4 10:28:04 host2 sshd[2824649]: Disconnected from invalid user claude 109.206.241.199 port 38502 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.80.35.45
country_id: 192950
description:
Jan  4 10:28:32 host2 sshd[2825169]: Disconnected from invalid user admins 41.80.35.45 port 39208 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.20.32.220
country_id: 1643084
description:
Jan  4 10:28:11 host2 sshd[2824793]: Disconnected from invalid user claude 157.20.32.220 port 49664 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.80.35.45
country_id: 192950
description:
Jan  4 10:29:10 host2 sshd[2825914]: Disconnected from invalid user mama 41.80.35.45 port 57548 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.206.241.199
country_id: 453733
description:
Jan  4 10:29:13 host2 sshd[2825990]: Disconnected from invalid user claude 109.206.241.199 port 46196 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 157.20.32.220
country_id: 1643084
description:
Jan  4 10:29:40 host2 sshd[2826364]: Disconnected from invalid user bitrix 157.20.32.220 port 56578 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.167.105
country_id: 2635167
description:
Jan  4 10:29:52 host2 sshd[2826669]: Disconnected from invalid user mailuser 178.128.167.105 port 37604 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  4 10:30:35 host2 pure-ftpd[2827623]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.94.106.254
country_id: 6252001
description:
Jan  4 10:30:41 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.94.106.254, lip=66.85.158.91, session=<0f0C04hHbqlCXmr+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.188.252.208
country_id: 6252001
description:
2026-01-04 10:33:02 dovecot_plain authenticator failed for H=c-73-188-252-208.hsd1.pa.comcast.net (ingalaus) [73.188.252.208]:58998: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 100.37.16.11
country_id: 6252001
description:
2026-01-04 10:33:27 dovecot_login authenticator failed for H=pool-100-37-16-11.nycmny.fios.verizon.net [100.37.16.11]:56193: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.84
country_id: 1210997
description:
2026-01-04 10:33:55 dovecot_login authenticator failed for H=([103.115.252.60]) [103.115.252.84]:45743: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 178.128.167.105
country_id: 2635167
description:
Jan  4 10:34:27 host2 sshd[2831551]: Disconnected from invalid user azureuser 178.128.167.105 port 43132 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.44.174.254
country_id: 357994
description:
2026-01-04 10:34:34 dovecot_plain authenticator failed for H=(cocal) [102.44.174.254]:49854: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.138.230
country_id: 1835841
description:
Jan  4 10:36:06 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=152.32.138.230, lip=66.85.158.92, session=<Sl5n5ohHMqiYIIrm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.138.230
country_id: 1835841
description:
Jan  4 10:36:26 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=152.32.138.230, lip=66.85.158.92, session=<682P54hHVuiYIIrm>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.202.118.38
country_id: 6252001
description:
Jan  4 10:37:19 host2 pure-ftpd[2834788]: (?@172.202.118.38) [INFO] New connection from 172.202.118.38


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 47.245.117.221
country_id: 1880251
description:
Jan  4 10:38:04 host2 pure-ftpd[2835553]: (?@47.245.117.221) [INFO] New connection from 47.245.117.221


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.62
country_id: 2635167
description:
Jan  4 10:40:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 45 secs): user=<>, rip=35.203.210.62, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<IR8k9ohHrM8jy9I+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.138.230
country_id: 1835841
description:
Jan  4 10:41:08 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=152.32.138.230, lip=66.85.158.91, session=<YEFi+IhHco+YIIrm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 10:41:41 host2 sshd[2839860]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.138.230
country_id: 1835841
description:
Jan  4 10:41:26 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 18 secs): user=<>, rip=152.32.138.230, lip=66.85.158.91, session=<Nh97+YhHeI+YIIrm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.62
country_id: 2635167
description:
Jan  4 10:41:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=35.203.210.62, lip=66.85.158.92, TLS: read(size=429) failed: Connection reset by peer, session=<hjHT+IhHTuwjy9I+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.68
country_id: 6252001
description:
Jan  4 10:44:26 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=216.218.206.68, lip=66.85.158.91, session=<Tj8wBIlHQjLY2s5E>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.134.120
country_id: 1269750
description:
2026-01-04 10:45:41 dovecot_login authenticator failed for H=(abts-mum-static-120.134.179.122.airtelbroadband.in) [122.179.134.120]:56356: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.62
country_id: 2635167
description:
Jan  4 10:46:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.62, lip=66.85.158.92, TLS, session=<4El+ColHRPIjy9I+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.183
country_id: 3144096
description:
2026-01-04 10:48:53 dovecot_login authenticator failed for H=(cm-84.213.189.183.get.no) [84.213.189.183]:60348: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.64.86
country_id: 1269750
description:
2026-01-04 10:49:32 dovecot_login authenticator failed for H=(nsg-corporate-80.50.185.122.airtel.in) [122.186.64.86]:51816: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.222.81.115
country_id: 6252001
description:
Jan  4 10:49:38 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=44.222.81.115, lip=66.85.158.92, TLS, session=<s0/AFolHktYs3lFz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 10:50:08 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<3cFtGIlHCteOq2dI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.45
country_id: 6252001
description:
Jan  4 10:51:03 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.45, lip=66.85.158.91, TLS, session=<j2vaG4lHbO+TuYQt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 10:51:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<3gUQHYlHNmUjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 10:51:39 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<ZuLXHYlHgrxA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 10:55:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<MSuwK4lHvJBnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2026-01-04 10:57:50 dovecot_plain authenticator failed for H=(afess) [75.97.190.237]:50707: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 10:58:04 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<mpPQNIlHVsOuijvy>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 11:01:16 host2 sshd[2862278]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.41
country_id: 2750405
description:
2026-01-04 11:02:58 dovecot_login authenticator failed for H=(Copy-of-VM-2022) [45.94.31.41]:15943: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.37.253.93
country_id: 6252001
description:
2026-01-04 11:05:24 dovecot_plain authenticator failed for H=([169.254.167.31]) [193.37.253.93]:60614: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 193.37.253.93
country_id: 6252001
description:
Jan  4 11:05:50 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=193.37.253.93, lip=66.85.158.91, TLS handshaking: Connection closed, session=<47C3UIlH/V3BJf1d>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.219
country_id: 6252001
description:
Jan  4 11:15:59 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.219, lip=66.85.158.92, TLS, session=<mCoIdYlH5PbN0h/b>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.217
country_id: 6252001
description:
Jan  4 11:19:44 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.217, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ipRxgolHlsnG6xjZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 11:20:17 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<UDE5hIlHDJ+Oq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 11:23:36 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<JRkbkIlHeNUjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 11:24:35 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<a6ygk4lHlLBA46ZK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.210.157.101
country_id: 1819730
description:
Jan  4 11:24:37 host2 sshd[2888230]: Disconnected from invalid user sunil 8.210.157.101 port 34028 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.101
country_id: 1819730
description:
Jan  4 11:25:34 host2 sshd[2889436]: Disconnected from invalid user botuser 154.83.15.101 port 52978 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.59.80.142
country_id: 3017382
description:
Jan  4 11:25:41 host2 sshd[2889513]: Disconnected from invalid user claude 146.59.80.142 port 49582 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 95.182.118.136
country_id: 1512440
description:
Jan  4 11:26:21 host2 sshd[2890133]: Disconnected from invalid user icinga 95.182.118.136 port 33670 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.59.95.254
country_id: 1522867
description:
Jan  4 11:27:23 host2 sshd[2891097]: Disconnected from invalid user eric 146.59.95.254 port 54290 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.182.118.136
country_id: 1512440
description:
Jan  4 11:27:31 host2 sshd[2891222]: Disconnected from invalid user rodrigo 95.182.118.136 port 57696 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.83.15.101
country_id: 1819730
description:
Jan  4 11:28:43 host2 sshd[2892869]: Disconnected from invalid user dashboard 154.83.15.101 port 41926 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 11:28:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<n56NoYlHRKCuijvy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.135.111.5
country_id: 298795
description:
Jan  4 11:28:34 host2 sshd[2892701]: Disconnected from invalid user lucas 78.135.111.5 port 46472 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.88
country_id: 1819730
description:
Jan  4 11:28:40 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=45.142.154.88, lip=66.85.158.91, session=<txlYoolHrkYtjppY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 11:29:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shop@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=</ypWpIlHcqpnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.101
country_id: 1819730
description:
Jan  4 11:29:23 host2 sshd[2893660]: Disconnected from invalid user claude 154.83.15.101 port 53814 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.190.168
country_id: 1819730
description:
Jan  4 11:29:44 host2 sshd[2894022]: Disconnected from invalid user postgres 152.32.190.168 port 40218 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.72.147.99
country_id: 1880251
description:
Jan  4 11:30:19 host2 sshd[2894908]: Disconnected from invalid user sagar 103.72.147.99 port 52050 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.59.80.142
country_id: 3017382
description:
Jan  4 11:30:56 host2 sshd[2895472]: Disconnected from invalid user claude 146.59.80.142 port 42158 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.59.95.254
country_id: 1522867
description:
Jan  4 11:31:34 host2 sshd[2896111]: Disconnected from invalid user marvin 146.59.95.254 port 59564 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.72.147.99
country_id: 1880251
description:
Jan  4 11:31:44 host2 sshd[2896247]: Disconnected from invalid user deploy 103.72.147.99 port 40386 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  4 11:31:13 host2 pure-ftpd[2895802]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.74.211.27
country_id: 6252001
description:
2026-01-04 11:32:38 dovecot_plain authenticator failed for H=c-75-74-211-27.hsd1.fl.comcast.net (unglerize) [75.74.211.27]:37970: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.59.95.254
country_id: 1522867
description:
Jan  4 11:32:42 host2 sshd[2897292]: Disconnected from invalid user claude 146.59.95.254 port 36744 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.190.168
country_id: 1819730
description:
Jan  4 11:32:09 host2 sshd[2896717]: Disconnected from invalid user frank 152.32.190.168 port 39240 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.135.111.5
country_id: 298795
description:
Jan  4 11:32:12 host2 sshd[2896817]: Disconnected from invalid user mine 78.135.111.5 port 38240 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.59.80.142
country_id: 3017382
description:
Jan  4 11:32:14 host2 sshd[2896854]: Disconnected from invalid user mauro 146.59.80.142 port 34840 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.190.168
country_id: 1819730
description:
Jan  4 11:33:34 host2 sshd[2898355]: Disconnected from invalid user mumbleserver 152.32.190.168 port 53480 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.203.184
country_id: 2542007
description:
2026-01-04 11:33:23 dovecot_login authenticator failed for H=([105.73.203.184]) [105.73.203.184]:46585: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.238.191.229
country_id: 6252001
description:
Jan  4 11:37:20 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.238.191.229, lip=66.85.158.91, session=<wvVcwYlH8KcD7r/l>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.140.19.22
country_id: 1269750
description:
Jan  4 11:37:57 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@euroentertainmentlk.com>, method=PLAIN, rip=103.140.19.22, lip=66.85.158.91, session=<LyVvw4lHmINnjBMW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.156
country_id: 3469034
description:
Jan  4 11:41:12 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@jrdc.lk>, method=PLAIN, rip=177.44.71.156, lip=66.85.158.91, TLS, session=<JW0hzolHIp6xLEec>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.134.100
country_id: 690791
description:
Jan  4 11:41:28 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=37.221.134.100, lip=66.85.158.91, TLS, session=<eOkpz4lHfsol3YZk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.17.125.44
country_id: 690791
description:
Jan  4 11:41:29 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.17.125.44, lip=66.85.158.91, TLS, session=<G8c2z4lHmwy5EX0s>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.12.14
country_id: 226074
description:
Jan  4 11:41:34 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=196.0.12.14, lip=66.85.158.91, TLS, session=<e+VVz4lHGd3EAAwO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.184.82.42
country_id: 798544
description:
Jan  4 11:41:10 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@jrdc.lk>, method=PLAIN, rip=195.184.82.42, lip=66.85.158.91, TLS, session=<5LIZzolHnYvDuFIq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.16.61.60
country_id: 2215636
description:
Jan  4 11:41:09 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@jrdc.lk>, method=PLAIN, rip=165.16.61.60, lip=66.85.158.91, TLS, session=<KzwLzolHOeylED08>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.4.78
country_id: 690791
description:
Jan  4 11:41:27 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=176.103.4.78, lip=66.85.158.91, TLS, session=<gBMcz4lHgI2wZwRO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.206.103.90
country_id: 6290252
description:
Jan  4 11:41:29 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=109.206.103.90, lip=66.85.158.91, TLS, session=<iYBCz4lHscZtzmda>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.128.123
country_id: 3469034
description:
Jan  4 11:41:12 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@jrdc.lk>, method=PLAIN, rip=191.53.128.123, lip=66.85.158.91, TLS, session=<8ecXzolHJ4C/NYB7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.11.119
country_id: 2300660
description:
Jan  4 11:41:11 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@jrdc.lk>, method=PLAIN, rip=41.139.11.119, lip=66.85.158.91, TLS, session=<KFIazolH470piwt3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.118.34.227
country_id: 1269750
description:
Jan  4 11:42:31 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=45.118.34.227, lip=66.85.158.91, TLS, session=<t+7T0olHWN8tdiLj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.190.22.247
country_id: 2750405
description:
Jan  4 11:42:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=146.190.22.247, lip=66.85.158.91, session=<dzmd1IlHBJmSvhb3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.142.125
country_id: 99237
description:
Jan  4 11:42:52 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw>, method=PLAIN, rip=65.20.142.125, lip=66.85.158.91, TLS, session=<OcQO1IlHeOFBFI59>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 11:49:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<qZ6o7YlHqOKOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 11:54:59 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<QqViAIpH5FojupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.166.38
country_id: 2186224
description:
2026-01-04 11:56:10 dovecot_login authenticator failed for H=([121.73.166.38]) [121.73.166.38]:60874: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.251
country_id: 3469034
description:
Jan  4 11:56:10 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=190.89.136.251, lip=66.85.158.91, TLS, session=<n1eLA4pHZ6a+WYj7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.80.26.252
country_id: 3865483
description:
Jan  4 11:55:48 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=181.80.26.252, lip=66.85.158.91, TLS, session=<smA6AopHir21UBr8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.14.56.116
country_id: 3017382
description:
2026-01-04 11:56:30 dovecot_login authenticator failed for H=laubervilliers-657-1-120-116.w80-14.abo.wanadoo.fr [80.14.56.116]:48852: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 11:56:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<ZqBDB4pHxNBA46ZK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  4 11:57:48 host2 sshd[2925527]: Disconnected from invalid user user 2.57.121.25 port 22467 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 11:59:34 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<Q8O+EIpH1EOuijvy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-04 12:01:26 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (blembrand) [87.103.126.54]:50618: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.123.134.194
country_id: 6252001
description:
Jan  4 12:02:39 host2 sshd[2931165]: Disconnected from invalid user administrador 34.123.134.194 port 49716 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 12:02:47 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<yGBFHIpHOo5nmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-04 12:03:47 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:55952: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.94.106.254
country_id: 6252001
description:
Jan  4 12:03:29 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.94.106.254, lip=66.85.158.91, session=<XPDiHopHVspCXmr+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.123.134.194
country_id: 6252001
description:
Jan  4 12:06:11 host2 sshd[2935337]: Disconnected from invalid user odoo 34.123.134.194 port 47182 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.67
country_id: 99237
description:
2026-01-04 12:09:22 dovecot_plain authenticator failed for H=(majoidae) [65.20.129.67]:48975: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.248.111.238
country_id: 6252001
description:
2026-01-04 12:12:14 dovecot_plain authenticator failed for H=(banth) [38.248.111.238]:33936: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Jan  4 12:16:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<YIJoTIpHMoIFhH+s>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.222.81.115
country_id: 6252001
description:
Jan  4 12:16:17 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=44.222.81.115, lip=66.85.158.91, session=<wk+uTIpHqKos3lFz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  4 12:19:08 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<8JzbVopHgNgDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 12:19:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<c61yV4pH3LOOq2dI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  4 12:20:21 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<u9g1W4pHbsIDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  4 12:21:30 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<TFhRX4pHjJMDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  4 12:22:41 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<iiSIY4pHspgDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  4 12:23:28 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<7MpZZopHANQDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.140.19.22
country_id: 1269750
description:
Jan  4 12:24:08 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=103.140.19.22, lip=66.85.158.91, session=<uUmYaIpHNs1njBMW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  4 12:24:40 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<WNuqaopHNpIDhBfJ>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  4 12:25:55 host2 dovecot[1170291]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<jfQWb4pH7IIDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.154.217.188
country_id: 690791
description:
2026-01-04 12:25:57 dovecot_login authenticator failed for H=ip-d9bc.d-net.kiev.ua [94.154.217.188]:53078: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.6.101.246
country_id: 2510769
description:
2026-01-04 12:26:10 dovecot_login authenticator failed for H=246.red-88-6-101.staticip.rima-tde.net [88.6.101.246]:46466: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 12:26:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<u+ixcIpHYpUjupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  4 12:26:36 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<e6aRcYpHvrgDhBfJ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 12:27:34 host2 sshd[2958331]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  4 12:27:15 host2 dovecot[1170291]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<Kw/ec4pHyrkDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  4 12:27:49 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<sQXjdYpHhNYDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.255
country_id: 6252001
description:
Jan  4 12:28:02 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.255, lip=66.85.158.91, TLS, session=<qVa1dopHkv7G6xj/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  4 12:29:04 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<Eg1feopHwLADhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 12:29:41 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<ZY56fIpH4MdA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 12:30:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<MXnqfopHOrWuijvy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 12:31:27 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<hhTHgopHkEWvnZ1q>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  4 12:31:45 host2 sshd[2962360]: Disconnected from invalid user admin 2.57.121.112 port 18012 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.157.219.158
country_id: 6252001
description:
2026-01-04 12:35:30 dovecot_plain authenticator failed for H=c-76-157-219-158.hsd1.il.comcast.net (basta) [76.157.219.158]:55816: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  4 12:36:02 host2 pure-ftpd[2966692]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 12:36:56 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<oQxjlopHIptnmud6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 12:37:22 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<2xL4l4pH2HmvnZ1q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 12:38:39 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<u5yInIpHkkWvnZ1q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 12:40:40 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<hi61o4pH2XmvnZ1q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.94.106.254
country_id: 6252001
description:
Jan  4 12:44:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.94.106.254, lip=66.85.158.91, session=<qL/BsYpHCJ1CXmr+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.65.154.146
country_id: 6252001
description:
Jan  4 12:44:59 host2 pure-ftpd[2978054]: (?@20.65.154.146) [INFO] New connection from 20.65.154.146


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 12:45:14 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<qrsMtIpHlEWvnZ1q>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 12:47:10 host2 sshd[2979977]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 12:46:48 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<LKmuuYpHlUWvnZ1q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 12:48:06 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<y7ZRvopH3XmvnZ1q>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 12:48:56 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<6TVKwYpHBsOOq2dI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 12:49:02 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<ztumwYpHlkWvnZ1q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.19.200
country_id: 6252001
description:
Jan  4 12:49:05 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=18.97.19.200, lip=66.85.158.92, session=<NezzwYpH+LwSYRPI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 12:50:03 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<W25HxYpHmEWvnZ1q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 12:51:09 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<oWI+yYpHmUWvnZ1q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 12:51:58 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<ul8pzIpH4HmvnZ1q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.5.33
country_id: 6252001
description:
Jan  4 12:54:40 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=18.97.5.33, lip=66.85.158.92, TLS handshaking: Connection closed, session=<hMvp1YpH1uQSYQUh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 12:54:27 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<r5EM1YpH4XmvnZ1q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 12:55:32 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<UkHi2IpHnUWvnZ1q>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.247.137.15
country_id: 2635167
description:
Jan  4 12:56:25 host2 pure-ftpd[2991198]: (?@185.247.137.15) [INFO] New connection from 185.247.137.15


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 12:56:54 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<Pd7S3YpH5HmvnZ1q>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2026-01-04 12:57:20 dovecot_plain authenticator failed for H=(hearaton) [24.105.248.218]:40928: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 12:58:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<vWB54opHbGcjupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 12:58:01 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<CurG4YpHnkWvnZ1q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 12:58:54 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<BWeT5IpHn0WvnZ1q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 12:59:49 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<vOY26IpH53mvnZ1q>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.5
country_id: 2635167
description:
Jan  4 13:00:02 host2 dovecot[1170291]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.5, lip=66.85.158.92, TLS, session=<e3gf6YpH1Za594kF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 13:01:05 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<pgnF7IpHoUWvnZ1q>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.11.17.169
country_id: 3175395
description:
2026-01-04 13:01:46 dovecot_plain authenticator failed for H=host-188-11-17-169.business.telecomitalia.it (saivess) [188.11.17.169]:54476: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 13:01:58 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<uMjo74pHznyuijvy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2026-01-04 13:02:05 dovecot_plain authenticator failed for H=c-73-13-220-220.hsd1.de.comcast.net (disiestip) [73.13.220.220]:55152: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 13:02:17 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<8kkI8YpHskevnZ1q>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 13:02:49 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<v5z38opHRpNA46ZK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 13:03:03 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<4o7J84pH6HmvnZ1q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 13:04:17 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<syvX94pHtEevnZ1q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 13:05:26 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<dWdO/IpHtUevnZ1q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 13:07:38 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<jaSEAItHtkevnZ1q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 13:09:30 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<VFd8CotH7nmvnZ1q>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 13:11:40 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<5RacEotHFKNnmud6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.201
country_id: 6252001
description:
Jan  4 13:11:58 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.201, lip=66.85.158.91, session=<TaXQE4tHUuCTuYTJ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.82.240.194
country_id: 1643084
description:
Jan  4 13:12:01 host2 sshd[3007503]: Disconnected from invalid user master 103.82.240.194 port 33216 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 13:12:39 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<DE4aFotHuUevnZ1q>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.152
country_id: 2635167
description:
Jan  4 13:14:13 host2 dovecot[1170291]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.152, lip=66.85.158.92, TLS, session=<cUTeG4tHm+dX7LCY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 13:15:11 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<HecrH4tHAnyvnZ1q>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.135.112.8
country_id: 6252001
description:
Jan  4 13:15:00 host2 pure-ftpd[3010301]: (?@103.135.112.8) [INFO] New connection from 103.135.112.8


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  4 13:15:42 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@anandaobauae.org>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<Q08NIYtHTskFhXlo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.253.25
country_id: 1819730
description:
Jan  4 13:17:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 9 secs): user=<>, rip=152.32.253.25, lip=66.85.158.92, session=<V081JotHqimYIP0Z>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.30.115.187
country_id: 3686110
description:
Jan  4 13:17:22 host2 sshd[3012906]: Disconnected from invalid user admin 186.30.115.187 port 40652 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 13:18:03 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<Pt5vKYtHvkevnZ1q>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.30.115.187
country_id: 3686110
description:
Jan  4 13:18:47 host2 sshd[3014092]: Disconnected from invalid user rahul 186.30.115.187 port 39760 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 13:19:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<9h54LYtH6p2Oq2dI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 13:19:24 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<0lpDLotHBHyvnZ1q>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.30.115.187
country_id: 3686110
description:
Jan  4 13:19:26 host2 sshd[3014793]: Disconnected from invalid user claude 186.30.115.187 port 53426 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  4 13:20:48 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<0jJfM4tHlLUDhpQ7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.235.179
country_id: 6252001
description:
Jan  4 13:21:57 host2 sshd[3017712]: Disconnected from invalid user dmdba 165.154.235.179 port 37674 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 13:22:08 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<UiQROItHv0evnZ1q>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.235.179
country_id: 6252001
description:
Jan  4 13:22:26 host2 sshd[3018157]: Disconnected from invalid user testuser 165.154.235.179 port 50112 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  4 13:23:26 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<HXPRPItHJNUDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 13:23:41 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<uQfrPItHCXyvnZ1q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  4 13:25:04 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<YIqmQotHjuUDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.221.99
country_id: 1227603
description:
Jan  4 13:24:32 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.221.99, lip=66.85.158.91, TLS, session=<rxI/QItHJzuvnd1j>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 13:25:48 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<J07KRItHC3yvnZ1q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  4 13:26:27 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<8DaYR4tHpKMDhpQ7>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  4 13:26:44 host2 dovecot[1170291]: imap-login: Disconnected: Input buffer full (no auth attempts in 1 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<MSCVSItHsqADhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 13:26:56 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=</hveSItHwEevnZ1q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  4 13:28:26 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<cy2xTotHrNUDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 13:29:39 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<1X/ZUotHD3yvnZ1q>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 13:30:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<rAgfVotH2r8jupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 13:32:21 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<78CQXItHxUevnZ1q>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  4 13:31:52 host2 sshd[3027288]: Disconnected from invalid user user 2.57.121.25 port 18083 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.53.199.160
country_id: 6252001
description:
2026-01-04 13:32:35 dovecot_login authenticator failed for H=(136-53-199-160.googlefiber.net) [136.53.199.160]:48893: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.83.145.39
country_id: 6252001
description:
Jan  4 13:32:40 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.83.145.39, lip=66.85.158.91, TLS, session=<oETUXYtH8qgDU5En>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.206
country_id: 1269750
description:
2026-01-04 13:32:58 dovecot_login authenticator failed for H=([27.123.105.41]) [182.95.52.206]:45834: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.218.247.234
country_id: 1522867
description:
2026-01-04 13:33:30 dovecot_login authenticator failed for H=([89.218.247.234]) [89.218.247.234]:54676: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 13:33:51 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<NVuyYItHxkevnZ1q>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 13:34:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<NcYeZItHSpGuijvy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 13:35:32 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<VdahZ4tHFHyvnZ1q>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 13:36:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<wDMGaotHlslA46ZK>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.46.210.158
country_id: 3175395
description:
Jan  4 13:37:28 host2 sshd[3033720]: Disconnected from invalid user deployer 151.46.210.158 port 61160 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 13:38:26 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<Og9FcotHykevnZ1q>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.46.210.158
country_id: 3175395
description:
Jan  4 13:40:27 host2 sshd[3036819]: Disconnected from invalid user claude 151.46.210.158 port 61358 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  4 13:40:34 host2 pure-ftpd[3036996]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  4 13:41:46 host2 sshd[3038010]: Disconnected from invalid user admin 2.57.121.112 port 48091 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 86.54.31.40
country_id: 2750405
description:
Jan  4 13:46:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=86.54.31.40, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<8qPtjYtH2sJWNh8o>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 13:45:57 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<7vk9jYtHpupnmud6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 13:46:36 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<QdxPjotHGnyvnZ1q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 13:48:31 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<FNxglotH40mvnZ1q>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 13:49:40 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<O7mAmotHMpiOq2dI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-04 13:50:11 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:16373: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.175.75
country_id: 99237
description:
2026-01-04 13:50:37 dovecot_login authenticator failed for H=([65.20.175.75]) [65.20.175.75]:38120: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.36.204
country_id: 3144096
description:
2026-01-04 13:51:01 dovecot_login authenticator failed for H=(cm-178.232.36.204.get.no) [178.232.36.204]:52150: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 179.40.31.154
country_id: 3865483
description:
Jan  4 13:51:45 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=179.40.31.154, lip=66.85.158.91, session=<oAo3oYtH3JyzKB+a>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.153.3.94
country_id: 3175395
description:
Jan  4 13:52:10 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@visionsolutionshospital.com>, method=LOGIN, rip=185.153.3.94, lip=66.85.158.91, session=<Mk3ooYtHDKW5mQNe>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.157.106
country_id: 1227603
description:
Jan  4 13:52:11 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<orders@myproteinbox.lk>, method=PLAIN, rip=175.157.157.106, lip=66.85.158.91, TLS, session=<+gdto4tH5kmvnZ1q>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.115.237.19
country_id: 3923057
description:
2026-01-04 13:52:19 dovecot_login authenticator failed for H=([181.115.237.19]) [181.115.237.19]:51165: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2026-01-04 13:53:19 dovecot_plain authenticator failed for H=(subfor) [24.104.225.201]:38965: 535 Incorrect authentication data (set_id=sales@ksoft.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 14.102.101.248
country_id: 1269750
description:
Jan  4 13:52:33 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=14.102.101.248, lip=66.85.158.91, session=<04B1o4tHqY8OZmX4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.54.99.236
country_id: 294640
description:
2026-01-04 13:52:36 dovecot_login authenticator failed for H=(2-54-99-236.orange.net.il) [2.54.99.236]:55149: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 178.239.35.203
country_id: 3175395
description:
Jan  4 13:52:54 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=178.239.35.203, lip=66.85.158.91, session=<u+4DpYtH2Jqy7yPL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.118
country_id: 1269750
description:
2026-01-04 13:53:17 dovecot_login authenticator failed for H=([152.52.234.180]) [182.95.177.118]:53984: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 152.32.146.202
country_id: 1861060
description:
Jan  4 13:53:53 host2 pure-ftpd[3050450]: (?@152.32.146.202) [INFO] New connection from 152.32.146.202


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.178
country_id: 1269750
description:
2026-01-04 13:53:53 dovecot_login authenticator failed for H=([152.52.246.178]) [152.52.246.178]:41342: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2026-01-04 13:54:32 dovecot_plain authenticator failed for H=(jacheal) [192.34.128.202]:58836: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 152.32.146.202
country_id: 1861060
description:
Jan  4 13:55:51 host2 pure-ftpd[3053544]: (?@152.32.146.202) [INFO] New connection from 152.32.146.202


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.241.132.152
country_id: 1269750
description:
2026-01-04 14:01:06 dovecot_login authenticator failed for H=(static.ill.117.248.107.130.bsnl.co.in) [43.241.132.152]:54176: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.155
country_id: 2186224
description:
2026-01-04 14:02:00 dovecot_login authenticator failed for H=([121.73.168.155]) [121.73.168.155]:37034: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 14:03:17 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<l0E5y4tHTIIjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 14:06:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<A7DS1YtHYnKuijvy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.190.155.43
country_id: 6252001
description:
2026-01-04 14:06:35 dovecot_plain authenticator failed for H=(sporke) [76.190.155.43]:45889: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 14:07:56 host2 sshd[3082330]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 14:09:49 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<J2aW4otH0LRA46ZK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2026-01-04 14:10:41 dovecot_plain authenticator failed for H=(bleting) [12.150.243.22]:52571: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.180.88.176
country_id: 6252001
description:
Jan  4 14:11:19 host2 sshd[3086239]: Disconnected from invalid user claude 107.180.88.176 port 48226 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 14:13:30 host2 sshd[3088520]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.5.0.120
country_id: 1643084
description:
Jan  4 14:15:03 host2 sshd[3089982]: Disconnected from invalid user ubuntu 69.5.0.120 port 44496 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.180.88.176
country_id: 6252001
description:
Jan  4 14:14:40 host2 sshd[3089598]: Disconnected from invalid user suporte 107.180.88.176 port 44784 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.166.245.172
country_id: 6252001
description:
Jan  4 14:15:41 host2 sshd[3090639]: Disconnected from invalid user qwe 43.166.245.172 port 27904 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.180.88.176
country_id: 6252001
description:
Jan  4 14:15:50 host2 sshd[3090768]: Disconnected from invalid user claude 107.180.88.176 port 41044 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.99.14
country_id: 290557
description:
2026-01-04 14:16:53 dovecot_plain authenticator failed for H=(acops) [5.32.99.14]:49807: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2026-01-04 14:16:55 dovecot_plain authenticator failed for H=(renct) [80.227.102.242]:58792: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.153.249.99
country_id: 3895114
description:
Jan  4 14:17:39 host2 sshd[3092346]: Disconnected from invalid user claude 190.153.249.99 port 57347 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.166.245.172
country_id: 6252001
description:
Jan  4 14:17:51 host2 sshd[3092517]: Disconnected from invalid user tt 43.166.245.172 port 22528 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 14:20:06 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<zRRWB4xH4ImOq2dI>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.129.236
country_id: 1819730
description:
Jan  4 14:19:24 host2 sshd[3094436]: Disconnected from invalid user test 152.32.129.236 port 51002 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 14:20:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<fZb9CYxHcMZnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.5.0.120
country_id: 1643084
description:
Jan  4 14:20:55 host2 sshd[3096052]: Disconnected from invalid user kt 69.5.0.120 port 55960 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.153.249.99
country_id: 3895114
description:
Jan  4 14:20:57 host2 sshd[3096125]: Disconnected from invalid user minecraft 190.153.249.99 port 57697 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.211.56.214
country_id: 2750405
description:
Jan  4 14:22:12 host2 sshd[3097398]: Disconnected from invalid user hb 172.211.56.214 port 45734 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.211.56.214
country_id: 2750405
description:
Jan  4 14:23:11 host2 sshd[3098299]: Disconnected from invalid user claude 172.211.56.214 port 34646 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.5.0.120
country_id: 1643084
description:
Jan  4 14:24:21 host2 sshd[3099574]: Disconnected from invalid user zhangwei 69.5.0.120 port 40216 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 14:33:11 host2 sshd[3109281]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 14:36:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<3rjAQIxHam4jupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 14:39:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<WXlzS4xH9juuijvy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.178.115.16
country_id: 6252001
description:
Jan  4 14:40:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.178.115.16, lip=66.85.158.92, session=<g1OJT4xHosSssnMQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 14:43:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<UArRW4xHuudA46ZK>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  4 14:45:22 host2 pure-ftpd[3123114]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 14:50:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<pT33dIxHkrSOq2dI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  4 14:51:25 host2 sshd[3128836]: Disconnected from invalid user admin 2.57.121.112 port 29732 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 14:56:37 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<SEj2iYxHDN9nmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.112.56.47
country_id: 798544
description:
Jan  4 14:57:34 host2 sshd[3135414]: Disconnected from invalid user cgpexpert 134.112.56.47 port 58814 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.176.115.34
country_id: 1269750
description:
Jan  4 14:59:00 host2 sshd[3136639]: Disconnected from invalid user claude 122.176.115.34 port 33672 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.176.115.34
country_id: 1269750
description:
Jan  4 14:59:51 host2 sshd[3137483]: Disconnected from invalid user dreambox 122.176.115.34 port 47428 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.106.89
country_id: 6252001
description:
Jan  4 15:00:20 host2 sshd[3138192]: Disconnected from invalid user ubuntu 164.92.106.89 port 45854 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.176.115.34
country_id: 1269750
description:
Jan  4 15:00:41 host2 sshd[3138537]: Disconnected from invalid user mantis 122.176.115.34 port 32952 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.106.89
country_id: 6252001
description:
Jan  4 15:01:33 host2 sshd[3139406]: Disconnected from invalid user steam 164.92.106.89 port 49890 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 164.92.106.89
country_id: 6252001
description:
Jan  4 15:02:08 host2 sshd[3139897]: Disconnected from invalid user claude 164.92.106.89 port 42744 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.92.134.8
country_id: 3469034
description:
Jan  4 15:03:20 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=177.92.134.8, lip=66.85.158.91, TLS, session=<Sbn+oIxHVryxXIYI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.112.56.47
country_id: 798544
description:
Jan  4 15:02:38 host2 sshd[3140298]: Disconnected from invalid user claude 134.112.56.47 port 54738 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.106.89
country_id: 6252001
description:
Jan  4 15:02:44 host2 sshd[3140372]: Disconnected from invalid user gino 164.92.106.89 port 55142 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 84.20.67.98
country_id: 783754
description:
Jan  4 15:03:38 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<charanaw>, method=PLAIN, rip=84.20.67.98, lip=66.85.158.91, TLS, session=<iIsmooxHBKlUFENi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-04 15:03:46 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (parchic) [87.103.126.54]:25381: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.106.89
country_id: 6252001
description:
Jan  4 15:03:48 host2 sshd[3141577]: Disconnected from invalid user ben 164.92.106.89 port 42432 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.176.115.34
country_id: 1269750
description:
Jan  4 15:04:56 host2 sshd[3142947]: Disconnected from invalid user frank 122.176.115.34 port 45290 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 134.112.56.47
country_id: 798544
description:
Jan  4 15:07:04 host2 sshd[3145581]: Disconnected from invalid user murad 134.112.56.47 port 44182 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.112.56.47
country_id: 798544
description:
Jan  4 15:07:54 host2 sshd[3146217]: Disconnected from invalid user gino 134.112.56.47 port 37204 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 15:08:42 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<8mUgtYxH0mcjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 15:12:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<gXiPwYxHIHSuijvy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.10
country_id: 798549
description:
Jan  4 15:13:59 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=85.217.140.10, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<XWYvyIxHXs5V2YwK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 15:17:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<jbou1IxHBu5A46ZK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.236.66
country_id: 6252001
description:
2026-01-04 15:19:01 dovecot_plain authenticator failed for H=c-73-213-236-66.hsd1.va.comcast.net (cogably) [73.213.236.66]:59162: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-04 15:20:14 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:55501: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 15:21:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<Mffa44xHcLWOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 15:32:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shop@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<Ln81C41H3sZnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.180
country_id: 99237
description:
2026-01-04 15:34:54 dovecot_login authenticator failed for H=([65.20.250.180]) [65.20.250.180]:37142: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.153
country_id: 2186224
description:
2026-01-04 15:35:11 dovecot_login authenticator failed for H=([121.73.162.153]) [121.73.162.153]:38656: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 15:41:49 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<dJaPK41HGtojupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 15:45:32 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<azflOI1HBmKuijvy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.220.97.188
country_id: 6252001
description:
2026-01-04 15:50:42 dovecot_login authenticator failed for H=c-98-220-97-188.hsd1.il.comcast.net [98.220.97.188]:52080: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2026-01-04 15:50:54 dovecot_login authenticator failed for H=([38.226.118.9]) [38.226.118.0]:38232: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  4 15:50:17 host2 pure-ftpd[3191247]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.83.145.39
country_id: 6252001
description:
Jan  4 15:51:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.83.145.39, lip=66.85.158.92, TLS, session=<IOhYTY1HHsIDU5En>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 15:51:59 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<dqLvT41HSIFA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 15:53:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<L03CU41Hhq+Oq2dI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.221.60.108
country_id: 6252001
description:
Jan  4 15:55:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.221.60.108, lip=66.85.158.91, session=<ui2kXI1HoOIU3Txs>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 15:59:24 host2 sshd[3201663]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.170.231.167
country_id: 3469034
description:
Jan  4 16:04:40 host2 sshd[3209053]: Disconnected from invalid user claude 177.170.231.167 port 48286 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 14.97.117.34
country_id: 1269750
description:
Jan  4 16:04:42 host2 sshd[3209090]: Disconnected from invalid user abc 14.97.117.34 port 53493 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  4 16:05:53 host2 sshd[3210561]: Disconnected from invalid user admin 2.57.121.112 port 35780 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.170.231.167
country_id: 3469034
description:
Jan  4 16:06:10 host2 sshd[3210934]: Disconnected from invalid user abc 177.170.231.167 port 40482 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.37.11.87
country_id: 3469034
description:
Jan  4 16:08:07 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=191.37.11.87, lip=66.85.158.91, TLS, session=<vi6TiI1HLKm/JQtX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.90.12.192
country_id: 6252001
description:
Jan  4 16:08:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.90.12.192, lip=66.85.158.91, TLS, session=<LVbFiY1HUOQDWgzA>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 14.97.117.34
country_id: 1269750
description:
Jan  4 16:09:05 host2 sshd[3214218]: Disconnected from invalid user web 14.97.117.34 port 16457 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.207.35.155
country_id: 6290252
description:
Jan  4 16:08:25 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<charanaw>, method=PLAIN, rip=109.207.35.155, lip=66.85.158.91, TLS, session=<K5jYiY1H1IttzyOb>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.170.231.167
country_id: 3469034
description:
Jan  4 16:08:54 host2 sshd[3213961]: Disconnected from invalid user claude 177.170.231.167 port 60866 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.70
country_id: 1269750
description:
2026-01-04 16:09:20 dovecot_login authenticator failed for H=([182.66.214.70]) [182.66.214.70]:45232: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 16:09:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<2dl1j41HMIZnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.221.88
country_id: 1880251
description:
Jan  4 16:09:49 host2 sshd[3215000]: Disconnected from invalid user tester 45.78.221.88 port 52256 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.12
country_id: 798549
description:
Jan  4 16:09:42 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.140.12, lip=66.85.158.91, TLS: Connection closed, session=<PRJqj41H4tlV2YwM>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.170.231.167
country_id: 3469034
description:
Jan  4 16:09:33 host2 sshd[3214782]: Disconnected from invalid user user2 177.170.231.167 port 44786 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.186.104.101
country_id: 6252001
description:
2026-01-04 16:09:40 dovecot_login authenticator failed for H=wsip-184-186-104-101.lv.lv.cox.net [184.186.104.101]:59213: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.12
country_id: 798549
description:
Jan  4 16:10:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=85.217.140.12, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<x34dkY1HbK5V2YwM>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 14.97.117.34
country_id: 1269750
description:
Jan  4 16:10:20 host2 sshd[3215727]: Disconnected from invalid user claude 14.97.117.34 port 20589 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.221.88
country_id: 1880251
description:
Jan  4 16:11:05 host2 sshd[3216613]: Disconnected from invalid user readonly 45.78.221.88 port 53872 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.243.236.86
country_id: 290557
description:
Jan  4 16:11:19 host2 sshd[3216836]: Disconnected from invalid user claude 74.243.236.86 port 48004 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 74.243.236.86
country_id: 290557
description:
Jan  4 16:12:36 host2 sshd[3218302]: Disconnected from invalid user claude 74.243.236.86 port 44970 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.221.88
country_id: 1880251
description:
Jan  4 16:13:34 host2 sshd[3219335]: Disconnected from invalid user sshuser 45.78.221.88 port 42380 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.243.236.86
country_id: 290557
description:
Jan  4 16:13:53 host2 sshd[3219646]: Disconnected from invalid user claude 74.243.236.86 port 39004 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 16:15:08 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<nXzAoo1HgKYjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.140.19.22
country_id: 1269750
description:
Jan  4 16:16:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=103.140.19.22, lip=66.85.158.91, session=<2yO+po1HaqtnjBMW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.118
country_id: 6252001
description:
Jan  4 16:16:10 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.118, lip=66.85.158.92, TLS: Connection closed, session=<cteOpo1HwmxChJl2>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.231.109.115
country_id: 2661886
description:
Jan  4 16:17:31 host2 sshd[3223692]: error: maximum authentication attempts exceeded for invalid user admin from 85.231.109.115 port 60730 ssh2 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 85.231.109.115
country_id: 2661886
description:
Jan  4 16:17:34 host2 sshd[3223757]: Disconnecting invalid user admin 85.231.109.115 port 32926: Too many authentication failures [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 85.231.109.115
country_id: 2661886
description:
Jan  4 16:17:22 host2 sshd[3223525]: Disconnecting authenticating user root 85.231.109.115 port 58974: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 85.231.109.115
country_id: 2661886
description:
Jan  4 16:17:22 host2 sshd[3223525]: error: maximum authentication attempts exceeded for root from 85.231.109.115 port 58974 ssh2 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 16:19:04 host2 sshd[3225467]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 16:19:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<bfE4sY1HRNuuijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 16:24:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<Otzqw41HftSOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 16:27:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<dNhXzY1HMrNA46ZK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  4 16:27:33 host2 sshd[3235073]: Disconnected from invalid user user 2.57.121.25 port 36528 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.126
country_id: 3865483
description:
Jan  4 16:39:03 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=179.0.252.126, lip=66.85.158.91, TLS, session=<3wM2941HBsWzAPx+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.8.99
country_id: 3175395
description:
Jan  4 16:39:20 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.197.8.99, lip=66.85.158.91, TLS, session=<FDlw+I1Hbei5xQhj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.141
country_id: 6252001
description:
Jan  4 16:44:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.141, lip=66.85.158.91, TLS: Connection closed, session=<cE7cDI5HiAtChJmN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 16:46:21 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<OhFYEo5H0pJnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 16:48:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<4Cb0GI5HaG0jupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2026-01-04 16:49:20 dovecot_plain authenticator failed for H=c-73-145-107-251.hsd1.mi.comcast.net (zierm) [73.145.107.251]:37036: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 16:52:29 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<e6RSKI5H8kSuijvy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.208.253.156
country_id: 130758
description:
Jan  4 16:54:45 host2 sshd[3267951]: Disconnected from invalid user claude 85.208.253.156 port 48052 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.137.142.115
country_id: 1655842
description:
Jan  4 16:56:04 host2 sshd[3269727]: Disconnected from invalid user claude 202.137.142.115 port 48842 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  4 16:55:28 host2 pure-ftpd[3268940]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 16:55:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<YygONI5H0KqOq2dI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.237.173.220
country_id: 6252001
description:
Jan  4 16:55:47 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.237.173.220, lip=66.85.158.92, session=<L7I7NI5H6OoD7a3c>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.227.237.176
country_id: 1861060
description:
Jan  4 16:56:18 host2 sshd[3270068]: Disconnected from invalid user dev 156.227.237.176 port 36034 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.137.142.115
country_id: 1655842
description:
Jan  4 16:56:54 host2 sshd[3270738]: Disconnected from invalid user bitrix 202.137.142.115 port 33650 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.137.142.115
country_id: 1655842
description:
Jan  4 16:58:25 host2 sshd[3272424]: Disconnected from invalid user vadim 202.137.142.115 port 45558 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.48.144.19
country_id: 6252001
description:
Jan  4 16:58:31 host2 sshd[3272551]: Disconnected from invalid user ubuntu 74.48.144.19 port 38578 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.227.237.176
country_id: 1861060
description:
Jan  4 16:58:53 host2 sshd[3272926]: Disconnected from invalid user bitrix 156.227.237.176 port 54006 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.227.237.176
country_id: 1861060
description:
Jan  4 16:59:33 host2 sshd[3273713]: Disconnected from invalid user wilson 156.227.237.176 port 33456 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.208.253.156
country_id: 130758
description:
Jan  4 17:00:59 host2 sshd[3275950]: Disconnected from invalid user junin 85.208.253.156 port 45444 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 74.48.144.19
country_id: 6252001
description:
Jan  4 17:00:20 host2 sshd[3275038]: Disconnected from invalid user ubuntu 74.48.144.19 port 43376 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.130
country_id: 1269750
description:
2026-01-04 17:01:56 dovecot_login authenticator failed for H=([27.123.114.130]) [27.123.114.130]:57822: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.48.144.19
country_id: 6252001
description:
Jan  4 17:01:28 host2 sshd[3276543]: Disconnected from invalid user claude 74.48.144.19 port 33548 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 17:01:29 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<nPN4SI5H2OdA46ZK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.221.122
country_id: 3144096
description:
2026-01-04 17:02:18 dovecot_login authenticator failed for H=([178.232.221.122]) [178.232.221.122]:56658: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 85.208.253.156
country_id: 130758
description:
Jan  4 17:03:11 host2 sshd[3278317]: Disconnected from invalid user vincent 85.208.253.156 port 48012 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.143.238.207
country_id: 1819730
description:
Jan  4 17:09:13 host2 sshd[3285785]: Disconnected from invalid user claude 103.143.238.207 port 35512 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.78
country_id: 6252001
description:
Jan  4 17:09:21 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=195.184.76.78, lip=66.85.158.91, TLS: Connection closed, session=<hlbDZI5HZ6HDuExO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.74
country_id: 6252001
description:
Jan  4 17:09:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=195.184.76.74, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<MCh9ZY5HX4/DuExK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.157
country_id: 6252001
description:
Jan  4 17:09:36 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.157, lip=66.85.158.91, TLS: Connection closed, session=<VBWsZY5HJ+XDuEyd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.79
country_id: 6252001
description:
Jan  4 17:09:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.79, lip=66.85.158.91, TLS handshaking: Connection closed, session=<RKwlZI5Hk63DuExP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.143.238.207
country_id: 1819730
description:
Jan  4 17:10:56 host2 sshd[3288146]: Disconnected from invalid user postgres 103.143.238.207 port 42242 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.143.238.207
country_id: 1819730
description:
Jan  4 17:12:03 host2 sshd[3289549]: Disconnected from invalid user deployer 103.143.238.207 port 37320 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 17:21:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<DbK7jo5HVOojupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 17:23:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<SQoZl45HIuBnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.195.138.52
country_id: 6252001
description:
2026-01-04 17:24:12 dovecot_plain authenticator failed for H=c-98-195-138-52.hsd1.tx.comcast.net (prolatar) [98.195.138.52]:39772: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.63
country_id: 6252001
description:
Jan  4 17:25:16 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.63, lip=66.85.158.92, TLS: Connection closed, session=<GN+mnY5H8AynXpI/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.96.233.67
country_id: 6251999
description:
2026-01-04 17:25:23 dovecot_login authenticator failed for H=208-96-233-67.resi.cgocable.ca [208.96.233.67]:54182: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.158
country_id: 1269750
description:
2026-01-04 17:25:39 dovecot_login authenticator failed for H=(nsg-corporate-185.188.186.122.airtel.in) [182.95.178.158]:49648: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 17:25:37 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<jgfOno5HWtSuijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 17:26:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<ctQgo45HZq2Oq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.140.19.22
country_id: 1269750
description:
Jan  4 17:28:01 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lezzarotech.com>, method=PLAIN, rip=103.140.19.22, lip=66.85.158.91, session=<Eb5op45HyolnjBMW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.113
country_id: 6252001
description:
Jan  4 17:34:26 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 1 secs): user=<>, rip=66.132.153.113, lip=66.85.158.91, session=<tRJ4vo5Hnq1ChJlx>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.122.87.24
country_id: 2921044
description:
Jan  4 17:34:37 host2 sshd[3319031]: Disconnected from invalid user db 134.122.87.24 port 50566 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 17:36:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<yLfMxY5H6rdA46ZK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.122.87.24
country_id: 2921044
description:
Jan  4 17:39:51 host2 sshd[3324472]: Disconnected from invalid user claude 134.122.87.24 port 60314 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 134.122.87.24
country_id: 2921044
description:
Jan  4 17:40:57 host2 sshd[3326117]: Disconnected from invalid user ghost 134.122.87.24 port 60852 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.122.87.24
country_id: 2921044
description:
Jan  4 17:41:33 host2 sshd[3326793]: Disconnected from invalid user ricoh 134.122.87.24 port 49792 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.134.235
country_id: 6252001
description:
Jan  4 17:44:04 host2 dovecot[1170291]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=71.6.134.235, lip=66.85.158.92, TLS, session=<SSPh4I5H0KpHBobr>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 17:45:51 host2 sshd[3332823]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.219
country_id: 1643084
description:
Jan  4 17:45:28 host2 sshd[3332306]: Disconnected from invalid user claude 103.171.85.219 port 37098 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.227.245.154
country_id: 690791
description:
2026-01-04 17:47:03 dovecot_login authenticator failed for H=(213-227-245-154.static.vega-ua.net) [213.227.245.154]:19501: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.171.85.219
country_id: 1643084
description:
Jan  4 17:46:19 host2 sshd[3333419]: Disconnected from invalid user username 103.171.85.219 port 52280 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.36.204
country_id: 3144096
description:
2026-01-04 17:47:21 dovecot_login authenticator failed for H=(cm-178.232.36.204.get.no) [178.232.36.204]:56741: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.219
country_id: 1643084
description:
Jan  4 17:47:23 host2 sshd[3334611]: Disconnected from invalid user claude 103.171.85.219 port 41344 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.109
country_id: 2186224
description:
2026-01-04 17:47:54 dovecot_login authenticator failed for H=([121.73.169.109]) [121.73.169.109]:33788: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.219
country_id: 1643084
description:
Jan  4 17:48:27 host2 sshd[3335707]: Disconnected from invalid user claude 103.171.85.219 port 55164 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  4 17:49:16 host2 sshd[3336578]: Disconnected from invalid user user 2.57.121.25 port 35070 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 17:54:01 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<K9tZBI9HdIMjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  4 17:54:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<CCctBY9HLIkFhXlo>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.135.112.20
country_id: 6252001
description:
Jan  4 17:56:41 host2 pure-ftpd[3346258]: (?@103.135.112.20) [INFO] New connection from 103.135.112.20


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 17:58:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<tdfiFI9HgpuOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 17:59:21 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<lNt1F49HHOCuijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 17:59:35 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<VzdDGI9HHMRnmud6>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  4 18:00:49 host2 pure-ftpd[3351022]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 18:05:42 host2 sshd[3357680]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.208.24.217
country_id: 6252001
description:
Jan  4 18:10:20 host2 sshd[3363489]: Disconnected from invalid user dmdba 172.208.24.217 port 50342 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.54.170.192
country_id: 3175395
description:
Jan  4 18:10:49 host2 sshd[3364038]: Disconnected from invalid user mostafa 156.54.170.192 port 43427 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.208.24.217
country_id: 6252001
description:
Jan  4 18:10:51 host2 sshd[3364074]: Disconnected from invalid user tejas 172.208.24.217 port 18096 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.54.170.192
country_id: 3175395
description:
Jan  4 18:11:56 host2 sshd[3365568]: Disconnected from invalid user tejas 156.54.170.192 port 55070 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.54.170.192
country_id: 3175395
description:
Jan  4 18:13:04 host2 sshd[3366943]: Disconnected from invalid user claude 156.54.170.192 port 38480 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.208.24.217
country_id: 6252001
description:
Jan  4 18:13:12 host2 sshd[3367060]: Disconnected from invalid user sshuser 172.208.24.217 port 64444 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 18:12:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<tFdXRo9HyoZA46ZK>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 13.200.128.216
country_id: 1269750
description:
Jan  4 18:12:47 host2 sshd[3366523]: Disconnected from invalid user sftpuser 13.200.128.216 port 51728 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.54.170.192
country_id: 3175395
description:
Jan  4 18:13:37 host2 sshd[3367432]: Disconnected from invalid user admin 156.54.170.192 port 44302 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.236.103
country_id: 2921044
description:
Jan  4 18:13:51 host2 sshd[3367642]: Disconnected from invalid user admin 164.92.236.103 port 55556 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 13.200.128.216
country_id: 1269750
description:
Jan  4 18:14:06 host2 sshd[3367940]: Disconnected from invalid user admin 13.200.128.216 port 60566 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 164.92.236.103
country_id: 2921044
description:
Jan  4 18:14:55 host2 sshd[3369016]: Disconnected from invalid user claude 164.92.236.103 port 57466 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.236.103
country_id: 2921044
description:
Jan  4 18:14:23 host2 sshd[3368295]: Disconnected from invalid user mostafa 164.92.236.103 port 39378 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 13.200.128.216
country_id: 1269750
description:
Jan  4 18:14:46 host2 sshd[3368769]: Disconnected from invalid user hadoop 13.200.128.216 port 53908 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.236.103
country_id: 2921044
description:
Jan  4 18:15:30 host2 sshd[3369897]: Disconnected from invalid user testuser 164.92.236.103 port 42414 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.19.168.235
country_id: 3175395
description:
Jan  4 18:16:24 host2 sshd[3370897]: Disconnected from invalid user tempuser 151.19.168.235 port 23719 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.114
country_id: 6252001
description:
Jan  4 18:16:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=713) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=66.132.153.114, lip=66.85.158.92, TLS: read(size=713) failed: Connection reset by peer, session=<0lVQVo9HArNChJly>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.184.50.251
country_id: 3686110
description:
Jan  4 18:18:27 host2 sshd[3373356]: Disconnected from invalid user clamav 201.184.50.251 port 46400 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.113.63.124
country_id: 298795
description:
Jan  4 18:18:31 host2 sshd[3373419]: Disconnected from invalid user furukawa 93.113.63.124 port 52302 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.209.166.253
country_id: 6252001
description:
Jan  4 18:18:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=134.209.166.253, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<DS0iXI9HCMqG0ab9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.158.23.150
country_id: 99237
description:
Jan  4 18:19:17 host2 sshd[3374521]: Disconnected from invalid user ubuntu 185.158.23.150 port 31701 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.59.124.195
country_id: 2658434
description:
Jan  4 18:20:00 host2 sshd[3375458]: Disconnected from invalid user user1 45.59.124.195 port 52756 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.104.136
country_id: 2750405
description:
Jan  4 18:20:31 host2 sshd[3376256]: Disconnected from invalid user joaquin 188.166.104.136 port 38766 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.59.124.195
country_id: 2658434
description:
Jan  4 18:20:33 host2 sshd[3376297]: Disconnected from invalid user ubuntu 45.59.124.195 port 41350 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.59.124.195
country_id: 2658434
description:
Jan  4 18:21:03 host2 sshd[3376828]: Disconnected from invalid user steam 45.59.124.195 port 48956 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.60.142
country_id: 1269750
description:
2026-01-04 18:21:15 dovecot_login authenticator failed for H=(nsg-corporate-142.60.186.122.airtel.in) [122.186.60.142]:59590: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.59.124.195
country_id: 2658434
description:
Jan  4 18:21:33 host2 sshd[3377356]: Disconnected from invalid user claude 45.59.124.195 port 53032 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.8.12
country_id: 614540
description:
2026-01-04 18:21:36 dovecot_login authenticator failed for H=([194.31.8.12]) [194.31.8.12]:65519: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.158.23.150
country_id: 99237
description:
Jan  4 18:21:44 host2 sshd[3377546]: Disconnected from invalid user claude 185.158.23.150 port 33200 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.158.23.150
country_id: 99237
description:
Jan  4 18:22:17 host2 sshd[3378247]: Disconnected from invalid user lek 185.158.23.150 port 9905 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.224.109.126
country_id: 6252001
description:
Jan  4 18:22:29 host2 sshd[3378482]: Disconnected from invalid user caja01 52.224.109.126 port 56198 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.19.168.235
country_id: 3175395
description:
Jan  4 18:22:47 host2 sshd[3378835]: Disconnected from invalid user claude 151.19.168.235 port 23126 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.113.63.124
country_id: 298795
description:
Jan  4 18:23:07 host2 sshd[3379237]: Disconnected from invalid user claude 93.113.63.124 port 42854 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 52.224.109.126
country_id: 6252001
description:
Jan  4 18:23:34 host2 sshd[3379670]: Disconnected from invalid user newroot 52.224.109.126 port 46684 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.113.63.124
country_id: 298795
description:
Jan  4 18:24:51 host2 sshd[3381277]: Disconnected from invalid user claude 93.113.63.124 port 55080 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.190.34.123
country_id: 6252001
description:
Jan  4 18:25:22 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=146.190.34.123, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<0XaVdI9HAOWSviJ7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.224.109.126
country_id: 6252001
description:
Jan  4 18:25:53 host2 sshd[3382735]: Disconnected from invalid user ftpuser 52.224.109.126 port 37314 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 93.113.63.124
country_id: 298795
description:
Jan  4 18:26:02 host2 sshd[3382879]: Disconnected from invalid user claude 93.113.63.124 port 34846 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.104.136
country_id: 2750405
description:
Jan  4 18:26:40 host2 sshd[3383770]: Disconnected from invalid user usuario1 188.166.104.136 port 59786 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 18:27:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<wlZte49HjDkjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.19.168.235
country_id: 3175395
description:
Jan  4 18:28:17 host2 sshd[3386204]: Disconnected from invalid user kamil 151.19.168.235 port 23053 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 188.166.104.136
country_id: 2750405
description:
Jan  4 18:29:12 host2 sshd[3387227]: Disconnected from invalid user clamav 188.166.104.136 port 44586 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 18:31:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<SXnUiY9HbumOq2dI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.173.58.47
country_id: 6252001
description:
2026-01-04 18:31:55 dovecot_plain authenticator failed for H=c-67-173-58-47.hsd1.il.comcast.net (skinon) [67.173.58.47]:43920: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.130.206
country_id: 3144096
description:
2026-01-04 18:33:06 dovecot_login authenticator failed for H=([178.232.130.206]) [178.232.130.206]:38870: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.158
country_id: 1269750
description:
2026-01-04 18:32:40 dovecot_login authenticator failed for H=(nsg-corporate-199.152.185.122.airtel.in) [182.95.178.158]:45334: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  4 18:33:17 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<AujQkI9HBuYFhXlo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.9.243
country_id: 2635167
description:
Jan  4 18:33:27 host2 sshd[3392382]: Disconnected from invalid user vadim 185.196.9.243 port 50602 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.82
country_id: 1269750
description:
2026-01-04 18:33:44 dovecot_login authenticator failed for H=([182.95.61.82]) [182.95.61.82]:33336: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 18:34:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<mkVgk49HXuiuijvy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.169.171.169
country_id: 6252001
description:
2026-01-04 18:34:06 dovecot_login authenticator failed for H=([69.169.171.169]) [69.169.171.169]:51000: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 140.238.186.185
country_id: 3469034
description:
Jan  4 18:36:55 host2 sshd[3396635]: Disconnected from invalid user erpnext 140.238.186.185 port 49204 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.9.243
country_id: 2635167
description:
Jan  4 18:38:26 host2 sshd[3398031]: Disconnected from invalid user claude 185.196.9.243 port 50194 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 18:38:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<isYXpI9HJJFnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.210.103.210
country_id: 3017382
description:
Jan  4 18:39:47 host2 sshd[3399238]: Disconnected from invalid user newuser 51.210.103.210 port 23258 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.196.9.243
country_id: 2635167
description:
Jan  4 18:39:27 host2 sshd[3398886]: Disconnected from invalid user ubuntu 185.196.9.243 port 35688 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.11.64.145
country_id: 241170
description:
Jan  4 18:39:40 host2 sshd[3399110]: Disconnected from invalid user ceo 212.11.64.145 port 49148 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.174.210.161
country_id: 2661886
description:
Jan  4 18:40:18 host2 sshd[3399844]: Disconnected from invalid user angela 158.174.210.161 port 4234 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.169.4.104
country_id: 2635167
description:
Jan  4 18:40:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=185.169.4.104, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<CCThqo9HJf+5qQRo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.11.64.145
country_id: 241170
description:
Jan  4 18:40:47 host2 sshd[3400505]: Disconnected from invalid user claude 212.11.64.145 port 49356 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 79.6.181.195
country_id: 3175395
description:
Jan  4 18:41:40 host2 sshd[3401417]: Disconnected from invalid user devuser 79.6.181.195 port 58134 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.169.4.104
country_id: 2635167
description:
Jan  4 18:41:51 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=185.169.4.104, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<uwmJr49HUf25qQRo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-04 18:41:17 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:55069: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.174.210.161
country_id: 2661886
description:
Jan  4 18:41:40 host2 sshd[3401413]: Disconnected from invalid user claude 158.174.210.161 port 13679 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.6.181.195
country_id: 3175395
description:
Jan  4 18:42:23 host2 sshd[3402186]: Disconnected from invalid user claude 79.6.181.195 port 48304 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.174.210.161
country_id: 2661886
description:
Jan  4 18:42:58 host2 sshd[3402796]: Disconnected from invalid user artem 158.174.210.161 port 58115 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.210.103.210
country_id: 3017382
description:
Jan  4 18:43:58 host2 sshd[3403810]: Disconnected from invalid user support 51.210.103.210 port 52144 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.202
country_id: 3469034
description:
Jan  4 18:44:06 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=187.120.72.202, lip=66.85.158.91, TLS, session=<dNBzto9HFJq7eEjK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.174.210.161
country_id: 2661886
description:
Jan  4 18:43:38 host2 sshd[3403458]: Disconnected from invalid user vlad 158.174.210.161 port 11259 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.199.117.9
country_id: 6252001
description:
Jan  4 18:44:44 host2 sshd[3404484]: Disconnected from invalid user system 24.199.117.9 port 44488 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.131.116
country_id: 690791
description:
Jan  4 18:44:26 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw>, method=PLAIN, rip=37.221.131.116, lip=66.85.158.91, TLS, session=<Z3i+t49HfIYl3YN0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.210.103.210
country_id: 3017382
description:
Jan  4 18:44:30 host2 sshd[3404279]: Disconnected from invalid user ubuntu 51.210.103.210 port 29382 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 24.199.117.9
country_id: 6252001
description:
Jan  4 18:45:22 host2 sshd[3405365]: Disconnected from invalid user admin 24.199.117.9 port 38932 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.210.103.210
country_id: 3017382
description:
Jan  4 18:45:32 host2 sshd[3405585]: Disconnected from invalid user test 51.210.103.210 port 63248 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.199.117.9
country_id: 6252001
description:
Jan  4 18:46:33 host2 sshd[3407262]: Disconnected from invalid user vnc 24.199.117.9 port 39136 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 18:49:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<N49lyY9Hmq1A46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 212.104.231.204
country_id: 1227603
description:
Jan  4 18:49:25 host2 dovecot[1170291]: pop3-login: Disconnected: Aborted login by logging out (auth failed, 1 attempts in 3 secs): user=<chamath.chamupathi@saara.lk>, method=PLAIN, rip=212.104.231.204, lip=66.85.158.91, TLS, session=<CK11yo9H/MDUaOfM>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 140.238.186.185
country_id: 3469034
description:
Jan  4 18:50:41 host2 sshd[3411578]: Disconnected from invalid user kamil 140.238.186.185 port 49020 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-04 18:55:30 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (czemipled) [87.103.126.54]:50351: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.168.194.41
country_id: 1269750
description:
Jan  4 18:55:33 host2 sshd[3416873]: Disconnected from invalid user claude 122.168.194.41 port 49048 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.44.173.68
country_id: 3175395
description:
Jan  4 18:55:43 host2 sshd[3417023]: Disconnected from invalid user claude 151.44.173.68 port 3795 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.155.223.9
country_id: 1605651
description:
Jan  4 18:55:45 host2 sshd[3416934]: Disconnected from invalid user claude 122.155.223.9 port 24168 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.230.228.16
country_id: 6252001
description:
2026-01-04 18:57:00 dovecot_plain authenticator failed for H=c-71-230-228-16.hsd1.de.comcast.net (trasceake) [71.230.228.16]:49448: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.28.190.247
country_id: 2510769
description:
Jan  4 18:57:51 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=139.28.190.247, lip=66.85.158.91, TLS, session=<bQWO549Hfs2LHL73>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.36.202.157
country_id: 3469034
description:
Jan  4 18:58:11 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=138.36.202.157, lip=66.85.158.91, TLS, session=<5m3i6I9Hc6CKJMqd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.125.150
country_id: 6252001
description:
Jan  4 18:57:17 host2 sshd[3418327]: Disconnected from invalid user claude 205.185.125.150 port 52430 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 31.14.114.105
country_id: 130758
description:
Jan  4 18:58:49 host2 sshd[3420443]: Disconnected from invalid user developer 31.14.114.105 port 33302 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.168.194.41
country_id: 1269750
description:
Jan  4 18:59:35 host2 sshd[3421231]: Disconnected from invalid user claude 122.168.194.41 port 42246 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 19:00:47 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<l2kp849HJqMjupN+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.168.194.41
country_id: 1269750
description:
Jan  4 19:00:19 host2 sshd[3422229]: Disconnected from invalid user admin 122.168.194.41 port 60144 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.125.150
country_id: 6252001
description:
Jan  4 19:00:31 host2 sshd[3422411]: Disconnected from invalid user claude 205.185.125.150 port 54032 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 148.113.24.68
country_id: 1269750
description:
Jan  4 19:01:23 host2 sshd[3423325]: Disconnected from invalid user xiaoli 148.113.24.68 port 59648 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.155.223.9
country_id: 1605651
description:
Jan  4 19:02:35 host2 sshd[3424472]: Disconnected from invalid user elasticuser 122.155.223.9 port 30558 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2026-01-04 19:02:14 dovecot_plain authenticator failed for H=(matic) [94.201.22.158]:50734: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.125.150
country_id: 6252001
description:
Jan  4 19:03:36 host2 sshd[3425490]: Disconnected from invalid user ubuntu 205.185.125.150 port 55640 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.44.173.68
country_id: 3175395
description:
Jan  4 19:03:52 host2 sshd[3425749]: Disconnected from invalid user claude 151.44.173.68 port 3028 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 19:03:56 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<n4Np/o9HHo6Oq2dI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.237.94.18
country_id: 6252001
description:
Jan  4 19:03:19 host2 sshd[3425233]: Disconnected from invalid user copia 35.237.94.18 port 39012 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.237.94.18
country_id: 6252001
description:
Jan  4 19:04:13 host2 sshd[3426295]: Disconnected from invalid user claude 35.237.94.18 port 54424 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.44.173.68
country_id: 3175395
description:
Jan  4 19:04:49 host2 sshd[3426901]: Disconnected from invalid user ubuntu 151.44.173.68 port 3204 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.174.115.196
country_id: 1643084
description:
Jan  4 19:05:56 host2 sshd[3428242]: Disconnected from invalid user ftp_admin 103.174.115.196 port 33674 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.237.94.18
country_id: 6252001
description:
Jan  4 19:06:04 host2 sshd[3428455]: Disconnected from invalid user steam 35.237.94.18 port 38168 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.86
country_id: 1269750
description:
2026-01-04 19:06:11 dovecot_login authenticator failed for H=([125.17.17.201]) [27.123.113.86]:60636: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2026-01-04 19:05:28 dovecot_plain authenticator failed for H=c-24-127-53-61.hsd1.mi.comcast.net (mintations) [24.127.53.61]:49406: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.237.94.18
country_id: 6252001
description:
Jan  4 19:05:30 host2 sshd[3427907]: Disconnected from invalid user ubuntu 35.237.94.18 port 53006 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 31.14.114.105
country_id: 130758
description:
Jan  4 19:05:38 host2 sshd[3428041]: Disconnected from invalid user claude 31.14.114.105 port 53214 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.32.75.127
country_id: 3585968
description:
2026-01-04 19:07:13 dovecot_login authenticator failed for H=([186.32.75.127]) [186.32.75.127]:59541: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.174.115.196
country_id: 1643084
description:
Jan  4 19:06:40 host2 sshd[3428904]: Disconnected from invalid user claude 103.174.115.196 port 51432 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.130.95
country_id: 99237
description:
2026-01-04 19:07:34 dovecot_login authenticator failed for H=([65.20.130.95]) [65.20.130.95]:55961: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.204.15
country_id: 1643084
description:
Jan  4 19:07:46 host2 sshd[3429903]: Disconnected from invalid user mcserver 103.172.204.15 port 56838 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 148.113.24.68
country_id: 1269750
description:
Jan  4 19:07:55 host2 sshd[3430082]: Disconnected from invalid user logviewer 148.113.24.68 port 44960 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  4 19:07:27 host2 pure-ftpd[3429742]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 19:08:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<ebWDD5BHhoWuijvy>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 148.113.24.68
country_id: 1269750
description:
Jan  4 19:09:50 host2 sshd[3432328]: Disconnected from invalid user claude 148.113.24.68 port 50618 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.68.71.16
country_id: 2921044
description:
Jan  4 19:10:04 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=138.68.71.16, lip=66.85.158.92, TLS, session=<rKd6FJBHqCiKREcQ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 148.113.24.68
country_id: 1269750
description:
Jan  4 19:10:31 host2 sshd[3433440]: Disconnected from invalid user elsearch 148.113.24.68 port 32898 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.204.15
country_id: 1643084
description:
Jan  4 19:11:44 host2 sshd[3434586]: Disconnected from invalid user admin 103.172.204.15 port 53838 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  4 19:15:42 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: Connection closed, session=<4eiaKJBHQrcDgmBb>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 161.118.215.229
country_id: 1880251
description:
Jan  4 19:15:21 host2 pure-ftpd[3439170]: (?@161.118.215.229) [INFO] New connection from 161.118.215.229


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 161.118.215.229
country_id: 1880251
description:
Jan  4 19:15:25 host2 pure-ftpd[3439280]: (?@161.118.215.229) [INFO] New connection from 161.118.215.229


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.140.19.22
country_id: 1269750
description:
Jan  4 19:16:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<info@gemtrails.com>, method=PLAIN, rip=103.140.19.22, lip=66.85.158.91, session=<yysQLJBHPN1njBMW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 19:16:49 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<vel6LJBH3NNnmud6>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 161.118.215.229
country_id: 1880251
description:
Jan  4 19:16:13 host2 pure-ftpd[3440304]: (?@161.118.215.229) [INFO] New connection from 161.118.215.229


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 161.118.215.229
country_id: 1880251
description:
Jan  4 19:16:14 host2 pure-ftpd[3440316]: (?@161.118.215.229) [INFO] New connection from 161.118.215.229


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.139.157
country_id: 1269750
description:
Jan  4 19:17:57 host2 sshd[3442207]: Disconnected from invalid user user5 64.227.139.157 port 39246 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.172.204.15
country_id: 1643084
description:
Jan  4 19:18:42 host2 sshd[3442860]: Disconnected from invalid user claude 103.172.204.15 port 59404 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  4 19:19:05 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<X9m7NJBH3rADgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  4 19:20:02 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS, session=<bbAcOJBHepgDgmBb>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.145.145.75
country_id: 1819730
description:
Jan  4 19:20:27 host2 sshd[3445262]: Disconnected from invalid user debian 103.145.145.75 port 40126 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.139.157
country_id: 1269750
description:
Jan  4 19:20:44 host2 sshd[3445555]: Disconnected from invalid user user 64.227.139.157 port 38240 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  4 19:21:24 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: Connection closed, session=<6fAEPZBHXIEDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.139.157
country_id: 1269750
description:
Jan  4 19:21:28 host2 sshd[3446341]: Disconnected from invalid user deploy 64.227.139.157 port 34544 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.227.139.157
country_id: 1269750
description:
Jan  4 19:22:52 host2 sshd[3447596]: Disconnected from invalid user testuser 64.227.139.157 port 54916 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  4 19:22:48 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<NlP7QZBHbpcDgmBb>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.105.224.72
country_id: 1861060
description:
Jan  4 19:24:07 host2 pure-ftpd[3448963]: (?@172.105.224.72) [INFO] New connection from 172.105.224.72


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  4 19:24:13 host2 sshd[3449011]: Disconnected from invalid user user 2.57.121.25 port 17105 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.152.61
country_id: 6252001
description:
2026-01-04 19:24:22 dovecot_login authenticator failed for H=(c-50-187-152-61.unallocated.comcastbusiness.net) [50.187.152.61]:41836: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.65.59.241
country_id: 3686110
description:
2026-01-04 19:24:36 dovecot_login authenticator failed for H=([190.65.59.241]) [190.65.59.241]:55892: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  4 19:24:43 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS, session=<G2TdSJBH0rwDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 19:25:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<WQuVS5BHCKxA46ZK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.152
country_id: 3703430
description:
Jan  4 19:25:53 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.227.254.152, lip=66.85.158.91, session=<D/8NTZBHtf8t4/6Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2026-01-04 19:29:14 dovecot_plain authenticator failed for H=c-68-60-77-128.hsd1.mi.comcast.net (fackate) [68.60.77.128]:57698: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 19:33:14 host2 sshd[3458695]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 19:34:21 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<cE4ra5BHrugjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.23.68
country_id: 3144096
description:
2026-01-04 19:35:27 dovecot_login authenticator failed for H=([178.232.23.68]) [178.232.23.68]:46149: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.50.155
country_id: 1269750
description:
2026-01-04 19:35:38 dovecot_login authenticator failed for H=(abts-north-static-155.50.160.122.airtelbroadband.in) [122.160.50.155]:35384: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 19:36:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<FFp3cpBHKuyOq2dI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.119.139
country_id: 2661886
description:
2026-01-04 19:36:37 dovecot_plain authenticator failed for H=78-66-119-139-no600.tbcn.telia.com (eines) [78.66.119.139]:48142: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2026-01-04 19:36:40 dovecot_plain authenticator failed for H=c-174-161-27-82.hsd1.tn.comcast.net (tochass) [174.161.27.82]:43579: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 19:43:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<PL1njJBHUPGuijvy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.225.176.238
country_id: 6252001
description:
Jan  4 19:46:34 host2 sshd[3475802]: Disconnected from invalid user oem 50.225.176.238 port 57406 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.93.128.179
country_id: 1269750
description:
Jan  4 19:46:56 host2 sshd[3476068]: Disconnected from invalid user es 34.93.128.179 port 44014 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.64.68.99
country_id: 1643084
description:
Jan  4 19:47:01 host2 sshd[3476150]: Disconnected from invalid user master 36.64.68.99 port 49040 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.121.76.190
country_id: 732800
description:
2026-01-04 19:47:13 dovecot_plain authenticator failed for H=(reakfic) [87.121.76.190]:40089: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2026-01-04 19:47:24 dovecot_login authenticator failed for H=([186.239.240.127]) [186.215.245.175]:40170: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.115.237.19
country_id: 3923057
description:
2026-01-04 19:47:38 dovecot_login authenticator failed for H=([181.115.237.19]) [181.115.237.19]:64842: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 50.225.176.238
country_id: 6252001
description:
Jan  4 19:48:23 host2 sshd[3477357]: Disconnected from invalid user claude 50.225.176.238 port 38524 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.93.128.179
country_id: 1269750
description:
Jan  4 19:48:55 host2 sshd[3477755]: Disconnected from invalid user claude 34.93.128.179 port 38216 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.225.176.238
country_id: 6252001
description:
Jan  4 19:49:29 host2 sshd[3478426]: Disconnected from invalid user claude 50.225.176.238 port 46430 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.64.68.99
country_id: 1643084
description:
Jan  4 19:49:46 host2 sshd[3478787]: Disconnected from invalid user pippo 36.64.68.99 port 36050 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.93.128.179
country_id: 1269750
description:
Jan  4 19:50:48 host2 sshd[3480498]: Disconnected from invalid user claude 34.93.128.179 port 52880 [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 1.32.41.192
country_id: 1733045
description:
Jan  4 19:51:24 host2 sshd[3481218]: Disconnecting authenticating user root 1.32.41.192 port 37151: Too many authentication failures [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 1.32.41.192
country_id: 1733045
description:
Jan  4 19:51:43 host2 sshd[3481624]: error: maximum authentication attempts exceeded for invalid user admin from 1.32.41.192 port 37712 ssh2 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 1.32.41.192
country_id: 1733045
description:
Jan  4 19:51:48 host2 sshd[3481722]: Disconnecting invalid user admin 1.32.41.192 port 37904: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 1.32.41.192
country_id: 1733045
description:
Jan  4 19:51:24 host2 sshd[3481218]: error: maximum authentication attempts exceeded for root from 1.32.41.192 port 37151 ssh2 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 19:53:10 host2 sshd[3482966]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.152.90
country_id: 1605651
description:
Jan  4 19:53:40 host2 sshd[3483300]: Disconnected from invalid user claude 27.254.152.90 port 57716 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.152.90
country_id: 1605651
description:
Jan  4 19:55:06 host2 sshd[3484964]: Disconnected from invalid user claude 27.254.152.90 port 56682 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 19:54:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<JbSUtJBHGMRnmud6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.107.233
country_id: 1819730
description:
Jan  4 19:55:36 host2 sshd[3485570]: Disconnected from invalid user ftpuser 101.36.107.233 port 59884 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.107.233
country_id: 1819730
description:
Jan  4 19:56:21 host2 sshd[3486143]: Disconnected from invalid user trevor 101.36.107.233 port 16456 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  4 19:56:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<82T0uZBHAM0FhXlo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.135.95
country_id: 1880251
description:
Jan  4 19:56:48 host2 sshd[3486600]: Disconnected from invalid user minecraft 101.47.135.95 port 49856 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 20:02:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<Y88PzpBHKthA46ZK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.135.95
country_id: 1880251
description:
Jan  4 20:03:06 host2 sshd[3492719]: Disconnected from invalid user ubuntu 101.47.135.95 port 57948 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.135.95
country_id: 1880251
description:
Jan  4 20:04:09 host2 sshd[3493717]: Disconnected from invalid user claude 101.47.135.95 port 48446 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.8.81
country_id: 2750405
description:
Jan  4 20:03:36 host2 sshd[3493210]: Disconnected from invalid user lex 159.223.8.81 port 42534 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 142.93.212.130
country_id: 1269750
description:
Jan  4 20:03:59 host2 sshd[3493543]: Disconnected from invalid user tezos 142.93.212.130 port 41738 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 77.87.40.114
country_id: 690791
description:
Jan  4 20:04:43 host2 sshd[3494218]: Disconnected from invalid user yuri 77.87.40.114 port 40140 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.135.95
country_id: 1880251
description:
Jan  4 20:06:11 host2 sshd[3495875]: Disconnected from invalid user claude 101.47.135.95 port 55566 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 77.87.40.114
country_id: 690791
description:
Jan  4 20:06:33 host2 sshd[3496261]: Disconnected from invalid user claude 77.87.40.114 port 43014 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.231.192
country_id: 1880251
description:
Jan  4 20:07:34 host2 sshd[3497318]: Disconnected from invalid user joe 45.78.231.192 port 46122 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 77.87.40.114
country_id: 690791
description:
Jan  4 20:07:39 host2 sshd[3497394]: Disconnected from invalid user joe 77.87.40.114 port 38400 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 20:08:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<rtDb5JBH6msjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 77.87.40.114
country_id: 690791
description:
Jan  4 20:08:43 host2 sshd[3498553]: Disconnected from invalid user claude 77.87.40.114 port 33774 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 96.77.54.153
country_id: 6252001
description:
Jan  4 20:09:54 host2 sshd[3499873]: Disconnected from invalid user joe 96.77.54.153 port 35304 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Jan  4 20:10:05 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<eBny6pBHxIEFhH+s>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.135.95
country_id: 1880251
description:
Jan  4 20:09:15 host2 sshd[3498963]: Disconnected from invalid user ali 101.47.135.95 port 50246 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 20:09:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<PAdo6JBH3NSOq2dI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 96.77.54.153
country_id: 6252001
description:
Jan  4 20:10:33 host2 sshd[3500951]: Disconnected from invalid user ansible 96.77.54.153 port 47802 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 142.93.212.130
country_id: 1269750
description:
Jan  4 20:10:51 host2 sshd[3501338]: Disconnected from invalid user claude 142.93.212.130 port 56182 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.8.81
country_id: 2750405
description:
Jan  4 20:11:07 host2 sshd[3501751]: Disconnected from invalid user test 159.223.8.81 port 33752 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 96.77.54.153
country_id: 6252001
description:
Jan  4 20:11:15 host2 sshd[3501891]: Disconnected from invalid user uploader 96.77.54.153 port 59346 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 142.93.212.130
country_id: 1269750
description:
Jan  4 20:12:11 host2 sshd[3502876]: Disconnected from invalid user tech 142.93.212.130 port 35678 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.23.180.137
country_id: 6252001
description:
Jan  4 20:14:24 host2 sshd[3505566]: Disconnected from invalid user minecraft 64.23.180.137 port 53210 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.216.177.55
country_id: 1643084
description:
Jan  4 20:15:23 host2 sshd[3506888]: Disconnected from invalid user saeid 41.216.177.55 port 55002 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.223.40.77
country_id: 3351879
description:
Jan  4 20:15:40 host2 sshd[3507524]: Disconnected from invalid user steam 41.223.40.77 port 56242 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.231.192
country_id: 1880251
description:
Jan  4 20:16:39 host2 sshd[3508583]: Disconnected from invalid user serv 45.78.231.192 port 52982 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.0.212.86
country_id: 3469034
description:
Jan  4 20:16:24 host2 sshd[3508333]: Disconnected from invalid user jagdish 177.0.212.86 port 37896 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.39.20.135
country_id: 6251999
description:
Jan  4 20:17:56 host2 sshd[3510604]: Disconnected from invalid user john 54.39.20.135 port 57734 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.95.157.171
country_id: 1861060
description:
Jan  4 20:17:23 host2 sshd[3509894]: Disconnected from invalid user odoo 150.95.157.171 port 37738 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.0.212.86
country_id: 3469034
description:
Jan  4 20:17:45 host2 sshd[3510384]: Disconnected from invalid user ubuntu 177.0.212.86 port 39508 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.95.157.171
country_id: 1861060
description:
Jan  4 20:18:44 host2 sshd[3511545]: Disconnected from invalid user admin1 150.95.157.171 port 60638 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 20:18:49 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<dPs6CpFHzDCuijvy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.0.212.86
country_id: 3469034
description:
Jan  4 20:19:04 host2 sshd[3512026]: Disconnected from invalid user yaya 177.0.212.86 port 37855 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.131.135.89
country_id: 2750405
description:
Jan  4 20:18:34 host2 sshd[3511373]: Disconnected from invalid user mcserver 45.131.135.89 port 46444 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.23.180.137
country_id: 6252001
description:
Jan  4 20:19:27 host2 sshd[3512432]: Disconnected from invalid user roots 64.23.180.137 port 56800 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.216.177.55
country_id: 1643084
description:
Jan  4 20:19:38 host2 sshd[3512590]: Disconnected from invalid user deploy 41.216.177.55 port 41480 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.213.129
country_id: 6251999
description:
Jan  4 20:19:41 host2 sshd[3512663]: Disconnected from invalid user claude 158.69.213.129 port 41336 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.223.40.77
country_id: 3351879
description:
Jan  4 20:19:50 host2 sshd[3512819]: Disconnected from invalid user ubuntu 41.223.40.77 port 59702 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.70.65.229
country_id: 1282988
description:
Jan  4 20:20:58 host2 sshd[3514234]: Disconnected from invalid user claude 202.70.65.229 port 40038 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.213.129
country_id: 6251999
description:
Jan  4 20:20:17 host2 sshd[3513616]: Disconnected from invalid user bitrix 158.69.213.129 port 34496 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.223.40.77
country_id: 3351879
description:
Jan  4 20:20:30 host2 sshd[3513815]: Disconnected from invalid user gao 41.223.40.77 port 38658 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.140.19.22
country_id: 1269750
description:
Jan  4 20:20:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=103.140.19.22, lip=66.85.158.91, session=<OOxiEJFHvMBnjBMW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.23.180.137
country_id: 6252001
description:
Jan  4 20:21:18 host2 sshd[3514586]: Disconnected from invalid user sol 64.23.180.137 port 37592 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 158.69.213.129
country_id: 6251999
description:
Jan  4 20:21:21 host2 sshd[3514626]: Disconnected from invalid user sol 158.69.213.129 port 46062 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.39.20.135
country_id: 6251999
description:
Jan  4 20:22:49 host2 sshd[3516167]: Disconnected from invalid user claude 54.39.20.135 port 32968 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.131.135.89
country_id: 2750405
description:
Jan  4 20:22:10 host2 sshd[3515470]: Disconnected from invalid user claude 45.131.135.89 port 57494 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.216.177.55
country_id: 1643084
description:
Jan  4 20:22:22 host2 sshd[3515666]: Disconnected from invalid user yujie 41.216.177.55 port 49618 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.23.180.137
country_id: 6252001
description:
Jan  4 20:22:24 host2 sshd[3515731]: Disconnected from invalid user ftpuser 64.23.180.137 port 36360 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.70.65.229
country_id: 1282988
description:
Jan  4 20:23:34 host2 sshd[3516950]: Disconnected from invalid user paul 202.70.65.229 port 53780 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.131.135.89
country_id: 2750405
description:
Jan  4 20:23:09 host2 sshd[3516599]: Disconnected from invalid user ubuntu 45.131.135.89 port 48656 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.70.65.229
country_id: 1282988
description:
Jan  4 20:24:17 host2 sshd[3517735]: Disconnected from invalid user spotlight 202.70.65.229 port 38776 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 174.138.87.242
country_id: 6252001
description:
Jan  4 20:24:29 host2 sshd[3517973]: Disconnected from invalid user sdtdserver 174.138.87.242 port 57184 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.216.20.24
country_id: 3469034
description:
Jan  4 20:25:04 host2 sshd[3518590]: Disconnected from invalid user claude 179.216.20.24 port 32462 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 174.138.87.242
country_id: 6252001
description:
Jan  4 20:25:42 host2 sshd[3519359]: Disconnected from invalid user amsftp 174.138.87.242 port 39372 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.131.135.89
country_id: 2750405
description:
Jan  4 20:26:10 host2 sshd[3519832]: Disconnected from invalid user claude 45.131.135.89 port 53700 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 174.138.87.242
country_id: 6252001
description:
Jan  4 20:26:22 host2 sshd[3520037]: Disconnected from invalid user claude 174.138.87.242 port 57520 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.159.248
country_id: 6252001
description:
Jan  4 20:26:55 host2 sshd[3520475]: Disconnected from invalid user claude 107.175.159.248 port 39576 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.204.152
country_id: 1643084
description:
Jan  4 20:28:24 host2 sshd[3521804]: Disconnected from invalid user claude 103.172.204.152 port 42856 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.131.135.89
country_id: 2750405
description:
Jan  4 20:28:41 host2 sshd[3522196]: Disconnected from invalid user ftpuser 45.131.135.89 port 58830 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.216.20.24
country_id: 3469034
description:
Jan  4 20:30:18 host2 sshd[3524218]: Disconnected from invalid user wanghao 179.216.20.24 port 34856 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.0.212.86
country_id: 3469034
description:
Jan  4 20:32:17 host2 sshd[3526110]: Disconnected from invalid user ftpuser 177.0.212.86 port 40775 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 20:32:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<NnLaOpFHJptnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.216.20.24
country_id: 3469034
description:
Jan  4 20:34:15 host2 sshd[3528066]: Disconnected from invalid user claude 179.216.20.24 port 34914 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.175.159.248
country_id: 6252001
description:
Jan  4 20:37:04 host2 sshd[3531483]: Disconnected from invalid user rw 107.175.159.248 port 39992 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 20:38:41 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<qhZFUZFHxOFA46ZK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.185.243.158
country_id: 6252001
description:
Jan  4 20:42:15 host2 sshd[3538260]: Disconnected from invalid user carl 20.185.243.158 port 39104 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 20:42:37 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<vY5IX5FHUrGOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 20:42:36 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<Z2NHX5FHcGQjupN+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.185.243.158
country_id: 6252001
description:
Jan  4 20:42:51 host2 sshd[3538855]: Disconnected from invalid user db2inst 20.185.243.158 port 33368 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.185.243.158
country_id: 6252001
description:
Jan  4 20:43:24 host2 sshd[3539530]: Disconnected from invalid user storage 20.185.243.158 port 43826 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.198.40.225
country_id: 241170
description:
Jan  4 20:43:40 host2 sshd[3539745]: Disconnected from invalid user elasticsearch 154.198.40.225 port 38894 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  4 20:46:10 host2 sshd[3542831]: Disconnected from invalid user user 2.57.121.25 port 19697 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.234.138.43
country_id: 690791
description:
Jan  4 20:46:33 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=91.234.138.43, lip=66.85.158.91, TLS, session=<I95qbJFH2Yxb6oor>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.243.150
country_id: 798544
description:
Jan  4 20:46:52 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=109.125.243.150, lip=66.85.158.91, TLS, session=<OtmYbZFHPKZtffOW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2026-01-04 20:49:46 dovecot_plain authenticator failed for H=(soxonmen) [176.113.155.132]:53353: 535 Incorrect authentication data (set_id=sales@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.0.32.181
country_id: 298795
description:
Jan  4 20:50:01 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=95.0.32.181, lip=66.85.158.91, TLS, session=<iVvZeJFHp6tfACC1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.172.11.140
country_id: 1269750
description:
Jan  4 20:50:05 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=103.172.11.140, lip=66.85.158.91, TLS, session=<uYLkeJFHDqxnrAuM>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.198.40.225
country_id: 241170
description:
Jan  4 20:50:37 host2 sshd[3547713]: Disconnected from invalid user setup 154.198.40.225 port 57146 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.129.206.42
country_id: 3469034
description:
Jan  4 20:50:22 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<hr>, method=PLAIN, rip=177.129.206.42, lip=66.85.158.91, TLS, session=<GL0RepFHPcKxgc4q>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.1.216.16
country_id: 3865483
description:
Jan  4 20:50:25 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<hr>, method=PLAIN, rip=186.1.216.16, lip=66.85.158.91, TLS, session=<spxEepFH24i6AdgQ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.198.40.225
country_id: 241170
description:
Jan  4 20:51:47 host2 sshd[3549078]: Disconnected from invalid user user100 154.198.40.225 port 33544 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.25.232.7
country_id: 953987
description:
Jan  4 20:52:36 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<amila@euroentertainmentlk.com>, method=PLAIN, rip=41.25.232.7, lip=66.85.158.91, session=<TgYIg5FH38IpGegH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 20:54:02 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<s0otiJFHLJuuijvy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.203.138
country_id: 1269750
description:
2026-01-04 20:55:54 dovecot_login authenticator failed for H=(nsg-corporate-201.0.185.122.airtel.in) [125.23.203.138]:36208: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2026-01-04 20:55:43 dovecot_plain authenticator failed for H=c-73-137-7-97.hsd1.ga.comcast.net (varupred) [73.137.7.97]:60836: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.205
country_id: 337996
description:
2026-01-04 20:56:14 dovecot_login authenticator failed for H=([196.188.187.205]) [196.188.187.205]:33128: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 21:05:19 host2 sshd[3565411]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.224.171.101
country_id: 6252001
description:
2026-01-04 21:08:42 dovecot_plain authenticator failed for H=c-73-224-171-101.hsd1.fl.comcast.net (nonize) [73.224.171.101]:47658: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 21:10:39 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<OGaZw5FHfrpnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2026-01-04 21:13:45 dovecot_plain authenticator failed for H=c-73-13-220-220.hsd1.de.comcast.net (unsamately) [73.13.220.220]:53488: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 21:14:35 host2 sshd[3575973]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 21:15:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<R8zJ05FHTNJA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 21:15:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<bFNX1pFHfM+Oq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 21:16:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<YrE/15FHkOMjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.255.223.75
country_id: 1880251
description:
Jan  4 21:17:09 host2 sshd[3578543]: Disconnected from invalid user ftpuser1 36.255.223.75 port 32450 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.255.223.75
country_id: 1880251
description:
Jan  4 21:18:54 host2 sshd[3580518]: Disconnected from invalid user ramesh 36.255.223.75 port 56424 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  4 21:19:21 host2 pure-ftpd[3581027]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.255.223.75
country_id: 1880251
description:
Jan  4 21:19:30 host2 sshd[3581157]: Disconnected from invalid user cristina 36.255.223.75 port 13472 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.255.223.75
country_id: 1880251
description:
Jan  4 21:21:19 host2 sshd[3583521]: Disconnected from invalid user claude 36.255.223.75 port 49608 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.206.160
country_id: 6252001
description:
Jan  4 21:22:34 host2 sshd[3584951]: Disconnected from invalid user spark 152.32.206.160 port 52658 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.206.160
country_id: 6252001
description:
Jan  4 21:23:10 host2 sshd[3585631]: Disconnected from invalid user smbguest 152.32.206.160 port 35234 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.206.160
country_id: 6252001
description:
Jan  4 21:24:27 host2 sshd[3587269]: Disconnected from invalid user fauzi 152.32.206.160 port 56080 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 21:25:12 host2 sshd[3588207]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 21:29:14 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<zCcJBpJHtnuuijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.60.212.126
country_id: 3175395
description:
Jan  4 21:30:43 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=194.60.212.126, lip=66.85.158.91, TLS, session=<4qx8CpJHZaDCPNR+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.85.107.170
country_id: 3469034
description:
Jan  4 21:31:04 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<charanaw>, method=PLAIN, rip=187.85.107.170, lip=66.85.158.91, TLS, session=<x6OdC5JHsou7VWuq>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.135.112.20
country_id: 6252001
description:
Jan  4 21:36:18 host2 pure-ftpd[3600889]: (?@103.135.112.20) [INFO] New connection from 103.135.112.20


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.94.146.61
country_id: 6252001
description:
Jan  4 21:40:51 host2 pure-ftpd[3605296]: (?@167.94.146.61) [INFO] New connection from 167.94.146.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.92.66.188
country_id: 6251999
description:
2026-01-04 21:46:47 dovecot_login authenticator failed for H=([147.92.66.188]) [147.92.66.188]:48438: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.219.80
country_id: 3144096
description:
2026-01-04 21:47:05 dovecot_login authenticator failed for H=(cm-84.210.219.80.get.no) [84.210.219.80]:60488: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 21:48:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<qR6tSZJHiIRnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 21:48:56 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<gwp+TJJHcKaOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 21:49:58 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<Ex8qUJJHtK4jupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.144
country_id: 1269750
description:
2026-01-04 21:50:56 dovecot_login authenticator failed for H=(nsg-corporate-144.230.187.122.airtel.in) [122.187.230.144]:52001: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.170.59
country_id: 99237
description:
2026-01-04 21:50:26 dovecot_login authenticator failed for H=([65.20.170.59]) [65.20.170.59]:59504: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 21:51:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<SWudVJJH1M1A46ZK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-04 21:53:07 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (asswale) [87.103.126.54]:46486: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  4 21:57:48 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<G54wbJJHfqgFhXlo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.98.45.238
country_id: 6252001
description:
2026-01-04 21:59:48 dovecot_plain authenticator failed for H=c-24-98-45-238.hsd1.ga.comcast.net (apsans) [24.98.45.238]:44584: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.40.48.59
country_id: 2635167
description:
[2026-01-04 21:59:15 +0530] info [webmaild] 149.40.48.59 - washeera@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.16.55.198
country_id: 6252001
description:
[2026-01-04 22:00:39 +0530] info [webmaild] 178.16.55.198 - 587hr@lezzarotech.com "GET /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-04 22:04:01 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:54585: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 22:04:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<nXiGg5JHsuGuijvy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.4
country_id: 798549
description:
Jan  4 22:08:11 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=85.217.140.4, lip=66.85.158.91, session=<6mdvkZJHoKBV2YwE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.248.19.102
country_id: 1269750
description:
2026-01-04 22:20:08 dovecot_login authenticator failed for H=([218.248.19.102]) [218.248.19.102]:60572: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 178.128.242.174
country_id: 2750405
description:
Jan  4 22:21:18 host2 pure-ftpd[3666255]: (?@178.128.242.174) [INFO] New connection from 178.128.242.174


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 22:21:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<xzMtwpJHGMuOq2dI>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.64.105.169
country_id: 6252001
description:
Jan  4 22:23:17 host2 pure-ftpd[3668938]: (?@20.64.105.169) [INFO] New connection from 20.64.105.169


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 22:23:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<26dHyZJH4jMjupN+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  4 22:24:44 host2 pure-ftpd[3670480]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 22:26:58 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<kfln1JJHptVnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 22:27:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<nUIg1pJHDL5A46ZK>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 22:29:32 host2 sshd[3676324]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.196.9.141
country_id: 2635167
description:
Jan  4 22:30:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=185.196.9.141, lip=66.85.158.91, session=<umIz4ZJHspa5xAmN>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.70
country_id: 6252001
description:
Jan  4 22:32:27 host2 pure-ftpd[3679336]: (?@198.235.24.70) [INFO] New connection from 198.235.24.70


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 22:38:32 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<iFrl/ZJHJMauijvy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.235.64.126
country_id: 1269750
description:
2026-01-04 22:41:07 dovecot_login authenticator failed for H=([223.235.64.126]) [223.235.64.126]:54127: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.108
country_id: 6252001
description:
Jan  4 22:40:27 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.108, lip=66.85.158.92, TLS handshaking: Connection closed, session=<JIjeBJNHpG9BMQFs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.247.239.202
country_id: 1269750
description:
2026-01-04 22:40:47 dovecot_login authenticator failed for H=(abts-north-static-194.142.160.122.airtelbroadband.in) [117.247.239.202]:47174: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.217.120
country_id: 6252001
description:
Jan  4 22:46:26 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.65.217.120, lip=66.85.158.91, session=<PAZBGpNHEIIUQdl4>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.136.113.72
country_id: 2264397
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 193.136.113.72 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 22:52:07 host2 sshd[3700757]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 51.83.164.92
country_id: 3017382
description:
Jan  4 22:51:41 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=51.83.164.92, lip=66.85.158.91, session=<MhsKLZNHquUzU6Rc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 22:55:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<kjO+OJNHSsuOq2dI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2026-01-04 22:55:54 dovecot_plain authenticator failed for H=(fitize) [102.53.15.180]:51883: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  4 22:56:47 host2 sshd[3705953]: Disconnected from invalid user admin 2.57.121.112 port 26187 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 22:57:49 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<XmfdQpNHMFIjupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.171.28.177
country_id: 6252001
description:
Jan  4 22:58:09 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.171.28.177, lip=66.85.158.92, session=<iC8vRJNHqLIUqxyx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.190.40
country_id: 2542007
description:
2026-01-04 23:01:15 dovecot_plain authenticator failed for H=(bacal) [105.73.190.40]:36552: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 23:03:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<AT4RWJNHKKVA46ZK>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.104
country_id: 6252001
description:
Jan  4 23:06:01 host2 pure-ftpd[3715754]: (?@198.235.24.104) [INFO] New connection from 198.235.24.104


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 23:06:32 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<lsH9YZNHXN5nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.154
country_id: 3865483
description:
Jan  4 23:06:36 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=179.0.250.154, lip=66.85.158.91, TLS, session=<oQ03YZNHOcOzAPqa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.146.167
country_id: 99237
description:
Jan  4 23:06:54 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<charanaw>, method=PLAIN, rip=65.20.146.167, lip=66.85.158.91, TLS, session=<wDFyYpNHZ+lBFJKn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-04 23:08:44 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (unwei) [87.103.126.54]:49761: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.229.6
country_id: 149590
description:
2026-01-04 23:10:58 dovecot_login authenticator failed for H=([41.59.229.6]) [41.59.229.6]:33474: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 23:11:51 host2 sshd[3722174]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.216.66
country_id: 1269750
description:
2026-01-04 23:11:59 dovecot_login authenticator failed for H=([182.66.234.193]) [125.19.216.66]:53320: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.27.76.210
country_id: 3469034
description:
2026-01-04 23:12:17 dovecot_login authenticator failed for H=([187.8.89.120]) [177.27.76.210]:32807: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 23:12:32 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<oNR9d5NHzDKuijvy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.113
country_id: 6252001
description:
Jan  4 23:16:08 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 14 secs): user=<>, rip=162.216.150.113, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<gHNyhJNHrMui2JZx>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.113
country_id: 6252001
description:
Jan  4 23:17:49 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=162.216.150.113, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=</3h6ipNHiOCi2JZx>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.181.104
country_id: 6252001
description:
Jan  4 23:19:40 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 1 secs): user=<>, rip=45.79.181.104, lip=66.85.158.91, session=<8J0UkZNHwJwtT7Vo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.105.128.12
country_id: 6252001
description:
Jan  4 23:19:40 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.105.128.12, lip=66.85.158.92, session=<KKYakZNHNpesaYAM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.157.219.158
country_id: 6252001
description:
2026-01-04 23:21:22 dovecot_plain authenticator failed for H=c-76-157-219-158.hsd1.il.comcast.net (litingis) [76.157.219.158]:49612: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.113
country_id: 6252001
description:
Jan  4 23:23:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=162.216.150.113, lip=66.85.158.92, TLS, session=<mv9HoJNHIP2i2JZx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  4 23:28:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<u0YasJNHQt2Oq2dI>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  4 23:29:12 host2 pure-ftpd[3740441]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  4 23:32:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<9eXpvpNHJHAjupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.225
country_id: 2635167
description:
Jan  4 23:35:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=35.203.210.225, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<6Dp3yJNHX84jy9Lh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.100.208.88
country_id: 1819730
description:
Jan  4 23:39:48 host2 sshd[3753499]: Disconnected from invalid user claude 103.100.208.88 port 41255 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.72.204
country_id: 2661886
description:
2026-01-04 23:40:04 dovecot_login authenticator failed for H=h-155-4-72-204.a192.priv.bahnhof.se [155.4.72.204]:47588: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.8.118.24
country_id: 1269750
description:
Jan  4 23:40:17 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@jrdc.lk>, method=PLAIN, rip=103.8.118.24, lip=66.85.158.91, TLS, session=<Y32d2ZNHiKNnCHYY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.164
country_id: 3865483
description:
Jan  4 23:40:26 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@jrdc.lk>, method=PLAIN, rip=179.0.251.164, lip=66.85.158.91, TLS, session=<wuc62pNHH8izAPuk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.107.195
country_id: 3469034
description:
Jan  4 23:40:39 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=191.53.107.195, lip=66.85.158.91, TLS, session=<eTX12pNH5cy/NWvD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 154.127.43.4
country_id: 2395170
description:
Jan  4 23:40:47 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=154.127.43.4, lip=66.85.158.91, TLS, session=<OJaF25NHm5yafysE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.150.101.190
country_id: 798544
description:
Jan  4 23:40:13 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@jrdc.lk>, method=PLAIN, rip=194.150.101.190, lip=66.85.158.91, TLS, session=<rMGS2ZNH88fClmW+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.28.190.210
country_id: 2510769
description:
Jan  4 23:40:12 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@jrdc.lk>, method=PLAIN, rip=139.28.190.210, lip=66.85.158.91, TLS, session=<dKSP2ZNHJdiLHL7S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.53.165.249
country_id: 3469034
description:
Jan  4 23:40:18 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@jrdc.lk>, method=PLAIN, rip=177.53.165.249, lip=66.85.158.91, TLS, session=<MwSr2ZNHR+2xNaX5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.86.130
country_id: 1269750
description:
2026-01-04 23:40:25 dovecot_login authenticator failed for H=(nsg-static-130.86.76.182-airtel.com) [182.76.86.130]:57820: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.0.171.73
country_id: 298795
description:
Jan  4 23:40:36 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=95.0.171.73, lip=66.85.158.91, TLS, session=<AN302pNHytJfAKtJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.239.11.219
country_id: 617790
description:
Jan  4 23:40:30 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=91.239.11.219, lip=66.85.158.91, TLS, session=<La6j2pNHmglb7wvb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  4 23:40:40 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<GDIW3JNHUuJA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.128.210
country_id: 99237
description:
Jan  4 23:40:42 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info>, method=PLAIN, rip=65.20.128.210, lip=66.85.158.91, TLS, session=<1Dj82pNHmadBFIDS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.100.208.88
country_id: 1819730
description:
Jan  4 23:41:42 host2 sshd[3756581]: Disconnected from invalid user yaya 103.100.208.88 port 56189 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.100.208.88
country_id: 1819730
description:
Jan  4 23:42:22 host2 sshd[3757458]: Disconnected from invalid user mcserver 103.100.208.88 port 34316 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  4 23:42:34 host2 sshd[3757700]: Disconnected from invalid user user 2.57.121.25 port 34577 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.225
country_id: 2635167
description:
Jan  4 23:42:59 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.225, lip=66.85.158.91, TLS, session=<bWyF5JNH5uEjy9Lh>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 23:46:21 host2 sshd[3762852]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  4 23:46:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<hya/75NHBshnmud6>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 23:47:14 host2 sshd[3763777]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  4 23:47:39 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<zgEX9ZNHOPKuijvy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.156.80.11
country_id: 1269750
description:
2026-01-04 23:53:00 dovecot_login authenticator failed for H=([182.156.80.11]) [182.156.80.11]:48750: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.170.26.169
country_id: 2077456
description:
2026-01-04 23:53:22 dovecot_login authenticator failed for H=(124-170-26-169.tpgi.com.au) [124.170.26.169]:37313: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  4 23:54:49 host2 sshd[3772837]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 183.82.126.193
country_id: 1269750
description:
Jan  5 00:00:39 host2 sshd[3780045]: Disconnected from invalid user steam 183.82.126.193 port 57150 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 183.82.126.193
country_id: 1269750
description:
Jan  5 00:01:17 host2 sshd[3780863]: Disconnected from invalid user ali 183.82.126.193 port 42304 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 00:01:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<1s1dJ5RHnM6Oq2dI>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 183.82.126.193
country_id: 1269750
description:
Jan  5 00:03:08 host2 sshd[3782876]: Disconnected from invalid user claude 183.82.126.193 port 54238 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 183.82.126.193
country_id: 1269750
description:
Jan  5 00:02:31 host2 sshd[3782039]: Disconnected from invalid user oracle 183.82.126.193 port 40846 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.140.19.22
country_id: 1269750
description:
Jan  5 00:03:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=103.140.19.22, lip=66.85.158.91, session=<blKbLJRHHr1njBMW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  5 00:07:37 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<20d6PJRH/H0jupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  5 00:11:35 host2 sshd[3793257]: Disconnected from invalid user admin 2.57.121.112 port 47087 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  5 00:18:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<hAyTYZRHlLNA46ZK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.79
country_id: 6252001
description:
Jan  5 00:18:28 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.132.79, lip=66.85.158.91, TLS, session=<m8ddY5RH0OaTuYRP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  5 00:22:49 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<IaTXcpRHdF+uijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  5 00:25:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<S3Pte5RHgo5nmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.0.120.211
country_id: 226074
description:
Jan  5 00:25:42 host2 sshd[3810320]: Disconnected from invalid user ftp1 196.0.120.211 port 33920 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.39.201.205
country_id: 2510769
description:
Jan  5 00:26:25 host2 sshd[3811050]: Disconnected from invalid user hadoop 95.39.201.205 port 52854 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2026-01-05 00:28:51 dovecot_plain authenticator failed for H=c-73-197-194-98.hsd1.nj.comcast.net (foredom) [73.197.194.98]:35794: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2026-01-05 00:28:47 dovecot_plain authenticator failed for H=c-24-23-125-83.hsd1.pa.comcast.net (sisener) [24.23.125.83]:51486: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.0.120.211
country_id: 226074
description:
Jan  5 00:29:38 host2 sshd[3814293]: Disconnected from invalid user claude 196.0.120.211 port 34132 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.53.236.155
country_id: 1168579
description:
Jan  5 00:29:40 host2 sshd[3814323]: Disconnected from invalid user claude 101.53.236.155 port 56324 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.39.9.137
country_id: 1168579
description:
Jan  5 00:30:24 host2 sshd[3815285]: Disconnected from invalid user guest2 110.39.9.137 port 38096 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.39.9.137
country_id: 1168579
description:
Jan  5 00:31:39 host2 sshd[3816258]: Disconnected from invalid user claude 110.39.9.137 port 36304 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 110.39.9.137
country_id: 1168579
description:
Jan  5 00:32:19 host2 sshd[3816813]: Disconnected from invalid user claude 110.39.9.137 port 49530 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  5 00:32:53 host2 pure-ftpd[3817332]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2026-01-05 00:33:18 dovecot_plain authenticator failed for H=(adhartal) [176.113.155.132]:41441: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.0.120.211
country_id: 226074
description:
Jan  5 00:33:36 host2 sshd[3817983]: Disconnected from invalid user claude 196.0.120.211 port 47132 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.0.120.211
country_id: 226074
description:
Jan  5 00:34:13 host2 sshd[3818636]: Disconnected from invalid user amir 196.0.120.211 port 58710 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan  5 00:35:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<f67Pn5RHroiOq2dI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.39.201.205
country_id: 2510769
description:
Jan  5 00:35:40 host2 sshd[3820292]: Disconnected from invalid user claude 95.39.201.205 port 49040 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  5 00:38:02 host2 sshd[3822783]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.59.32.88
country_id: 1269750
description:
Jan  5 00:37:39 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=139.59.32.88, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<wUz5p5RHlNaLOyBY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.42.225.40
country_id: 2510769
description:
2026-01-05 00:38:01 dovecot_login authenticator failed for H=40.red-81-42-225.staticip.rima-tde.net [81.42.225.40]:47824: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.39.201.205
country_id: 2510769
description:
Jan  5 00:37:28 host2 sshd[3822133]: Disconnected from invalid user guest 95.39.201.205 port 46464 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.183.103.121
country_id: 2635167
description:
2026-01-05 00:38:10 dovecot_login authenticator failed for H=(185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:51248: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 95.39.201.205
country_id: 2510769
description:
Jan  5 00:38:23 host2 sshd[3823162]: Disconnected from invalid user testftp 95.39.201.205 port 48476 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.249
country_id: 6252001
description:
Jan  5 00:41:04 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.249, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Xpg4tJRHZdTG6xj5>


