# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2025-12-31 16:59:51 dovecot_plain authenticator failed for H=c-67-172-54-29.hsd1.pa.comcast.net (unhaedae) [67.172.54.29]:58420: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.149.154.117
country_id: 6252001
description:
[2025-12-31 16:59:26 +0530] info [cpaneld] 73.149.154.117 - datae "GET /login/?login_only=1&user=datae&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user datae (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.36.62.62
country_id: 6252001
description:
[2025-12-31 16:59:28 +0530] info [cpaneld] 69.36.62.62 - dat "GET /login/?login_only=1&user=dat&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dat (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 31 16:59:24 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<G0SuyT1HXoFCdMzo>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 131.241.17.19
country_id: 6252001
description:
[2025-12-31 16:59:27 +0530] info [cpaneld] 131.241.17.19 - data "GET /login/?login_only=1&user=data&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user data (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.74.112.107
country_id: 6252001
description:
[2025-12-31 16:59:24 +0530] info [cpaneld] 108.74.112.107 - dataesi "GET /login/?login_only=1&user=dataesi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dataesi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.147.124.209
country_id: 6252001
description:
[2025-12-31 16:59:25 +0530] info [cpaneld] 216.147.124.209 - dataes "GET /login/?login_only=1&user=dataes&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dataes (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.27.94
country_id: 1643084
description:
Dec 31 17:00:11 host2 sshd[1310655]: Disconnected from invalid user tempuser 103.179.27.94 port 52114 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.203.222.206
country_id: 192950
description:
Dec 31 17:02:17 host2 sshd[1313470]: Invalid user secondcoffeeinternational from 41.203.222.206 port 17717


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 31 17:02:18 host2 pure-ftpd[1313509]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.2.255
country_id: 690791
description:
Dec 31 17:03:25 host2 dovecot[988630]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=176.103.2.255, lip=66.85.158.91, TLS, session=<5Xb31j1HMaKwZwL/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 149.34.211.132
country_id: 298795
description:
Dec 31 17:03:48 host2 dovecot[988630]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<env_eng>, method=PLAIN, rip=149.34.211.132, lip=66.85.158.91, TLS, session=<NY9X2D1HrYmVItOE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 31 17:04:16 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<oMIa2z1Hmo2eRdGr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.89.154.59
country_id: 285570
description:
Dec 31 17:04:18 host2 sshd[1316303]: Disconnected from invalid user actions 78.89.154.59 port 41550 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.89.154.59
country_id: 285570
description:
Dec 31 17:05:09 host2 sshd[1317464]: Disconnected from invalid user test 78.89.154.59 port 59140 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 78.89.154.59
country_id: 285570
description:
Dec 31 17:06:00 host2 sshd[1318503]: Disconnected from invalid user saeed 78.89.154.59 port 34456 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 31 17:06:54 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<lpOG5D1HpNSYNcU1>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.61.162.164
country_id: 6252001
description:
[2025-12-31 17:07:54 +0530] info [cpaneld] 24.61.162.164 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.133.156.55
country_id: 6252001
description:
[2025-12-31 17:07:55 +0530] info [whostmgrd] 76.133.156.55 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.18.84.80
country_id: 6252001
description:
[2025-12-31 17:07:56 +0530] info [cpaneld] 38.18.84.80 - bostonlankacom "GET /login/?login_only=1&user=bostonlankacom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bostonlankacom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.113.147.36
country_id: 6252001
description:
[2025-12-31 17:07:57 +0530] info [cpaneld] 69.113.147.36 - bostonla "GET /login/?login_only=1&user=bostonla&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bostonla (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.102.186.249
country_id: 6252001
description:
[2025-12-31 17:08:06 +0530] info [cpaneld] 75.102.186.249 - bo "GET /login/?login_only=1&user=bo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.168.17.224
country_id: 6252001
description:
[2025-12-31 17:07:58 +0530] info [cpaneld] 174.168.17.224 - bostonl "GET /login/?login_only=1&user=bostonl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bostonl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.16.126.10
country_id: 6252001
description:
[2025-12-31 17:08:01 +0530] info [cpaneld] 108.16.126.10 - bosto "GET /login/?login_only=1&user=bosto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bosto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.175.189.238
country_id: 6252001
description:
[2025-12-31 17:08:01 +0530] info [cpaneld] 108.175.189.238 - boston "GET /login/?login_only=1&user=boston&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user boston (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.19.2.91
country_id: 6252001
description:
[2025-12-31 17:08:02 +0530] info [cpaneld] 70.19.2.91 - bost "GET /login/?login_only=1&user=bost&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bost (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.27.37
country_id: 6252001
description:
[2025-12-31 17:07:53 +0530] info [cpaneld] 98.97.27.37 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.153.208.233
country_id: 6252001
description:
[2025-12-31 17:07:55 +0530] info [cpaneld] 76.153.208.233 - bostonlanka "GET /login/?login_only=1&user=bostonlanka&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.218.58.228
country_id: 6252001
description:
[2025-12-31 17:08:05 +0530] info [cpaneld] 66.218.58.228 - bos "GET /login/?login_only=1&user=bos&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bos (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.93.125.53
country_id: 6252001
description:
[2025-12-31 17:08:08 +0530] info [cpaneld] 64.93.125.53 - bostonl1 "GET /login/?login_only=1&user=bostonl1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bostonl1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.176.121.119
country_id: 6252001
description:
[2025-12-31 17:08:09 +0530] info [cpaneld] 184.176.121.119 - bostonl2 "GET /login/?login_only=1&user=bostonl2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bostonl2 (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.89.154.59
country_id: 285570
description:
Dec 31 17:08:30 host2 sshd[1321624]: Disconnected from invalid user mahdi 78.89.154.59 port 49412 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 31 17:10:21 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: Connection closed, session=<CRP88D1HiO0DiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 31 17:11:42 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: Connection closed, session=<MrvQ9T1H3NADiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 31 17:13:44 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<BmgP/T1HEqwDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-31 17:13:47 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:56609: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 31 17:14:25 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<edCG/z1HzO0DiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 31 17:15:56 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<4i/HBD5HWSFniu0S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 31 17:15:46 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS, session=<GbJSBD5HutMDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 31 17:16:29 host2 dovecot[988630]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS, session=<wk/qBj5HBIYDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 31 17:17:15 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<MpqpCT5HFMMDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 31 17:18:17 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: Connection closed, session=<JMxRDT5HCuoDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 31 17:19:23 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS, session=<HDZEET5HLsUDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.133.156.119
country_id: 294640
description:
2025-12-31 17:19:45 dovecot_plain authenticator failed for H=(untie) [195.133.156.119]:39933: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 31 17:20:29 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<WGkTFT5Haq2eRdGr>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.165.223
country_id: 6252001
description:
[2025-12-31 17:23:30 +0530] info [cpaneld] 98.97.165.223 - kamecho "GET /login/?login_only=1&user=kamecho&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kamecho (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.215.3.25
country_id: 6252001
description:
[2025-12-31 17:23:36 +0530] info [cpaneld] 134.215.3.25 - kamec "GET /login/?login_only=1&user=kamec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kamec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.5.29.31
country_id: 6252001
description:
[2025-12-31 17:23:37 +0530] info [cpaneld] 104.5.29.31 - kame "GET /login/?login_only=1&user=kame&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kame (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.95.125.176
country_id: 6252001
description:
[2025-12-31 17:23:39 +0530] info [cpaneld] 68.95.125.176 - ka "GET /login/?login_only=1&user=ka&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ka (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.8.161.240
country_id: 6252001
description:
[2025-12-31 17:23:38 +0530] info [cpaneld] 99.8.161.240 - kam "GET /login/?login_only=1&user=kam&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kam (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.130.124.9
country_id: 6252001
description:
[2025-12-31 17:23:29 +0530] info [cpaneld] 174.130.124.9 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.25.56.26
country_id: 6252001
description:
[2025-12-31 17:23:28 +0530] info [cpaneld] 216.25.56.26 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.115.197.29
country_id: 6252001
description:
[2025-12-31 17:23:31 +0530] info [whostmgrd] 24.115.197.29 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.228.45.177
country_id: 6252001
description:
[2025-12-31 17:23:32 +0530] info [cpaneld] 129.228.45.177 - kamecholk "GET /login/?login_only=1&user=kamecholk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kamecholk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.151.19.144
country_id: 6252001
description:
[2025-12-31 17:23:35 +0530] info [cpaneld] 99.151.19.144 - kamech "GET /login/?login_only=1&user=kamech&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kamech (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.76.142
country_id: 1269750
description:
2025-12-31 17:26:25 dovecot_login authenticator failed for H=([128.185.213.82]) [182.78.76.142]:42822: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.183.221.168
country_id: 6252001
description:
2025-12-31 17:26:42 dovecot_login authenticator failed for H=wsip-70-183-221-168.br.br.cox.net [70.183.221.168]:51105: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.104.53
country_id: 6252001
description:
Dec 31 17:26:23 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.64.104.53, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<R8ZLKj5HRLkUQGg1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 17:28:52 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<Qn4WMz5H2rov/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 17:29:18 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<YBCWND5HNJIjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 17:29:22 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<3fbZND5HjICeRdY+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.227.99.216
country_id: 6252001
description:
Dec 31 17:29:54 host2 pure-ftpd[1349549]: (?@64.227.99.216) [INFO] New connection from 64.227.99.216


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.227.39.158
country_id: 6251999
description:
Dec 31 17:30:06 host2 pure-ftpd[1349948]: (?@165.227.39.158) [INFO] New connection from 165.227.39.158


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2025-12-31 17:32:03 dovecot_plain authenticator failed for H=c-73-195-211-98.hsd1.nj.comcast.net (shably) [73.195.211.98]:42702: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.80.105.86
country_id: 6252001
description:
Dec 31 17:35:10 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.80.105.86, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<HpO9ST5H3ukUUGlW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 31 17:37:48 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<8w8FUz5HoHdo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 17:37:37 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<S/tWUj5HdJMzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 31 17:39:16 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<d/A6WD5Hrft100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.44.137.176
country_id: 798549
description:
Dec 31 17:39:34 host2 sshd[1362277]: Disconnected from invalid user informix 89.44.137.176 port 54990 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.44.137.176
country_id: 798549
description:
Dec 31 17:40:38 host2 sshd[1363819]: Disconnected from invalid user www-upload 89.44.137.176 port 44578 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 89.44.137.176
country_id: 798549
description:
Dec 31 17:41:12 host2 sshd[1364670]: Disconnected from invalid user nate 89.44.137.176 port 56758 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 31 17:41:48 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<EzxLYT5HuMNn9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.44.137.176
country_id: 798549
description:
Dec 31 17:42:20 host2 sshd[1366247]: Disconnected from invalid user m1 89.44.137.176 port 52948 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 17:42:31 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<gEvfYz5H5uszTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 17:45:03 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<Szv3bD5HljojupN+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 40.124.175.103
country_id: 6252001
description:
Dec 31 17:44:31 host2 pure-ftpd[1369043]: (?@40.124.175.103) [INFO] New connection from 40.124.175.103


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 31 17:44:55 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<PJlTbD5HwKwyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 31 17:45:53 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<mRPxbz5HXrKi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 17:47:51 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<YDzzdj5HGoGeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 31 17:48:25 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<Lh33eD5HlI+i8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.241.132.152
country_id: 1269750
description:
2025-12-31 17:48:29 dovecot_login authenticator failed for H=(static.ill.117.248.107.130.bsnl.co.in) [43.241.132.152]:49054: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.192.166
country_id: 1269750
description:
2025-12-31 17:48:12 dovecot_login authenticator failed for H=(aes-static-025.20.22.125.airtel.in) [128.185.192.166]:34394: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 17:52:45 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<6tl7iD5H6MYv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 31 17:54:06 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<Yl1KjT5Hkr5nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 31 17:58:33 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<SEsvnT5HRt0vWBNS>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.87.55.116
country_id: 6252001
description:
[2025-12-31 18:01:00 +0530] info [cpaneld] 65.87.55.116 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.186.210.125
country_id: 6252001
description:
[2025-12-31 18:01:00 +0530] info [cpaneld] 66.186.210.125 - absolutehomecarenb "GET /login/?login_only=1&user=absolutehomecarenb&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user absolutehomecarenb (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.127.216.25
country_id: 6252001
description:
[2025-12-31 18:01:03 +0530] info [cpaneld] 73.127.216.25 - absolutehomecarenbca "GET /login/?login_only=1&user=absolutehomecarenbca&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user absolutehomecarenbca (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.6.27.55
country_id: 6252001
description:
[2025-12-31 18:01:05 +0530] info [cpaneld] 99.6.27.55 - absolut "GET /login/?login_only=1&user=absolut&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user absolut (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.201.214.176
country_id: 6252001
description:
[2025-12-31 18:01:04 +0530] info [cpaneld] 72.201.214.176 - absolute "GET /login/?login_only=1&user=absolute&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.194.84.158
country_id: 6252001
description:
[2025-12-31 18:00:59 +0530] info [cpaneld] 162.194.84.158 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.130.126.218
country_id: 6252001
description:
[2025-12-31 18:01:02 +0530] info [whostmgrd] 69.130.126.218 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 199.47.250.147
country_id: 6252001
description:
[2025-12-31 18:01:12 +0530] info [cpaneld] 199.47.250.147 - ab "GET /login/?login_only=1&user=ab&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ab (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.170.33.137
country_id: 6252001
description:
[2025-12-31 18:01:13 +0530] info [cpaneld] 70.170.33.137 - absolut1 "GET /login/?login_only=1&user=absolut1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user absolut1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.71.214.209
country_id: 6252001
description:
[2025-12-31 18:01:06 +0530] info [cpaneld] 75.71.214.209 - absolu "GET /login/?login_only=1&user=absolu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user absolu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.23.76.115
country_id: 6252001
description:
[2025-12-31 18:01:09 +0530] info [cpaneld] 165.23.76.115 - abso "GET /login/?login_only=1&user=abso&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user abso (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.117.20.244
country_id: 6252001
description:
[2025-12-31 18:01:10 +0530] info [cpaneld] 23.117.20.244 - abs "GET /login/?login_only=1&user=abs&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user abs (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.156.111.194
country_id: 6252001
description:
[2025-12-31 18:01:14 +0530] info [cpaneld] 24.156.111.194 - absolut2 "GET /login/?login_only=1&user=absolut2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user absolut2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.92.144.148
country_id: 6252001
description:
[2025-12-31 18:01:08 +0530] info [cpaneld] 73.92.144.148 - absol "GET /login/?login_only=1&user=absol&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user absol (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2025-12-31 18:02:40 dovecot_plain authenticator failed for H=(lagis) [65.20.205.197]:55939: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2025-12-31 18:03:39 dovecot_plain authenticator failed for H=(deringuse) [176.113.155.132]:55303: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.27
country_id: 3144096
description:
2025-12-31 18:04:08 dovecot_login authenticator failed for H=([84.213.189.27]) [84.213.189.27]:48000: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 31 18:04:12 host2 sshd[1394819]: Disconnected from invalid user admin 2.57.121.112 port 61839 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.249
country_id: 1168579
description:
2025-12-31 18:04:53 dovecot_login authenticator failed for H=(249.92.zcomnetworks.com.pk) [103.148.92.249]:42658: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.210.93.132
country_id: 6252001
description:
[2025-12-31 18:05:36 +0530] info [whostmgrd] 108.210.93.132 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.218.220.70
country_id: 6252001
description:
[2025-12-31 18:05:41 +0530] info [cpaneld] 104.218.220.70 - seyaw "GET /login/?login_only=1&user=seyaw&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user seyaw (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.7.70.48
country_id: 6252001
description:
[2025-12-31 18:05:42 +0530] info [cpaneld] 71.7.70.48 - seya "GET /login/?login_only=1&user=seya&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user seya (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.93.118.81
country_id: 6252001
description:
[2025-12-31 18:05:44 +0530] info [cpaneld] 72.93.118.81 - se "GET /login/?login_only=1&user=se&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user se (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.12.6.98
country_id: 6252001
description:
[2025-12-31 18:05:32 +0530] info [cpaneld] 104.12.6.98 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.216.39.136
country_id: 6252001
description:
[2025-12-31 18:05:36 +0530] info [cpaneld] 73.216.39.136 - seyawin "GET /login/?login_only=1&user=seyawin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user seyawin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.4.187.17
country_id: 6252001
description:
[2025-12-31 18:05:38 +0530] info [cpaneld] 75.4.187.17 - seyawincom "GET /login/?login_only=1&user=seyawincom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user seyawincom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.167.196
country_id: 6252001
description:
[2025-12-31 18:05:39 +0530] info [cpaneld] 172.56.167.196 - seyawi "GET /login/?login_only=1&user=seyawi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user seyawi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.169.53.20
country_id: 6252001
description:
[2025-12-31 18:05:43 +0530] info [cpaneld] 73.169.53.20 - sey "GET /login/?login_only=1&user=sey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sey (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 31 18:05:23 host2 pure-ftpd[1396546]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.43.71.191
country_id: 6252001
description:
[2025-12-31 18:05:34 +0530] info [cpaneld] 149.43.71.191 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 31 18:06:58 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<+jlIuz5HXJpCdMzo>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 31 18:11:53 host2 sshd[1405423]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 31 18:13:40 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<GAQ40z5HfJEFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 31 18:13:53 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<nisJ1D5H9Exniu0S>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.155.204.203
country_id: 1880251
description:
2025-12-31 18:17:44 dovecot_login authenticator failed for H=(124.155.204-203.unknown.starhub.net.sg) [124.155.204.203]:48405: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.108.215.39
country_id: 3469034
description:
2025-12-31 18:18:05 dovecot_login authenticator failed for H=([189.108.215.39]) [189.108.215.39]:58507: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 207.90.244.28
country_id: 6252001
description:
Dec 31 18:21:50 host2 pure-ftpd[1417785]: (?@207.90.244.28) [INFO] New connection from 207.90.244.28


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 207.90.244.28
country_id: 6252001
description:
Dec 31 18:21:47 host2 pure-ftpd[1417732]: (?@207.90.244.28) [INFO] New connection from 207.90.244.28


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.252.209.165
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 73.252.209.165 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.50.174
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 172.59.50.174 - gemtrail "GET /login/?login_only=1&user=gemtrail&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gemtrail (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.186.159.11
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 67.186.159.11 - gemtr "GET /login/?login_only=1&user=gemtr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gemtr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.31.27.34
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 45.31.27.34 - gemtra "GET /login/?login_only=1&user=gemtra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gemtra (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 18:28:34 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<rnGSCD9HkNeeRdY+>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.196.96.17
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 107.196.96.17 - gem "GET /login/?login_only=1&user=gem&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gem (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.250.56.227
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 170.250.56.227 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.207.248.70
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 108.207.248.70 - gemtrai "GET /login/?login_only=1&user=gemtrai&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gemtrai (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.48.150.139
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 99.48.150.139 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.105.159.136
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 143.105.159.136 - ge "GET /login/?login_only=1&user=ge&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ge (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.46.78.85
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 73.46.78.85 - gemtrails "GET /login/?login_only=1&user=gemtrails&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.4.252.114
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 24.4.252.114 - gemtrailscom "GET /login/?login_only=1&user=gemtrailscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gemtrailscom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.26.11.20
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 69.26.11.20 - gemt "GET /login/?login_only=1&user=gemt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gemt (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 18:29:47 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<7MDvDD9HfL0jupN+>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.162.41.187
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 73.162.41.187 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.93.50.124
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 73.93.50.124 - melanifinefood "GET /login/?login_only=1&user=melanifinefood&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 204.60.20.196
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 204.60.20.196 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 57.138.137.253
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 57.138.137.253 - me "GET /login/?login_only=1&user=me&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user me (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.99.150.162
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 74.99.150.162 - melanifi "GET /login/?login_only=1&user=melanifi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user melanifi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.25.251.108
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 209.25.251.108 - melanif1 "GET /login/?login_only=1&user=melanif1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user melanif1 (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 31 18:33:08 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<4b7lGD9HKVt100Db>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.49.127.203
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 174.49.127.203 - melanif "GET /login/?login_only=1&user=melanif&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user melanif (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.198.154.178
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 75.198.154.178 - melani "GET /login/?login_only=1&user=melani&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user melani (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.90.210.16
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 66.90.210.16 - melan "GET /login/?login_only=1&user=melan&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user melan (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.154.219.23
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 24.154.219.23 - melanifinefoodcom "GET /login/?login_only=1&user=melanifinefoodcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user melanifinefoodcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.31.223.192
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 45.31.223.192 - mela "GET /login/?login_only=1&user=mela&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mela (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.7.46.104
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 24.7.46.104 - mel "GET /login/?login_only=1&user=mel&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.102.23.231
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 74.102.23.231 - melanif2 "GET /login/?login_only=1&user=melanif2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user melanif2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.65.78.173
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 174.65.78.173 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 31 18:37:40 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<7vAgKT9HgKOYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 18:40:34 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<5FR3Mz9HWoUv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 31 18:41:20 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<ZjY/Nj9HSuhn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 31 18:41:31 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<ncfgNj9HgNyeRdGr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.243.234.23
country_id: 6252001
description:
2025-12-31 18:41:52 dovecot_login authenticator failed for H=c-73-243-234-23.hsd1.co.comcast.net [73.243.234.23]:47578: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 31 18:43:51 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<UVY5Pz9HGOei8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 31 18:45:06 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<OgKyQz9HHlxo7MS0>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 31 18:45:23 host2 sshd[1446500]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 207.90.244.28
country_id: 6252001
description:
Dec 31 18:45:44 host2 pure-ftpd[1446879]: (?@207.90.244.28) [INFO] New connection from 207.90.244.28


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 18:45:43 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<D0HhRT9HFmMjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.237.113.106
country_id: 587116
description:
2025-12-31 18:45:16 dovecot_login authenticator failed for H=([109.237.113.106]) [109.237.113.106]:36979: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 207.90.244.28
country_id: 6252001
description:
Dec 31 18:45:43 host2 pure-ftpd[1446854]: (?@207.90.244.28) [INFO] New connection from 207.90.244.28


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 18:47:10 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<sJYOSz9HXICeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 18:49:09 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<0vwnUj9HWsUzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 79.110.37.179
country_id: 3077311
description:
Dec 31 18:50:59 host2 dovecot[988630]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=79.110.37.179, lip=66.85.158.91, TLS, session=<8hLlVz9Hza5PbiWz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 31 18:50:39 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<ZvuCVz9HiiKi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.230
country_id: 3469034
description:
Dec 31 18:51:21 host2 dovecot[988630]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<charanaw>, method=PLAIN, rip=190.89.137.230, lip=66.85.158.91, TLS, session=<IlP+WD9HDLu+WYnm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 31 18:52:47 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<L0QnXz9HaoRnmud6>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.229.184.123
country_id: 6252001
description:
[2025-12-31 18:53:04 +0530] info [cpaneld] 24.229.184.123 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.131.151
country_id: 6252001
description:
[2025-12-31 18:53:03 +0530] info [cpaneld] 172.59.131.151 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.180.59.199
country_id: 6252001
description:
[2025-12-31 18:53:07 +0530] info [whostmgrd] 98.180.59.199 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.165.5.142
country_id: 6252001
description:
[2025-12-31 18:53:06 +0530] info [cpaneld] 97.165.5.142 - tradeceylon "GET /login/?login_only=1&user=tradeceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.43.9.218
country_id: 6252001
description:
[2025-12-31 18:53:12 +0530] info [cpaneld] 38.43.9.218 - tradec "GET /login/?login_only=1&user=tradec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.235.153.123
country_id: 6252001
description:
[2025-12-31 18:53:14 +0530] info [cpaneld] 73.235.153.123 - trad "GET /login/?login_only=1&user=trad&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trad (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.219.62.43
country_id: 6252001
description:
[2025-12-31 18:53:15 +0530] info [cpaneld] 107.219.62.43 - tra "GET /login/?login_only=1&user=tra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tra (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.193.19.19
country_id: 6252001
description:
[2025-12-31 18:53:08 +0530] info [cpaneld] 71.193.19.19 - tradeceyloncom "GET /login/?login_only=1&user=tradeceyloncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyloncom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.41.78.172
country_id: 6252001
description:
[2025-12-31 18:53:10 +0530] info [cpaneld] 73.41.78.172 - tradecey "GET /login/?login_only=1&user=tradecey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradecey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.227.220.190
country_id: 6252001
description:
[2025-12-31 18:53:13 +0530] info [cpaneld] 50.227.220.190 - trade "GET /login/?login_only=1&user=trade&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trade (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.206.19.162
country_id: 6252001
description:
[2025-12-31 18:53:16 +0530] info [cpaneld] 107.206.19.162 - tr "GET /login/?login_only=1&user=tr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.187.1.100
country_id: 6252001
description:
[2025-12-31 18:53:18 +0530] info [cpaneld] 173.187.1.100 - tradece2 "GET /login/?login_only=1&user=tradece2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.37.49.240
country_id: 6252001
description:
[2025-12-31 18:53:18 +0530] info [cpaneld] 100.37.49.240 - tradece1 "GET /login/?login_only=1&user=tradece1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece1 (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 18:54:04 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<0vTJYz9HaJIzTcpt>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.22.195.31
country_id: 6252001
description:
[2025-12-31 18:53:11 +0530] info [cpaneld] 134.22.195.31 - tradece "GET /login/?login_only=1&user=tradece&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 31 18:57:58 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<zVOycT9HKuqeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 31 19:00:50 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<btTsez9HOpoyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 19:04:25 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<3GfEiD9H3tIv/AU1>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 31 19:08:33 host2 pure-ftpd[1475639]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 31 19:11:01 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<hBFdoD9Hyg5niu0S>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.129.57.71
country_id: 6252001
description:
2025-12-31 19:12:07 dovecot_plain authenticator failed for H=c-73-129-57-71.hsd1.md.comcast.net (pance) [73.129.57.71]:36718: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 31 19:15:26 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<D34nsD9Hop1CdMzo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.186
country_id: 3144096
description:
2025-12-31 19:17:36 dovecot_login authenticator failed for H=(186-161-97-62.cust.smartcall.no) [62.97.161.186]:45273: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.182.65.40
country_id: 3017382
description:
2025-12-31 19:17:48 dovecot_login authenticator failed for H=40.ip-217-182-65.eu [217.182.65.40]:55282: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 31 19:18:35 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<VWxyuz9H+OUvWBNS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-31 19:19:10 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (moustobed) [87.103.126.54]:54204: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.155.38.219
country_id: 3469034
description:
Dec 31 19:19:23 host2 sshd[1489292]: Disconnected from invalid user croceiris 200.155.38.219 port 39476 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.203.21.122
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 76.203.21.122 - tfab "GET /login/?login_only=1&user=tfab&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tfab (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.54.128.223
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 108.54.128.223 - tfa "GET /login/?login_only=1&user=tfa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tfa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.159.151.106
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 72.159.151.106 - tf "GET /login/?login_only=1&user=tf&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tf (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.81.162
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 172.56.81.162 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.202.194.92
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 107.202.194.92 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.70.11.188
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 173.70.11.188 - tfablk "GET /login/?login_only=1&user=tfablk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.155.38.219
country_id: 3469034
description:
Dec 31 19:20:10 host2 sshd[1490446]: Disconnected from invalid user suporte 200.155.38.219 port 29651 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.167.108.242
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 73.167.108.242 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.155.38.219
country_id: 3469034
description:
Dec 31 19:21:48 host2 sshd[1492511]: Disconnected from invalid user db2inst1 200.155.38.219 port 10295 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 31 19:26:19 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<vdgT1z9HmwN100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 19:27:21 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<f8fO2j9HCtqeRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2025-12-31 19:29:15 dovecot_plain authenticator failed for H=c-24-15-216-41.hsd1.il.comcast.net (osadiance) [24.15.216.41]:47262: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 19:30:00 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<e+ZC5D9HHIMjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 31 19:32:33 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<3pBj7T9HmuIFhXlo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-31 19:32:47 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (valial) [87.103.126.54]:26615: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.248.242.186
country_id: 2921044
description:
Dec 31 19:39:17 host2 sshd[1514090]: Disconnected from invalid user rafael 195.248.242.186 port 59392 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 31 19:40:50 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<SzMEC0BH/oln9M4G>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.241.80.141
country_id: 1814991
description:
Dec 31 19:41:26 host2 dovecot[988630]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=188.241.80.141, lip=66.85.158.91, TLS, session=<NIRNDUBHesW88VCN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.102.232.93
country_id: 3057568
description:
Dec 31 19:41:26 host2 dovecot[988630]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=149.102.232.93, lip=66.85.158.91, TLS handshaking: Connection closed, session=<xvdMDUBHasWVZuhd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 31 19:41:52 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<seixDkBHFLCi8GQy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.248.242.186
country_id: 2921044
description:
Dec 31 19:42:36 host2 sshd[1517899]: Disconnected from invalid user ankit 195.248.242.186 port 55120 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 195.248.242.186
country_id: 2921044
description:
Dec 31 19:43:09 host2 sshd[1518425]: Disconnected from invalid user werkstatt 195.248.242.186 port 35330 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.248.242.186
country_id: 2921044
description:
Dec 31 19:44:12 host2 sshd[1519505]: Disconnected from invalid user customer 195.248.242.186 port 36224 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 19:45:20 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<x1UeG0BHhrWeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 19:45:22 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<hto9G0BH/FYjupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.122
country_id: 6252001
description:
Dec 31 19:48:31 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.122, lip=66.85.158.91, TLS handshaking: Connection closed, session=<sbuZJkBHYrpChJl6>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.94.146.48
country_id: 6252001
description:
Dec 31 19:51:11 host2 pure-ftpd[1528653]: (?@167.94.146.48) [INFO] New connection from 167.94.146.48


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 31 19:51:38 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<gbmgMUBH8uhnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 31 19:52:34 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<GSv4NEBHdqJo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 19:52:24 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<UtFjNEBH/tgv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 31 19:52:26 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<z02DNEBHjHyi8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.176.34.117
country_id: 1269750
description:
2025-12-31 19:54:55 dovecot_plain authenticator failed for H=(P1G39) [123.176.34.117]:51603: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.61.82.50
country_id: 6252001
description:
[2025-12-31 19:57:35 +0530] info [cpaneld] 24.61.82.50 - millenn1 "GET /login/?login_only=1&user=millenn1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user millenn1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 204.57.19.3
country_id: 6252001
description:
[2025-12-31 19:57:23 +0530] info [cpaneld] 204.57.19.3 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.23.200.252
country_id: 6252001
description:
[2025-12-31 19:57:28 +0530] info [cpaneld] 73.23.200.252 - millenn "GET /login/?login_only=1&user=millenn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user millenn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.37.160.246
country_id: 6252001
description:
[2025-12-31 19:57:30 +0530] info [cpaneld] 50.37.160.246 - mille "GET /login/?login_only=1&user=mille&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mille (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.215.134.149
country_id: 6252001
description:
[2025-12-31 19:57:25 +0530] info [cpaneld] 69.215.134.149 - millenniumagro "GET /login/?login_only=1&user=millenniumagro&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user millenniumagro (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.71.179.211
country_id: 6252001
description:
[2025-12-31 19:57:33 +0530] info [cpaneld] 209.71.179.211 - mil "GET /login/?login_only=1&user=mil&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mil (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.248.8.67
country_id: 6252001
description:
[2025-12-31 19:57:36 +0530] info [cpaneld] 173.248.8.67 - millenn2 "GET /login/?login_only=1&user=millenn2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user millenn2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.17.145.79
country_id: 6252001
description:
[2025-12-31 19:57:26 +0530] info [whostmgrd] 108.17.145.79 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.115.34.253
country_id: 6252001
description:
[2025-12-31 19:57:29 +0530] info [cpaneld] 98.115.34.253 - millen "GET /login/?login_only=1&user=millen&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user millen (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.20.76.61
country_id: 6252001
description:
[2025-12-31 19:57:34 +0530] info [cpaneld] 99.20.76.61 - mi "GET /login/?login_only=1&user=mi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.48.107.249
country_id: 6252001
description:
[2025-12-31 19:57:26 +0530] info [cpaneld] 108.48.107.249 - millenniumagrolk "GET /login/?login_only=1&user=millenniumagrolk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user millenniumagrolk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.188.214.206
country_id: 6252001
description:
[2025-12-31 19:57:32 +0530] info [cpaneld] 67.188.214.206 - mill "GET /login/?login_only=1&user=mill&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mill (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.121.195.112
country_id: 6252001
description:
[2025-12-31 19:57:24 +0530] info [cpaneld] 23.121.195.112 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.114.136.17
country_id: 6252001
description:
[2025-12-31 19:57:27 +0530] info [cpaneld] 98.114.136.17 - millenni "GET /login/?login_only=1&user=millenni&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user millenni (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 31 19:59:14 host2 sshd[1537604]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 20:01:23 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<KIGFVEBHpJEzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.212.3
country_id: 732800
description:
Dec 31 20:02:50 host2 dovecot[988630]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=185.255.212.3, lip=66.85.158.91, TLS, session=<+WjBWEBH7Om5/9QD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.11.195.107
country_id: 3865483
description:
Dec 31 20:03:11 host2 dovecot[988630]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=190.11.195.107, lip=66.85.158.91, TLS, session=<eJjrWUBHOsK+C8Nr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.212.34.236
country_id: 3895114
description:
Dec 31 20:05:38 host2 sshd[1545585]: Disconnected from invalid user sammy 181.212.34.236 port 33470 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.243.213.125
country_id: 290557
description:
Dec 31 20:05:46 host2 sshd[1545741]: Disconnected from invalid user test 151.243.213.125 port 53956 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.212.34.236
country_id: 3895114
description:
Dec 31 20:06:59 host2 sshd[1547030]: Disconnected from invalid user fts 181.212.34.236 port 42054 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 20:06:19 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<VV0qZkBHbt8zTcpt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.243.213.125
country_id: 290557
description:
Dec 31 20:06:54 host2 sshd[1546910]: Disconnected from invalid user oracle 151.243.213.125 port 44194 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 31 20:06:58 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<UPlraEBHnTxniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.212.34.236
country_id: 3895114
description:
Dec 31 20:07:43 host2 sshd[1547758]: Disconnected from invalid user alien 181.212.34.236 port 47470 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 31 20:07:09 host2 pure-ftpd[1547244]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.243.213.125
country_id: 290557
description:
Dec 31 20:07:28 host2 sshd[1547532]: Disconnected from invalid user syp 151.243.213.125 port 35500 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.212.34.236
country_id: 3895114
description:
Dec 31 20:08:23 host2 sshd[1548458]: Disconnected from invalid user ying 181.212.34.236 port 36302 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.245
country_id: 6252001
description:
Dec 31 20:08:34 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 9 secs): user=<>, rip=162.216.149.245, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<obBObkBHVcii2JX1>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.243.213.125
country_id: 290557
description:
Dec 31 20:08:36 host2 sshd[1548670]: Disconnected from invalid user raja 151.243.213.125 port 56352 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.245
country_id: 6252001
description:
Dec 31 20:09:21 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=162.216.149.245, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<I/kfcUBHnOWi2JX1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2025-12-31 20:09:28 dovecot_plain authenticator failed for H=c-68-40-189-43.hsd1.mi.comcast.net (ownspurper) [68.40.189.43]:43740: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 31 20:10:08 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<xQHGc0BHCoCYNcU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.216.63.127
country_id: 1835841
description:
Dec 31 20:14:36 host2 sshd[1555791]: Disconnected from invalid user marcela 35.216.63.127 port 64724 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.193.177.237
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 107.193.177.237 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.239.206.199
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 75.239.206.199 - essenceceylonteacom "GET /login/?login_only=1&user=essenceceylonteacom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user essenceceylonteacom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.137.80.143
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 107.137.80.143 - essence1 "GET /login/?login_only=1&user=essence1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user essence1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.209.189.103
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 108.209.189.103 - essenceceylontea "GET /login/?login_only=1&user=essenceceylontea&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: User essenceceylontea has their account suspended. Login blocked.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.110.235.186
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 208.110.235.186 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.55.114.137
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 69.55.114.137 - essenc "GET /login/?login_only=1&user=essenc&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user essenc (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.164.117.158
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 184.164.117.158 - es "GET /login/?login_only=1&user=es&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user es (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.245
country_id: 6252001
description:
Dec 31 20:15:52 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.245, lip=66.85.158.92, TLS, session=<4cRtiEBHzOai2JX1>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.251.123.2
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 98.251.123.2 - ess "GET /login/?login_only=1&user=ess&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ess (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.142.96.30
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 73.142.96.30 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.63.16.176
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 71.63.16.176 - essence "GET /login/?login_only=1&user=essence&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user essence (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.222.175.88
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 216.222.175.88 - essencec "GET /login/?login_only=1&user=essencec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user essencec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.130.252.182
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 107.130.252.182 - essen "GET /login/?login_only=1&user=essen&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user essen (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.45.34.16
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 99.45.34.16 - esse "GET /login/?login_only=1&user=esse&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user esse (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.220.100.243
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 24.220.100.243 - essence2 "GET /login/?login_only=1&user=essence2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user essence2 (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.47.217
country_id: 6252001
description:
Dec 31 20:15:09 host2 sshd[1556575]: Disconnected from invalid user demo 209.141.47.217 port 45880 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 20:16:27 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<gSdlikBHAIcv/AU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.245
country_id: 6252001
description:
Dec 31 20:16:11 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.245, lip=66.85.158.92, TLS, session=<gHuNiUBHGP+i2JX1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.255.147.244
country_id: 1269750
description:
Dec 31 20:18:06 host2 sshd[1560351]: Disconnected from invalid user devuser 103.255.147.244 port 49284 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.11.64.145
country_id: 241170
description:
Dec 31 20:17:28 host2 sshd[1559551]: Disconnected from invalid user henry 212.11.64.145 port 48176 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.81.224
country_id: 1880251
description:
Dec 31 20:17:31 host2 sshd[1559594]: Disconnected from invalid user bitrix 154.91.81.224 port 60244 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 31 20:17:33 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<29xWjkBHjKMyBsPO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.248.245.89
country_id: 2921044
description:
Dec 31 20:17:53 host2 sshd[1560050]: Disconnected from invalid user vmuser 104.248.245.89 port 33944 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.131.199
country_id: 1269750
description:
Dec 31 20:18:25 host2 sshd[1560664]: Disconnected from invalid user anna 64.227.131.199 port 54084 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.91.81.224
country_id: 1880251
description:
Dec 31 20:18:11 host2 sshd[1560408]: Disconnected from invalid user testuser 154.91.81.224 port 44456 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 31 20:19:40 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<+ebllUBHS89100Db>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.248.245.89
country_id: 2921044
description:
Dec 31 20:19:56 host2 sshd[1562237]: Disconnected from invalid user admin 104.248.245.89 port 55348 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.47.217
country_id: 6252001
description:
Dec 31 20:20:05 host2 sshd[1562576]: Disconnected from invalid user ftpadmin 209.141.47.217 port 51362 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.81.224
country_id: 1880251
description:
Dec 31 20:20:09 host2 sshd[1562607]: Disconnected from invalid user debian 154.91.81.224 port 52740 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.131.199
country_id: 1269750
description:
Dec 31 20:20:22 host2 sshd[1562885]: Disconnected from invalid user fivem 64.227.131.199 port 48288 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.141.47.217
country_id: 6252001
description:
Dec 31 20:21:15 host2 sshd[1563883]: Disconnected from invalid user gmodserver 209.141.47.217 port 36476 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.81.224
country_id: 1880251
description:
Dec 31 20:21:32 host2 sshd[1564167]: Disconnected from invalid user virt 154.91.81.224 port 48780 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.216.63.127
country_id: 1835841
description:
Dec 31 20:21:38 host2 sshd[1564355]: Disconnected from invalid user noc 35.216.63.127 port 55136 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 31 20:21:09 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<3ZEzm0BHhp6eRdGr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.255.147.244
country_id: 1269750
description:
Dec 31 20:22:38 host2 sshd[1565655]: Disconnected from invalid user anna 103.255.147.244 port 34952 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.53.184.147
country_id: 2782113
description:
Dec 31 20:22:40 host2 sshd[1565723]: Disconnected from invalid user ubuntu 152.53.184.147 port 59534 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.131.199
country_id: 1269750
description:
Dec 31 20:22:51 host2 sshd[1565947]: Disconnected from invalid user ubuntu 64.227.131.199 port 48110 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.95.187
country_id: 1643084
description:
Dec 31 20:22:25 host2 sshd[1565439]: Disconnected from invalid user debian 103.59.95.187 port 51084 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 31 20:23:54 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<upYHpUBHLq1CdMzo>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.139.193.223
country_id: 1643084
description:
Dec 31 20:23:10 host2 sshd[1566436]: Disconnected from invalid user l4d2server 103.139.193.223 port 57560 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.145.147.99
country_id: 290557
description:
Dec 31 20:23:15 host2 sshd[1566676]: Disconnected from invalid user anna 141.145.147.99 port 54404 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.53.184.147
country_id: 2782113
description:
Dec 31 20:23:23 host2 sshd[1566858]: Disconnected from invalid user ms 152.53.184.147 port 60226 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 20:24:35 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<vid2p0BHzpqeRdY+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 141.145.147.99
country_id: 290557
description:
Dec 31 20:25:56 host2 sshd[1570175]: Disconnected from invalid user ubuntu 141.145.147.99 port 48264 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.145.147.99
country_id: 290557
description:
Dec 31 20:25:11 host2 sshd[1569253]: Disconnected from invalid user bot 141.145.147.99 port 55928 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 31 20:27:48 host2 dovecot[988630]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS, session=<pb8Ts0BHcNoDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.206
country_id: 2635167
description:
Dec 31 20:27:54 host2 dovecot[988630]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.206, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<6uJts0BHh5q594nO>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.200
country_id: 2635167
description:
Dec 31 20:27:53 host2 dovecot[988630]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.200, lip=66.85.158.91, TLS, session=<cV5is0BH+dq594nI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2025-12-31 20:28:45 dovecot_login authenticator failed for H=(ip-103-29-185-162.pascalwave.com) [103.29.185.162]:53094: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.183
country_id: 2635167
description:
Dec 31 20:29:00 host2 dovecot[988630]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.183, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<Ubxkt0BHo6BX7LC3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.182
country_id: 2635167
description:
Dec 31 20:28:27 host2 dovecot[988630]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.182, lip=66.85.158.91, TLS handshaking: Connection closed, session=<TS9ptUBH+dG594m2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.67.22
country_id: 1269750
description:
2025-12-31 20:28:31 dovecot_login authenticator failed for H=([182.95.2.9]) [182.78.67.22]:35242: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 20:28:43 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<GSU9tkBHanojupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.202
country_id: 2635167
description:
Dec 31 20:29:33 host2 dovecot[988630]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.202, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<AO1fuUBH86RX7LDK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.216
country_id: 2635167
description:
Dec 31 20:30:07 host2 dovecot[988630]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=185.247.137.216, lip=66.85.158.91, TLS handshaking: Connection closed, session=<60tbu0BHu5a594nY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.206
country_id: 2635167
description:
Dec 31 20:30:40 host2 dovecot[988630]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.206, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<4aZUvUBHR6u594nO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 31 20:30:46 host2 dovecot[988630]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS, session=<ko61vUBHcssDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.196
country_id: 2635167
description:
Dec 31 20:31:13 host2 dovecot[988630]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.196, lip=66.85.158.91, TLS handshaking: Connection closed, session=<h+5Rv0BHa95X7LDE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.208
country_id: 2635167
description:
Dec 31 20:31:46 host2 dovecot[988630]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.208, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<mSxNwUBHqey594nQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.186
country_id: 2635167
description:
Dec 31 20:32:19 host2 dovecot[988630]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.186, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<MIlGw0BHjdRX7LC6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.7
country_id: 2635167
description:
Dec 31 20:32:27 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=35.203.211.7, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<u6W0w0BHoNojy9MH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.207
country_id: 2635167
description:
Dec 31 20:32:53 host2 dovecot[988630]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.207, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<vdRBxUBHwZq594nP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.7
country_id: 2635167
description:
Dec 31 20:33:24 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=35.203.211.7, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<1Xojx0BHNvojy9MH>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 31 20:34:26 host2 sshd[1580703]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.4
country_id: 6252001
description:
Dec 31 20:34:44 host2 dovecot[988630]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=74.82.47.4, lip=66.85.158.92, session=<kovhy0BHzPRKUi8E>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.4
country_id: 6252001
description:
Dec 31 20:35:11 host2 dovecot[988630]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=74.82.47.4, lip=66.85.158.92, session=<IwN+zUBHMHBKUi8E>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 31 20:37:58 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<h/NQ10BHeuueRdGr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-31 20:38:54 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:56000: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 31 20:38:57 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<SQvU2kBHoIAvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 31 20:39:03 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<JB8y20BH9q5n9M4G>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.7
country_id: 2635167
description:
Dec 31 20:39:14 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.7, lip=66.85.158.91, TLS, session=<GIT820BHNu0jy9MH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 31 20:40:09 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<rtIl30BHQqSi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 20:42:26 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<4rpR50BHVtaeRdY+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 223.123.65.63
country_id: 1168579
description:
Dec 31 20:42:40 host2 sshd[1594240]: Disconnected from invalid user devuser 223.123.65.63 port 60264 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 20:44:02 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<9z0P7UBHAJwjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.19.243.145
country_id: 3017382
description:
Dec 31 20:45:12 host2 sshd[1598042]: Disconnected from invalid user ubuntu 162.19.243.145 port 50178 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.145.147.99
country_id: 290557
description:
Dec 31 20:46:11 host2 sshd[1599123]: Disconnected from invalid user fivem 141.145.147.99 port 47258 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.19.243.145
country_id: 3017382
description:
Dec 31 20:47:55 host2 sshd[1601425]: Disconnected from invalid user user 162.19.243.145 port 47780 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 128.199.44.215
country_id: 2750405
description:
Dec 31 20:48:24 host2 dovecot[988630]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=128.199.44.215, lip=66.85.158.92, session=<bc3K/EBHpLqAxyzX>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.19.243.145
country_id: 3017382
description:
Dec 31 20:48:52 host2 sshd[1602777]: Disconnected from invalid user test4 162.19.243.145 port 57286 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.0.63.226
country_id: 3686110
description:
Dec 31 20:49:49 host2 sshd[1603918]: Disconnected from invalid user deploy 190.0.63.226 port 44690 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 162.19.243.145
country_id: 3017382
description:
Dec 31 20:49:55 host2 sshd[1603998]: Received disconnect from 162.19.243.145 port 43358:11: Bye Bye [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 31 20:50:22 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<vLysA0FHNMxnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2025-12-31 20:50:23 dovecot_plain authenticator failed for H=c-98-40-101-10.hsd1.tn.comcast.net (deheline) [98.40.101.10]:35852: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 31 20:51:26 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<5259B0FHNIsFhXlo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.113.105.228
country_id: 1269750
description:
Dec 31 20:51:48 host2 sshd[1606368]: Disconnected from invalid user myuser 103.113.105.228 port 49191 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.64.123.41
country_id: 3895114
description:
Dec 31 20:52:12 host2 sshd[1606881]: Disconnected from invalid user ubuntu 186.64.123.41 port 47541 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.0.63.226
country_id: 3686110
description:
Dec 31 20:52:19 host2 sshd[1607035]: Disconnected from invalid user smart 190.0.63.226 port 35162 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.33.91.226
country_id: 357994
description:
Dec 31 20:52:47 host2 sshd[1607497]: Disconnected from invalid user ubuntu 41.33.91.226 port 36686 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 31 20:53:08 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<YniZDUFHZC2i8Jp9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.124.97.102
country_id: 2245662
description:
Dec 31 20:53:14 host2 sshd[1608007]: Disconnected from invalid user user 154.124.97.102 port 33412 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.19.243.145
country_id: 3017382
description:
Dec 31 20:53:21 host2 sshd[1608119]: Disconnected from invalid user ubuntu 162.19.243.145 port 46254 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.64.123.41
country_id: 3895114
description:
Dec 31 20:55:34 host2 sshd[1611359]: Disconnected from invalid user jack 186.64.123.41 port 43395 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.64.27.145
country_id: 3932488
description:
Dec 31 20:56:09 host2 sshd[1612013]: Disconnected from invalid user rsync 181.64.27.145 port 52172 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.64.123.41
country_id: 3895114
description:
Dec 31 20:56:17 host2 sshd[1612170]: Disconnected from invalid user iksi 186.64.123.41 port 49433 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.64.123.41
country_id: 3895114
description:
Dec 31 20:57:00 host2 sshd[1612965]: Disconnected from invalid user myuser 186.64.123.41 port 55473 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.64.123.41
country_id: 3895114
description:
Dec 31 20:57:44 host2 sshd[1613887]: Disconnected from invalid user casa 186.64.123.41 port 33279 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Dec 31 20:58:20 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.91, TLS: Connection closed, session=<5udOIEFHtueLonHU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.33.91.226
country_id: 357994
description:
Dec 31 20:58:44 host2 sshd[1614971]: Disconnected from invalid user admin1 41.33.91.226 port 45708 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2025-12-31 20:58:55 dovecot_plain authenticator failed for H=(inges) [91.73.188.251]:39962: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.64.27.145
country_id: 3932488
description:
Dec 31 20:58:28 host2 sshd[1614702]: Disconnected from invalid user myuser 181.64.27.145 port 53942 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.113.105.228
country_id: 1269750
description:
Dec 31 20:59:38 host2 sshd[1616054]: Disconnected from invalid user jack 103.113.105.228 port 47746 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.64.27.145
country_id: 3932488
description:
Dec 31 20:59:12 host2 sshd[1615539]: Disconnected from invalid user sftpuser 181.64.27.145 port 47654 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.64.27.145
country_id: 3932488
description:
Dec 31 21:00:35 host2 sshd[1617593]: Disconnected from invalid user admin1 181.64.27.145 port 40176 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.33.91.226
country_id: 357994
description:
Dec 31 21:00:41 host2 sshd[1617701]: Disconnected from invalid user me 41.33.91.226 port 46664 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.113.105.228
country_id: 1269750
description:
Dec 31 21:00:58 host2 sshd[1618054]: Disconnected from invalid user pmf 103.113.105.228 port 53813 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.124.97.102
country_id: 2245662
description:
Dec 31 21:00:18 host2 sshd[1617185]: Disconnected from invalid user arjun 154.124.97.102 port 32789 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.104.30.66
country_id: 6252001
description:
Dec 31 21:01:56 host2 pure-ftpd[1619482]: (?@172.104.30.66) [INFO] New connection from 172.104.30.66


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 31 21:01:59 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<67IzLUFHyHto7MS0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.104.30.66
country_id: 6252001
description:
Dec 31 21:01:46 host2 dovecot[988630]: imap-login: Disconnected: Connection closed (disconnected before auth was ready, waited 0 secs): user=<>, rip=172.104.30.66, lip=66.85.158.91, TLS handshaking: Connection closed, session=<RA6PLEFHxLysaB5C>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.113.105.228
country_id: 1269750
description:
Dec 31 21:02:15 host2 sshd[1619875]: Disconnected from invalid user server 103.113.105.228 port 59785 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 31 21:03:13 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<srWfMUFH7hpniu0S>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.52.119.193
country_id: 6252001
description:
2025-12-31 21:03:24 dovecot_plain authenticator failed for H=c-68-52-119-193.hsd1.tn.comcast.net (nonicong) [68.52.119.193]:46184: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.124.97.102
country_id: 2245662
description:
Dec 31 21:03:30 host2 sshd[1621677]: Disconnected from invalid user test 154.124.97.102 port 51576 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 21:03:55 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<HxkoNEFHgrQv/AU1>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.124.97.102
country_id: 2245662
description:
Dec 31 21:06:47 host2 sshd[1625859]: Disconnected from invalid user ronaldo 154.124.97.102 port 38750 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.46.131.55
country_id: 3865483
description:
Dec 31 21:09:00 host2 sshd[1628415]: Disconnected from invalid user postgres 181.46.131.55 port 36168 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 31 21:10:03 host2 sshd[1629965]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 31 21:10:47 host2 sshd[1631032]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 31 21:10:47 host2 pure-ftpd[1631044]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 31 21:12:05 host2 sshd[1632743]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 21:18:00 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<LniEZkFHeJIzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 21:21:33 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<UIc1c0FHUKeeRdY+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.235
country_id: 6252001
description:
Dec 31 21:27:22 host2 pure-ftpd[1653178]: (?@198.235.24.235) [INFO] New connection from 198.235.24.235


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 21:27:29 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<q9lpiEFHPtQjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 21:27:56 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<vcsGikFHRM4v/AU1>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 130.211.126.21
country_id: 6252001
description:
Dec 31 21:29:38 host2 pure-ftpd[1655602]: (?@130.211.126.21) [INFO] New connection from 130.211.126.21


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.175.201.167
country_id: 3469034
description:
2025-12-31 21:30:47 dovecot_login authenticator failed for H=200.175.201.167.dynamic.dialup.gvt.net.br (corporate.static.gvt.net.br) [200.175.201.167]:60644: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.42.225.40
country_id: 2510769
description:
2025-12-31 21:31:24 dovecot_login authenticator failed for H=40.red-81-42-225.staticip.rima-tde.net [81.42.225.40]:38480: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2025-12-31 21:32:13 dovecot_plain authenticator failed for H=c-71-235-225-181.hsd1.ct.comcast.net (catale) [71.235.225.181]:57310: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 31 21:32:42 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<y74Lm0FHQNtCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 31 21:34:03 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<R4Tun0FH/uAyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 31 21:37:37 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<4OmhrEFHxMtn9M4G>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 95.181.236.131
country_id: 614540
description:
Dec 31 21:38:27 host2 pure-ftpd[1666688]: (?@95.181.236.131) [INFO] New connection from 95.181.236.131


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.90.124.158
country_id: 3042225
description:
Dec 31 21:38:27 host2 pure-ftpd[1666683]: (?@91.90.124.158) [INFO] New connection from 91.90.124.158


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 31 21:38:34 host2 dovecot[988630]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<jPoRsEFHSKyi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 21:39:23 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<ncn1skFHAI+eRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.137
country_id: 3175395
description:
Dec 31 21:39:57 host2 dovecot[1667607]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=185.15.169.137, lip=66.85.158.91, TLS, session=<B5gGtEFH1di5D6mJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.87.117.177
country_id: 3469034
description:
Dec 31 21:40:24 host2 dovecot[1667607]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<charanaw>, method=PLAIN, rip=177.87.117.177, lip=66.85.158.91, TLS, session=<v+yZtUFH5cOxV3Wx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 31 21:42:49 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<6TtAv0FHJJWYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 21:42:57 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<0gu4v0FHbHcjupN+>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 31 21:43:21 host2 sshd[1672873]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.223.231.254
country_id: 2750405
description:
Dec 31 21:46:08 host2 dovecot[1667607]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=159.223.231.254, lip=66.85.158.91, session=<ojg/y0FH8uif3+f+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 31 21:48:57 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<hZUu1UFHauZnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.121.76.190
country_id: 732800
description:
2025-12-31 21:51:31 dovecot_plain authenticator failed for H=(fordial) [87.121.76.190]:34520: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2025-12-31 21:51:43 dovecot_plain authenticator failed for H=c-73-13-220-220.hsd1.de.comcast.net (ulachodef) [73.13.220.220]:41094: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 31 21:53:59 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<kL4w50FHYDWi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 31 21:57:57 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 6 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<yakl9UFHfkdniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 31 21:59:10 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<foe3+UFHMokvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 31 22:01:32 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<WR0xAkJHkNqeRdGr>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 102.204.223.7
country_id: 2328926
description:
Dec 31 22:02:10 host2 pure-ftpd[1707862]: (?@102.204.223.7) [INFO] New connection from 102.204.223.7


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 31 22:07:04 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<ficBFkJHU1N100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 31 22:10:49 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<8dBoI0JHlDlo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 31 22:10:52 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<Y9mMI0JHGJ8FhXlo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2025-12-31 22:12:52 dovecot_plain authenticator failed for H=c-73-208-81-125.hsd1.in.comcast.net (chorlinia) [73.208.81.125]:36284: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 31 22:13:35 host2 pure-ftpd[1721641]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 22:15:55 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<hzOlNUJHutAv/AU1>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.185
country_id: 6252001
description:
Dec 31 22:16:29 host2 pure-ftpd[1725103]: (?@198.235.24.185) [INFO] New connection from 198.235.24.185


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.190.94
country_id: 2542007
description:
2025-12-31 22:17:38 dovecot_login authenticator failed for H=([105.73.190.94]) [105.73.190.94]:37855: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.149
country_id: 1733045
description:
2025-12-31 22:18:08 dovecot_login authenticator failed for H=([49.124.152.149]) [49.124.152.149]:40950: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 31 22:18:30 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<EjDjPkJHxLaeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 22:19:21 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<BH/nQUJHXp+eRdY+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.164
country_id: 2993457
description:
Dec 31 22:19:25 host2 pure-ftpd[1728613]: (?@194.165.16.164) [INFO] New connection from 194.165.16.164


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.243.50.114
country_id: 3469034
description:
Dec 31 22:20:42 host2 sshd[1730342]: Disconnected from invalid user nextcloud 8.243.50.114 port 39910 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 13.218.248.146
country_id: 6252001
description:
Dec 31 22:24:37 host2 pure-ftpd[1734788]: (?@13.218.248.146) [INFO] New connection from 13.218.248.146


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 22:25:20 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<q0BIV0JH4IAzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 22:27:14 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<I+wTXkJHVmIjupN+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 8.243.50.114
country_id: 3469034
description:
Dec 31 22:26:40 host2 sshd[1737167]: Disconnected from invalid user developer 8.243.50.114 port 35670 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.243.50.114
country_id: 3469034
description:
Dec 31 22:29:14 host2 sshd[1740377]: Disconnected from invalid user abc 8.243.50.114 port 54844 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 22:30:19 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<Q7kfaUJHxtMzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 31 22:35:35 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<mWfye0JH8oRn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 31 22:36:28 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<o9oLf0JHZs6i8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 22:37:23 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<W2dggkJHMoCeRdY+>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.249.55.106
country_id: 2017370
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 89.249.55.106 - gnetuniv "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetuniv (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 22:39:58 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<FQ6oi0JHCqAv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 31 22:41:52 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<uEtvkkJHzN1CdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 22:42:51 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<1qX3lUJHNpwjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.117
country_id: 1269750
description:
Dec 31 22:43:33 host2 dovecot[1667607]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=103.18.166.117, lip=66.85.158.91, TLS, session=<sWcyl0JHHrFnEqZ1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.39.212.79
country_id: 2510769
description:
Dec 31 22:43:50 host2 dovecot[1667607]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<charanaw>, method=PLAIN, rip=46.39.212.79, lip=66.85.158.91, TLS, session=<CmmjmEJHma8uJ9RP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 31 22:47:49 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<7Xi0p0JHvtxnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.80.228.231
country_id: 6252001
description:
2025-12-31 22:51:48 dovecot_login authenticator failed for H=([129.80.228.231]) [129.80.228.231]:35972: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2025-12-31 22:51:18 dovecot_login authenticator failed for H=([128.185.39.145]) [128.185.214.78]:32826: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Dec 31 22:52:18 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<xCrBt0JH/pMyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 31 22:52:23 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<4rkHuEJHzClniu0S>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.241.132.152
country_id: 1269750
description:
2025-12-31 22:53:47 dovecot_login authenticator failed for H=(static.ill.117.248.107.130.bsnl.co.in) [43.241.132.152]:51216: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 31 22:54:06 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<UkAsvkJH+G6i8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-12-31 22:53:28 dovecot_login authenticator failed for H=([85.19.195.12]) [85.19.195.12]:34288: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.62.25.91
country_id: 2635167
description:
Dec 31 22:55:14 host2 sshd[1771141]: Disconnected from invalid user rich 178.62.25.91 port 49132 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 31 22:56:59 host2 sshd[1773392]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.194.140.170
country_id: 3996063
description:
Dec 31 22:57:05 host2 sshd[1773523]: Disconnected from invalid user peter 189.194.140.170 port 38206 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.125.122
country_id: 1269750
description:
2025-12-31 22:57:15 dovecot_login authenticator failed for H=(nsg-static-233.166.76.182-airtel.com) [182.95.125.122]:39526: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.234.146.158
country_id: 2661886
description:
Dec 31 22:56:21 host2 sshd[1772699]: Disconnected from invalid user data 81.234.146.158 port 44804 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.161.56.210
country_id: 6252001
description:
Dec 31 22:56:36 host2 sshd[1772992]: Disconnected from invalid user mailuser 203.161.56.210 port 43092 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 81.234.146.158
country_id: 2661886
description:
Dec 31 22:57:55 host2 sshd[1774378]: Disconnected from invalid user hadoop 81.234.146.158 port 59120 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.194
country_id: 1269750
description:
2025-12-31 22:58:02 dovecot_login authenticator failed for H=([182.95.52.194]) [182.95.52.194]:48824: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.224.109.126
country_id: 6252001
description:
Dec 31 22:59:03 host2 sshd[1775614]: Disconnected from invalid user rich 52.224.109.126 port 52180 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.161.56.210
country_id: 6252001
description:
Dec 31 22:59:26 host2 sshd[1776108]: Disconnected from invalid user me 203.161.56.210 port 34496 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.234.146.158
country_id: 2661886
description:
Dec 31 23:00:03 host2 sshd[1776965]: Disconnected from invalid user traccar 81.234.146.158 port 54414 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.172.98.248
country_id: 6252001
description:
Dec 31 23:00:21 host2 sshd[1777474]: Disconnected from invalid user odoo 144.172.98.248 port 43576 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.194.140.170
country_id: 3996063
description:
Dec 31 23:00:22 host2 sshd[1777478]: Disconnected from invalid user debian 189.194.140.170 port 48160 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 203.161.56.210
country_id: 6252001
description:
Dec 31 23:00:29 host2 sshd[1777596]: Disconnected from invalid user traccar 203.161.56.210 port 48384 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.234.146.158
country_id: 2661886
description:
Dec 31 23:00:35 host2 sshd[1777706]: Disconnected from invalid user test1 81.234.146.158 port 60295 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.189.235.176
country_id: 1643084
description:
Dec 31 23:01:35 host2 sshd[1779061]: Disconnected from invalid user sftpuser 103.189.235.176 port 40656 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.194.140.170
country_id: 3996063
description:
Dec 31 23:01:41 host2 sshd[1779234]: Disconnected from invalid user alice 189.194.140.170 port 47324 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 144.172.98.248
country_id: 6252001
description:
Dec 31 23:01:59 host2 sshd[1779581]: Disconnected from invalid user kenji 144.172.98.248 port 37918 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 31 23:01:21 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<oQMa2EJHzol100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.172.98.248
country_id: 6252001
description:
Dec 31 23:01:27 host2 sshd[1778869]: Disconnected from invalid user traccar 144.172.98.248 port 38502 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.224.109.126
country_id: 6252001
description:
Dec 31 23:02:38 host2 sshd[1780370]: Disconnected from invalid user justin 52.224.109.126 port 32860 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.62.25.91
country_id: 2635167
description:
Dec 31 23:02:44 host2 sshd[1780482]: Disconnected from invalid user low 178.62.25.91 port 39670 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.189.235.176
country_id: 1643084
description:
Dec 31 23:02:18 host2 sshd[1779922]: Disconnected from invalid user appuser 103.189.235.176 port 55112 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.189.235.176
country_id: 1643084
description:
Dec 31 23:03:35 host2 sshd[1781674]: Disconnected from invalid user ubuntu 103.189.235.176 port 56136 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.180.145.136
country_id: 1269750
description:
2025-12-31 23:05:08 dovecot_login authenticator failed for H=(nsg-corporate-136.145.180.122.airtel.in) [122.180.145.136]:46500: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.29.30.135
country_id: 1527747
description:
2025-12-31 23:05:24 dovecot_login authenticator failed for H=(217-29-30-135.saimanet.kg) [217.29.30.135]:42806: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.190.155.43
country_id: 6252001
description:
2025-12-31 23:07:18 dovecot_plain authenticator failed for H=(prenest) [76.190.155.43]:47041: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 31 23:16:33 host2 pure-ftpd[1797841]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Dec 31 23:17:27 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<7tGqEUNHnK2YNcU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.194.231
country_id: 3144096
description:
2025-12-31 23:17:31 dovecot_login authenticator failed for H=(cm-178.232.194.231.get.no) [178.232.194.231]:38680: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.221.254.250
country_id: 783754
description:
2025-12-31 23:17:47 dovecot_login authenticator failed for H=([185.221.254.250]) [185.221.254.250]:47992: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 23:17:21 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<fj1UEUNHGMGeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Dec 31 23:19:56 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<h1GVGkNH4G5o7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Dec 31 23:20:36 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<gX3kHENHBJQvWBNS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.215.199.37
country_id: 1819730
description:
2025-12-31 23:20:57 dovecot_login authenticator failed for H=([125.215.199.37]) [125.215.199.37]:52528: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.220.210
country_id: 2403846
description:
2025-12-31 23:22:05 dovecot_login authenticator failed for H=([196.216.220.210]) [196.216.220.210]:49854: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.202.65
country_id: 1880251
description:
Dec 31 23:21:17 host2 sshd[1804418]: Disconnected from invalid user surya 45.78.202.65 port 56306 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.188
country_id: 1733045
description:
2025-12-31 23:21:39 dovecot_login authenticator failed for H=([49.124.148.188]) [49.124.148.188]:48794: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2025-12-31 23:21:46 dovecot_login authenticator failed for H=([83.136.176.12]) [83.136.176.12]:54316: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.125
country_id: 6252001
description:
Dec 31 23:23:11 host2 dovecot[1667607]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.125, lip=66.85.158.92, TLS: Connection closed, session=<2hJWJkNHgsNChJl9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.75
country_id: 1880251
description:
Dec 31 23:25:33 host2 sshd[1809593]: Disconnected from invalid user ec2-user 45.78.223.75 port 42364 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 23:26:38 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<iKWGMkNHGjwjupN+>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 35.186.147.126
country_id: 1880251
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[35.186.147.126] [Remote Port]=[15386] [Authentication Database]=[mail] [Username]=[postfix@anandaobauae.org] (12/10 failures) (blocked until [Thu Jan  1 17:56:36 2026 UTC/Thu Jan  1 23:26:36 2026 LOCAL])


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.188.176.242
country_id: 3923057
description:
Dec 31 23:27:41 host2 sshd[1812248]: Disconnected from invalid user ec2-user 181.188.176.242 port 48498 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.225.99.151
country_id: 2921044
description:
Dec 31 23:27:45 host2 sshd[1812347]: Disconnected from invalid user user5 64.225.99.151 port 50592 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 23:27:58 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<OBhLN0NHvMsv/AU1>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 47.252.5.53
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[47.252.5.53] [Remote Port]=[52156] [Authentication Database]=[mail] [Username]=[info@lankaherbalsolutions.com] (10/10 failures) (blocked until [Thu Jan  1 17:57:56 2026 UTC/Thu Jan  1 23:27:56 2026 LOCAL])


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.225.99.151
country_id: 2921044
description:
Dec 31 23:27:14 host2 sshd[1811689]: Disconnected from invalid user miner 64.225.99.151 port 58180 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.156.114.92
country_id: 2921044
description:
Dec 31 23:27:30 host2 sshd[1811994]: Disconnected from invalid user a 94.156.114.92 port 45502 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.188.176.242
country_id: 3923057
description:
Dec 31 23:28:25 host2 sshd[1813140]: Disconnected from invalid user omm 181.188.176.242 port 41862 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 31 23:29:12 host2 sshd[1814256]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.103.210
country_id: 6252001
description:
Dec 31 23:29:28 host2 sshd[1814598]: Disconnected from invalid user kali 107.150.103.210 port 6928 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.150.103.210
country_id: 6252001
description:
Dec 31 23:29:59 host2 sshd[1815198]: Disconnected from invalid user ansible 107.150.103.210 port 38262 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 31 23:30:14 host2 sshd[1815663]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.103.210
country_id: 6252001
description:
Dec 31 23:31:04 host2 sshd[1816821]: Disconnected from invalid user bob 107.150.103.210 port 5686 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.75
country_id: 1880251
description:
Dec 31 23:31:59 host2 sshd[1817865]: Disconnected from invalid user surya 45.78.223.75 port 49976 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 94.156.114.92
country_id: 2921044
description:
Dec 31 23:31:30 host2 sshd[1817307]: Received disconnect from 94.156.114.92 port 58120:11: Bye Bye [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Dec 31 23:31:36 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=</2pIRENH/rQFhXlo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.188.176.242
country_id: 3923057
description:
Dec 31 23:31:51 host2 sshd[1817704]: Disconnected from invalid user wk 181.188.176.242 port 45290 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.244.206.6
country_id: 1643084
description:
Dec 31 23:32:11 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<941jRkNHAtNn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Dec 31 23:33:44 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<5VDqS0NHfpmi8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.74.211.27
country_id: 6252001
description:
2025-12-31 23:34:31 dovecot_plain authenticator failed for H=c-75-74-211-27.hsd1.fl.comcast.net (sliatia) [75.74.211.27]:38747: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Dec 31 23:35:22 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<nvbIUUNHwoWeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 23:38:37 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<qApoXUNH6tszTcpt>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 51.77.202.109
country_id: 3017382
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[51.77.202.109] [Remote Port]=[56298] [Authentication Database]=[mail] [Username]=[admin@lankaherbalsolutions.com] (10/10 failures) (blocked until [Thu Jan  1 18:08:35 2026 UTC/Thu Jan  1 23:38:35 2026 LOCAL])


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.151.182.15
country_id: 2017370
description:
Dec 31 23:39:03 host2 sshd[1827262]: Disconnected from invalid user mine 45.151.182.15 port 56250 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.151.182.15
country_id: 2017370
description:
Dec 31 23:40:10 host2 sshd[1828690]: Disconnected from invalid user testuser 45.151.182.15 port 38998 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.221.74.234
country_id: 226074
description:
Dec 31 23:40:20 host2 sshd[1828938]: Disconnected from invalid user user 45.221.74.234 port 50524 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.151.182.15
country_id: 2017370
description:
Dec 31 23:40:46 host2 sshd[1829469]: Disconnected from invalid user tester 45.151.182.15 port 46410 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Dec 31 23:42:12 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<jHg0akNHit0jupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.1
country_id: 798549
description:
Dec 31 23:42:19 host2 dovecot[1667607]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 1 secs): user=<>, rip=85.217.149.1, lip=66.85.158.92, TLS, session=<YR29akNH4IBV2ZUB>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.151.182.15
country_id: 2017370
description:
Dec 31 23:42:52 host2 sshd[1832154]: Disconnected from invalid user elasticsearch 45.151.182.15 port 45218 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 31 23:43:17 host2 sshd[1832795]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.221.74.234
country_id: 226074
description:
Dec 31 23:43:17 host2 sshd[1832743]: Disconnected from invalid user elasticsearch 45.221.74.234 port 32808 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Dec 31 23:43:41 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<tiSHb0NHdswzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Dec 31 23:43:39 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<mGdnb0NHONCeRdGr>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.221.74.234
country_id: 226074
description:
Dec 31 23:44:41 host2 sshd[1834655]: Disconnected from invalid user user5 45.221.74.234 port 33468 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Dec 31 23:45:29 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<YJX0dUNHHQlniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Dec 31 23:46:38 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<GsIPekNHBJ9nmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.88.102.128
country_id: 2661886
description:
2025-12-31 23:49:11 dovecot_login authenticator failed for H=(128.102.88.80.sta.ac-net.se) [80.88.102.128]:39072: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.145.94
country_id: 3996063
description:
2025-12-31 23:49:40 dovecot_login authenticator failed for H=([177.236.145.94]) [177.236.145.94]:49290: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Dec 31 23:50:20 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<R0VMh0NHgqhCdMzo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.75
country_id: 1880251
description:
Dec 31 23:50:37 host2 sshd[1842903]: Disconnected from invalid user bob 45.78.223.75 port 58264 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.75
country_id: 1880251
description:
Dec 31 23:51:43 host2 sshd[1844147]: Disconnected from invalid user panel 45.78.223.75 port 54672 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Dec 31 23:52:20 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<5S1wjkNHVJ0v/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Dec 31 23:52:31 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<LZwdj0NH3ICi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.229.98.92
country_id: 2510769
description:
Dec 31 23:53:16 host2 dovecot[1667607]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=185.229.98.92, lip=66.85.158.91, TLS, session=<HrjukENHWpq55WJc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.159.85
country_id: 690791
description:
Dec 31 23:53:34 host2 dovecot[1667607]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=37.221.159.85, lip=66.85.158.91, TLS, session=<ouwCkkNHg7ol3Z9V>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec 31 23:55:49 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<kBLomkNHXN1100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  1 00:00:30 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<LyGpq0NH3I6eRdGr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.124.168.139
country_id: 3996063
description:
Jan  1 00:00:37 host2 sshd[1855403]: Disconnected from invalid user user 201.124.168.139 port 52862 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.246.87.238
country_id: 3658394
description:
Jan  1 00:00:48 host2 sshd[1855682]: Disconnected from invalid user ec2-user 170.246.87.238 port 35330 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.180.59.208
country_id: 1168579
description:
Jan  1 00:00:52 host2 sshd[1855716]: Disconnected from invalid user runner 182.180.59.208 port 38146 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.205.103
country_id: 1643084
description:
Jan  1 00:00:55 host2 sshd[1855932]: Disconnected from invalid user public 103.172.205.103 port 58250 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.53.215.134
country_id: 3658394
description:
Jan  1 00:01:32 host2 sshd[1856738]: Disconnected from invalid user webserver 177.53.215.134 port 39480 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.53.215.134
country_id: 3658394
description:
Jan  1 00:02:39 host2 sshd[1858033]: Disconnected from invalid user deploy 177.53.215.134 port 56552 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.221.8
country_id: 1880251
description:
Jan  1 00:02:45 host2 sshd[1858152]: Disconnected from invalid user omm 45.78.221.8 port 56244 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.64.179
country_id: 1269750
description:
Jan  1 00:02:48 host2 sshd[1858241]: Disconnected from invalid user ec2-user 139.59.64.179 port 48188 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.124.168.139
country_id: 3996063
description:
Jan  1 00:02:55 host2 sshd[1858397]: Disconnected from invalid user certbot 201.124.168.139 port 60180 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.180.59.208
country_id: 1168579
description:
Jan  1 00:02:58 host2 sshd[1858376]: Disconnected from invalid user demo 182.180.59.208 port 37716 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.53.215.134
country_id: 3658394
description:
Jan  1 00:03:56 host2 sshd[1859924]: Disconnected from invalid user no-reply 177.53.215.134 port 51860 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.225.176.238
country_id: 6252001
description:
Jan  1 00:05:06 host2 sshd[1861532]: Disconnected from invalid user runner 50.225.176.238 port 49374 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.64.179
country_id: 1269750
description:
Jan  1 00:06:02 host2 sshd[1862891]: Disconnected from invalid user omm 139.59.64.179 port 59564 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.180.59.208
country_id: 1168579
description:
Jan  1 00:06:01 host2 sshd[1862851]: Disconnected from invalid user ops 182.180.59.208 port 34242 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.124.168.139
country_id: 3996063
description:
Jan  1 00:05:09 host2 sshd[1861595]: Disconnected from invalid user zac 201.124.168.139 port 50572 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.19.77
country_id: 3932488
description:
Jan  1 00:06:16 host2 sshd[1863179]: Disconnected from invalid user kafka 161.132.19.77 port 57422 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.135.111.5
country_id: 298795
description:
Jan  1 00:06:29 host2 sshd[1863456]: Disconnected from invalid user orlando 78.135.111.5 port 42428 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.64.179
country_id: 1269750
description:
Jan  1 00:06:37 host2 sshd[1863742]: Disconnected from invalid user deploy 139.59.64.179 port 44898 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.245.101.12
country_id: 1269750
description:
Jan  1 00:06:57 host2 sshd[1864151]: Disconnected from invalid user kafka 157.245.101.12 port 46684 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.18.236.229
country_id: 3175395
description:
Jan  1 00:06:59 host2 sshd[1864208]: Disconnected from invalid user pro 85.18.236.229 port 45748 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 139.59.64.179
country_id: 1269750
description:
Jan  1 00:07:11 host2 sshd[1864540]: Disconnected from invalid user user 139.59.64.179 port 58458 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.225.176.238
country_id: 6252001
description:
Jan  1 00:07:25 host2 sshd[1864840]: Disconnected from invalid user soporte 50.225.176.238 port 37912 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.246.87.238
country_id: 3658394
description:
Jan  1 00:07:35 host2 sshd[1865017]: Disconnected from invalid user no-reply 170.246.87.238 port 35970 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.18.236.229
country_id: 3175395
description:
Jan  1 00:07:29 host2 sshd[1864898]: Disconnected from invalid user backups 85.18.236.229 port 57252 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.19.77
country_id: 3932488
description:
Jan  1 00:07:31 host2 sshd[1864941]: Disconnected from invalid user hadoop 161.132.19.77 port 56572 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.205.103
country_id: 1643084
description:
Jan  1 00:08:32 host2 sshd[1866307]: Disconnected from invalid user mas 103.172.205.103 port 47348 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.135.111.5
country_id: 298795
description:
Jan  1 00:08:34 host2 sshd[1866341]: Disconnected from invalid user sanjay 78.135.111.5 port 33910 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.246.87.238
country_id: 3658394
description:
Jan  1 00:08:09 host2 sshd[1865816]: Disconnected from invalid user vncuser 170.246.87.238 port 46816 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 50.225.176.238
country_id: 6252001
description:
Jan  1 00:08:21 host2 sshd[1866086]: Disconnected from invalid user installer 50.225.176.238 port 42690 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.226.12
country_id: 1880251
description:
Jan  1 00:08:23 host2 sshd[1866102]: Disconnected from invalid user trading 45.78.226.12 port 59894 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.18.236.229
country_id: 3175395
description:
Jan  1 00:08:25 host2 sshd[1866167]: Disconnected from invalid user db2admin 85.18.236.229 port 51962 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-01 00:09:34 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:55378: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.132.19.77
country_id: 3932488
description:
Jan  1 00:10:30 host2 sshd[1868799]: Disconnected from invalid user no-reply 161.132.19.77 port 60532 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  1 00:10:18 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<hoS3zkNHTJoyBsPO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.95.132.54
country_id: 6252001
description:
Jan  1 00:10:21 host2 sshd[1868635]: Disconnected from invalid user developer 23.95.132.54 port 46834 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.205.103
country_id: 1643084
description:
Jan  1 00:11:37 host2 sshd[1870020]: Disconnected from invalid user cuckoo 103.172.205.103 port 50094 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 23.95.132.54
country_id: 6252001
description:
Jan  1 00:11:47 host2 sshd[1870213]: Disconnected from invalid user vikas 23.95.132.54 port 53326 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.205.103
country_id: 1643084
description:
Jan  1 00:12:23 host2 sshd[1871003]: Disconnected from invalid user test1 103.172.205.103 port 55100 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 157.245.101.12
country_id: 1269750
description:
Jan  1 00:13:01 host2 sshd[1871660]: Disconnected from invalid user sinusbot 157.245.101.12 port 59752 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.130
country_id: 6252001
description:
Jan  1 00:13:15 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (no auth attempts in 18 secs): user=<>, rip=66.132.153.130, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Hh9h2UNH4n5ChJmC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 00:15:03 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<JyCw30NH5LSeRdY+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.226.12
country_id: 1880251
description:
Jan  1 00:16:47 host2 sshd[1876016]: Disconnected from invalid user intell 45.78.226.12 port 53442 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.221.8
country_id: 1880251
description:
Jan  1 00:18:12 host2 sshd[1877733]: Disconnected from invalid user user 45.78.221.8 port 43850 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  1 00:19:19 host2 pure-ftpd[1879013]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.134.230
country_id: 6252001
description:
Jan  1 00:21:29 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=71.6.134.230, lip=66.85.158.91, TLS: Connection closed, session=<oIjW9kNHTI9HBobm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.79
country_id: 6252001
description:
Jan  1 00:23:52 host2 dovecot[1667607]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.79, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ndRd/0NHnMKTuYRP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.190.155.43
country_id: 6252001
description:
2026-01-01 00:24:26 dovecot_plain authenticator failed for H=(hebown) [76.190.155.43]:34075: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.176.157.57
country_id: 6252001
description:
2026-01-01 00:24:43 dovecot_plain authenticator failed for H=c-73-176-157-57.hsd1.il.comcast.net (ormant) [73.176.157.57]:37524: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 223.122.203.39
country_id: 1819730
description:
Jan  1 00:25:59 host2 sshd[1889788]: Disconnecting invalid user admin 223.122.203.39 port 43092: Too many authentication failures [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 00:26:01 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<c7XqBkRH7OojupN+>


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 223.122.203.39
country_id: 1819730
description:
Jan  1 00:25:46 host2 sshd[1889299]: Disconnecting authenticating user root 223.122.203.39 port 33522: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 223.122.203.39
country_id: 1819730
description:
Jan  1 00:25:46 host2 sshd[1889299]: error: maximum authentication attempts exceeded for root from 223.122.203.39 port 33522 ssh2 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 223.122.203.39
country_id: 1819730
description:
Jan  1 00:25:56 host2 sshd[1889667]: error: maximum authentication attempts exceeded for invalid user admin from 223.122.203.39 port 35416 ssh2 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  1 00:26:49 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<gXTFCURHkiBo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  1 00:28:04 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<fgtCDkRH+KBn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2026-01-01 00:28:25 dovecot_plain authenticator failed for H=(arymy) [12.150.243.22]:54261: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.145.10.140
country_id: 6252001
description:
2026-01-01 00:28:30 dovecot_plain authenticator failed for H=c-76-145-10-140.hsd1.ga.comcast.net (mendyne) [76.145.10.140]:50118: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  1 00:30:23 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<rSCMFkRHqK6i8GQy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.70
country_id: 6252001
description:
Jan  1 00:30:41 host2 dovecot[1667607]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.139.70, lip=66.85.158.92, TLS handshaking: Connection closed, session=<0OO5F0RHGiG4aYtG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.70
country_id: 6252001
description:
Jan  1 00:31:15 host2 dovecot[1667607]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.139.70, lip=66.85.158.92, TLS: Connection closed, session=<a9HDGURHrPS4aYtG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 00:33:15 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<r6TDIERHuqKeRdY+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.95.121.178
country_id: 3175395
description:
Jan  1 00:34:43 host2 sshd[1905013]: Disconnected from invalid user alice 5.95.121.178 port 57484 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.144.124.91
country_id: 6252001
description:
Jan  1 00:35:43 host2 sshd[1906731]: Disconnected from invalid user rundeck 24.144.124.91 port 34056 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.95.121.178
country_id: 3175395
description:
Jan  1 00:36:26 host2 sshd[1907646]: Disconnected from invalid user odoo 5.95.121.178 port 37156 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 5.95.121.178
country_id: 3175395
description:
Jan  1 00:37:59 host2 sshd[1909690]: Disconnected from invalid user senthil 5.95.121.178 port 38646 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.144.124.91
country_id: 6252001
description:
Jan  1 00:38:08 host2 sshd[1909906]: Disconnected from invalid user ubuntu 24.144.124.91 port 35588 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  1 00:38:47 host2 dovecot[1667607]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<d9yPNERHiBJniu0S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 98.159.40.7
country_id: 1227603
description:
Jan  1 00:39:57 host2 dovecot[1911092]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=98.159.40.7, lip=66.85.158.91, session=<BergOERHUJdinygH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 154.47.30.28
country_id: 953987
description:
Jan  1 00:39:58 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=154.47.30.28, lip=66.85.158.91, TLS, session=<KPHrOERHcL6aLx4c>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.47.194.4
country_id: 146669
description:
Jan  1 00:39:58 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=195.47.194.4, lip=66.85.158.91, session=<wmblOERH+nDDL8IE>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 176.223.173.112
country_id: 2658434
description:
Jan  1 00:39:44 host2 pure-ftpd[1912075]: (?@176.223.173.112) [INFO] New connection from 176.223.173.112


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 00:40:22 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<LU87OkRHTsQv/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.230.228.16
country_id: 6252001
description:
2026-01-01 00:40:30 dovecot_plain authenticator failed for H=c-71-230-228-16.hsd1.de.comcast.net (ormade) [71.230.228.16]:49230: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 00:41:42 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<4x4AP0RHsscjupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.54
country_id: 6252001
description:
Jan  1 00:41:47 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.54, lip=66.85.158.91, session=<futtP0RHDO7N0h82>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  1 00:41:56 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<TjfPP0RHup4vWBNS>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  1 00:43:35 host2 sshd[1917329]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 24.144.124.91
country_id: 6252001
description:
Jan  1 00:44:07 host2 sshd[1918117]: Disconnected from invalid user leon 24.144.124.91 port 47428 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  1 00:44:55 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<KvF3SkRH3Oxnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.144.124.91
country_id: 6252001
description:
Jan  1 00:46:31 host2 sshd[1921864]: Disconnected from invalid user odoo 24.144.124.91 port 47572 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  1 00:46:40 host2 sshd[1922031]: Disconnected from invalid user user 2.57.121.25 port 8108 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  1 00:50:53 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<dmzYX0RH+G+i8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  1 00:50:12 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<Dz9eXURHcul100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  1 00:50:14 host2 sshd[1926320]: Disconnected from invalid user admin 2.57.121.112 port 53371 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 00:51:46 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<+qQBY0RHRN8zTcpt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.153.57.103
country_id: 2542007
description:
Jan  1 00:51:58 host2 sshd[1928519]: Disconnected from invalid user user 197.153.57.103 port 50543 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.240.75.51
country_id: 2802361
description:
Jan  1 00:52:13 host2 sshd[1928827]: Disconnected from invalid user wordpress 35.240.75.51 port 49900 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Jan  1 00:52:20 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<8hEAZURH/IGYNcU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.232.50.5
country_id: 3865483
description:
Jan  1 00:52:40 host2 sshd[1929381]: Disconnected from invalid user user 24.232.50.5 port 46110 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  1 00:52:50 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<oT/PZkRHpqoFhXlo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.40.57.41
country_id: 1269750
description:
Jan  1 00:53:30 host2 sshd[1930495]: Disconnected from invalid user testing 45.40.57.41 port 57744 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.153.57.103
country_id: 2542007
description:
Jan  1 00:53:57 host2 sshd[1931000]: Disconnected from invalid user nvr 197.153.57.103 port 36802 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.198
country_id: 6252001
description:
Jan  1 00:54:06 host2 dovecot[1911092]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.198, lip=66.85.158.92, session=<OwN9a0RHmM6s7OTG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2026-01-01 00:54:53 dovecot_login authenticator failed for H=([189.108.156.41]) [187.8.64.94]:46137: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.115.18.231
country_id: 2750405
description:
Jan  1 00:54:54 host2 sshd[1932571]: Disconnected from invalid user nvr 40.115.18.231 port 47884 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.175.213.4
country_id: 6252001
description:
Jan  1 00:54:56 host2 dovecot[1911092]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=66.175.213.4, lip=66.85.158.92, session=<wyFwbkRHaINCr9UE>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.153.57.103
country_id: 2542007
description:
Jan  1 00:54:35 host2 sshd[1932200]: Disconnected from invalid user teamspeak 197.153.57.103 port 43400 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.224.71.115
country_id: 6252001
description:
Jan  1 00:55:57 host2 sshd[1934093]: Disconnected from invalid user david 52.224.71.115 port 47398 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 40.115.18.231
country_id: 2750405
description:
Jan  1 00:56:00 host2 sshd[1934137]: Disconnected from invalid user user 40.115.18.231 port 47082 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.208.46.130
country_id: 1522867
description:
2026-01-01 00:55:22 dovecot_login authenticator failed for H=([37.208.46.130]) [37.208.46.130]:45668: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.115.18.231
country_id: 2750405
description:
Jan  1 00:55:27 host2 sshd[1933374]: Disconnected from invalid user rw 40.115.18.231 port 33372 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.153.57.103
country_id: 2542007
description:
Jan  1 00:55:43 host2 sshd[1933814]: Disconnected from invalid user ubuntu 197.153.57.103 port 56511 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 00:56:48 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<r/r8dERH/u0zTcpt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.153.57.103
country_id: 2542007
description:
Jan  1 00:56:16 host2 sshd[1934545]: Disconnected from invalid user hunter 197.153.57.103 port 34937 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.139.193.31
country_id: 1643084
description:
Jan  1 00:57:14 host2 sshd[1935412]: Disconnected from invalid user jorge 103.139.193.31 port 39798 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.115.18.231
country_id: 2750405
description:
Jan  1 00:57:46 host2 sshd[1936067]: Disconnected from invalid user wordpress 40.115.18.231 port 60026 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.92.247.136
country_id: 3469034
description:
Jan  1 00:57:44 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<charanaw>, method=PLAIN, rip=177.92.247.136, lip=66.85.158.91, TLS, session=<KsNYd0RHcZSxXPeI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.13.110.39
country_id: 3865483
description:
Jan  1 00:57:13 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=181.13.110.39, lip=66.85.158.91, TLS, session=<tVpmdURH/YO1DW4n>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.224.71.115
country_id: 6252001
description:
Jan  1 00:57:36 host2 sshd[1935868]: Disconnected from invalid user steam 52.224.71.115 port 40692 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.95.177
country_id: 1643084
description:
Jan  1 00:57:39 host2 sshd[1935915]: Disconnected from invalid user admin 103.59.95.177 port 36142 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.78.253.49
country_id: 1210997
description:
2026-01-01 00:58:50 dovecot_plain authenticator failed for H=(B9MP3) [103.78.253.49]:11501: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  1 00:58:34 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<+VdOe0RHdOBCdMzo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.139.193.31
country_id: 1643084
description:
Jan  1 00:59:07 host2 sshd[1937667]: Disconnected from invalid user jenkins 103.139.193.31 port 37134 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.95.177
country_id: 1643084
description:
Jan  1 00:58:43 host2 sshd[1937216]: Disconnected from invalid user jorge 103.59.95.177 port 37214 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.122.251.18
country_id: 130758
description:
Jan  1 00:59:41 host2 sshd[1938259]: Disconnected from invalid user test001 109.122.251.18 port 32970 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.139.193.31
country_id: 1643084
description:
Jan  1 00:59:51 host2 sshd[1938559]: Disconnected from invalid user user 103.139.193.31 port 46728 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.40.57.41
country_id: 1269750
description:
Jan  1 01:00:30 host2 sshd[1939659]: Disconnected from invalid user admin 45.40.57.41 port 60192 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 216.167.53.36
country_id: 6252001
description:
Jan  1 01:01:03 host2 sshd[1940467]: Disconnected from invalid user rw 216.167.53.36 port 57542 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 216.167.53.36
country_id: 6252001
description:
Jan  1 01:00:08 host2 sshd[1939165]: Disconnected from invalid user user 216.167.53.36 port 39216 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.240.75.51
country_id: 2802361
description:
Jan  1 01:00:32 host2 sshd[1939707]: Disconnected from invalid user appuser 35.240.75.51 port 33720 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.95.177
country_id: 1643084
description:
Jan  1 01:00:45 host2 sshd[1940072]: Disconnected from invalid user ftpupload 103.59.95.177 port 49320 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.232.50.5
country_id: 3865483
description:
Jan  1 01:00:48 host2 sshd[1940128]: Disconnected from invalid user admin 24.232.50.5 port 55854 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.95.177
country_id: 1643084
description:
Jan  1 01:01:17 host2 sshd[1940722]: Disconnected from invalid user sysadmin 103.59.95.177 port 48276 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 103.59.95.177
country_id: 1643084
description:
Jan  1 01:02:18 host2 sshd[1941873]: Received disconnect from 103.59.95.177 port 46918:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.40.57.41
country_id: 1269750
description:
Jan  1 01:02:51 host2 sshd[1942484]: Disconnected from invalid user teamspeak 45.40.57.41 port 49722 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.232.50.5
country_id: 3865483
description:
Jan  1 01:02:55 host2 sshd[1942610]: Disconnected from invalid user ftpupload 24.232.50.5 port 45310 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.40.57.41
country_id: 1269750
description:
Jan  1 01:03:17 host2 sshd[1943241]: Disconnected from invalid user frappe 45.40.57.41 port 34130 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.224.71.115
country_id: 6252001
description:
Jan  1 01:04:29 host2 sshd[1945189]: Disconnected from invalid user teamspeak 52.224.71.115 port 47270 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 01:04:38 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<FyQJkURHkt0v/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.221.216.189
country_id: 2635167
description:
Jan  1 01:04:19 host2 sshd[1944894]: Disconnected from invalid user sysadmin 185.221.216.189 port 53198 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.83.107.150
country_id: 2264397
description:
Jan  1 01:05:27 host2 sshd[1946628]: Disconnected from invalid user ubuntu 2.83.107.150 port 57422 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.246.86.68
country_id: 357994
description:
Jan  1 01:05:52 host2 sshd[1947266]: Disconnected from invalid user frappe 45.246.86.68 port 53650 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.61
country_id: 6252001
description:
Jan  1 01:06:43 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=167.94.146.61, lip=66.85.158.91, TLS: Connection closed, session=<XmiVmERHFJynXpI9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.221.216.189
country_id: 2635167
description:
Jan  1 01:06:55 host2 sshd[1948861]: Disconnected from invalid user oracle 185.221.216.189 port 39426 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.216.177.55
country_id: 1643084
description:
Jan  1 01:07:46 host2 sshd[1950070]: Disconnected from invalid user t 41.216.177.55 port 35384 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.235
country_id: 6252001
description:
Jan  1 01:07:52 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.235, lip=66.85.158.91, session=<GYuxnERHf9RBMQHr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.153.32.151
country_id: 798544
description:
Jan  1 01:07:52 host2 sshd[1950211]: Disconnected from invalid user minikube 185.153.32.151 port 42188 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.221.216.189
country_id: 2635167
description:
Jan  1 01:07:59 host2 sshd[1950374]: Disconnected from invalid user test 185.221.216.189 port 35468 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.232
country_id: 6252001
description:
Jan  1 01:08:03 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=65.49.1.232, lip=66.85.158.91, TLS: Connection closed, session=<iepSnURH+MpBMQHo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.83.107.150
country_id: 2264397
description:
Jan  1 01:07:32 host2 sshd[1949743]: Disconnected from invalid user user 2.83.107.150 port 63983 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.115.134
country_id: 6252001
description:
Jan  1 01:08:05 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=45.79.115.134, lip=66.85.158.91, session=<BSp8nURHROctT3OG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.132
country_id: 6252001
description:
Jan  1 01:07:38 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.132, lip=66.85.158.91, session=<dGzZm0RHvr1BMQGE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.212
country_id: 6252001
description:
Jan  1 01:07:43 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.212, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Ut0snERHcMjG6xjU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.232
country_id: 6252001
description:
Jan  1 01:08:15 host2 dovecot[1911092]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=65.49.1.232, lip=66.85.158.91, session=<Ca8KnkRHII5BMQHo>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.83.107.150
country_id: 2264397
description:
Jan  1 01:09:36 host2 sshd[1952759]: Disconnected from invalid user manager 2.83.107.150 port 50134 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.191.92.110
country_id: 1643084
description:
Jan  1 01:09:43 host2 sshd[1952917]: Disconnected from invalid user wwww 103.191.92.110 port 51718 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.178.248
country_id: 1643084
description:
Jan  1 01:10:07 host2 sshd[1953606]: Disconnected from invalid user xh 103.193.178.248 port 52654 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.221.216.189
country_id: 2635167
description:
Jan  1 01:09:27 host2 sshd[1952549]: Disconnected from invalid user username 185.221.216.189 port 43914 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.178.248
country_id: 1643084
description:
Jan  1 01:10:56 host2 sshd[1954843]: Disconnected from invalid user omar 103.193.178.248 port 54402 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.191.92.110
country_id: 1643084
description:
Jan  1 01:10:49 host2 sshd[1954718]: Disconnected from invalid user t 103.191.92.110 port 47094 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.191.92.110
country_id: 1643084
description:
Jan  1 01:11:26 host2 sshd[1955690]: Disconnected from invalid user xh 103.191.92.110 port 51794 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.178.248
country_id: 1643084
description:
Jan  1 01:11:37 host2 sshd[1955971]: Disconnected from invalid user sysadmin 103.193.178.248 port 45822 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.246.86.68
country_id: 357994
description:
Jan  1 01:11:43 host2 sshd[1956102]: Disconnected from invalid user demo 45.246.86.68 port 46078 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.216.177.55
country_id: 1643084
description:
Jan  1 01:11:12 host2 sshd[1955263]: Disconnected from invalid user bot 41.216.177.55 port 37042 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.153.32.151
country_id: 798544
description:
Jan  1 01:11:23 host2 sshd[1955611]: Disconnected from invalid user demo 185.153.32.151 port 55800 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.122.251.18
country_id: 130758
description:
Jan  1 01:11:26 host2 sshd[1955694]: Disconnected from invalid user sammy 109.122.251.18 port 47256 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.246.86.68
country_id: 357994
description:
Jan  1 01:13:43 host2 sshd[1958832]: Disconnected from invalid user ftpuser 45.246.86.68 port 52510 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.60.12.168
country_id: 6252001
description:
Jan  1 01:13:59 host2 pure-ftpd[1959355]: (?@103.60.12.168) [INFO] New connection from 103.60.12.168


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.18.229.242
country_id: 1694008
description:
Jan  1 01:14:17 host2 sshd[1959730]: Disconnected from invalid user luis 103.18.229.242 port 41472 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.246.86.68
country_id: 357994
description:
Jan  1 01:14:22 host2 sshd[1959835]: Disconnected from invalid user test 45.246.86.68 port 41370 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  1 01:16:31 host2 sshd[1962818]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  1 01:16:17 host2 sshd[1962512]: Disconnected from invalid user admin 2.57.121.112 port 36458 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.3
country_id: 798549
description:
Jan  1 01:16:45 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.3, lip=66.85.158.91, TLS: Connection closed, session=<akd9vERHeopV2ZUD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.174.149
country_id: 6252001
description:
Jan  1 01:21:04 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=40.124.174.149, lip=66.85.158.92, session=</n3ky0RHAoIofK6V>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.161
country_id: 6252001
description:
Jan  1 01:20:10 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.161, lip=66.85.158.92, TLS handshaking: Connection closed, session=<a5quyERHtf9BMQGh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.152
country_id: 6252001
description:
Jan  1 01:20:28 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.152, lip=66.85.158.92, TLS handshaking: Connection closed, session=<FYy/yURHtsJBMQGY>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  1 01:21:57 host2 pure-ftpd[1970265]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.11
country_id: 798549
description:
Jan  1 01:22:17 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.11, lip=66.85.158.91, TLS: Connection closed, session=<WqZF0ERHzJlV2ZUL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  1 01:24:12 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<SzP31kRHNJZn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  1 01:26:07 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<BT7T3URH4M+i8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 01:26:16 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<mD1k3kRHgmgjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  1 01:26:47 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<scYz4ERHYpqeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  1 01:29:56 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<v4+E60RH9KcyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 01:31:42 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<aVnS8URHAK+eRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  1 01:32:00 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<yong8kRHBTtniu0S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.14
country_id: 6252001
description:
Jan  1 01:38:07 host2 dovecot[1911092]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=207.90.244.14, lip=66.85.158.92, session=<4ITeCEVHKs7PWvQO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  1 01:37:34 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<KLXLBkVHPAto7MS0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.231
country_id: 6252001
description:
Jan  1 01:37:46 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.231, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<V8mZB0VHbNjN0h/n>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.14
country_id: 6252001
description:
Jan  1 01:38:08 host2 dovecot[1911092]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=207.90.244.14, lip=66.85.158.92, session=<pWHyCEVHls7PWvQO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 01:42:09 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<VLMuF0VHLOQjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  1 01:43:55 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<fDmGHUVHBoxnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  1 01:44:32 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<Pbe1H0VHlqmeRdGr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2026-01-01 01:44:18 dovecot_plain authenticator failed for H=c-73-213-237-28.hsd1.va.comcast.net (proman) [73.213.237.28]:48388: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  1 01:44:23 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<7Q4xH0VHPsh100Db>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.162
country_id: 6252001
description:
Jan  1 01:45:31 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.162, lip=66.85.158.91, TLS handshaking: Connection closed, session=<J8pVI0VHABVBMQGi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.63
country_id: 6252001
description:
Jan  1 01:47:57 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.63, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<+DAMLEVHqd+TuYQ/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.48.221.214
country_id: 1269750
description:
2026-01-01 01:49:03 dovecot_plain authenticator failed for H=(CHXEI8NX18) [157.48.221.214]:55657: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.48.221.214
country_id: 1269750
description:
2026-01-01 01:49:10 dovecot_login authenticator failed for H=(CHXEI8NX18) [157.48.221.214]:55657: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  1 01:49:38 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<gCPyMUVHiHui8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.11.179.18
country_id: 953987
description:
2026-01-01 01:53:27 dovecot_plain authenticator failed for H=(5D07V5) [196.11.179.18]:60613: 535 Incorrect authentication data (set_id=lasithar@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 01:53:27 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<p5mUP0VHkpQv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  1 02:01:01 host2 sshd[2016588]: Disconnected from invalid user admin 2.57.121.112 port 48065 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.49.209.255
country_id: 1269750
description:
2026-01-01 02:02:04 dovecot_plain authenticator failed for H=(E7G74M1Q) [157.49.209.255]:50397: 535 Incorrect authentication data (set_id=lasithar@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.49.209.255
country_id: 1269750
description:
2026-01-01 02:02:10 dovecot_login authenticator failed for H=(E7G74M1Q) [157.49.209.255]:50397: 535 Incorrect authentication data (set_id=lasithar@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  1 02:04:10 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<pLPnZUVHeqovWBNS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.133.156.119
country_id: 294640
description:
2026-01-01 02:05:46 dovecot_plain authenticator failed for H=(comation) [195.133.156.119]:58509: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 02:05:11 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<C5eUaUVHhMozTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  1 02:07:19 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<P/IncUVHuM1CdMzo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.126
country_id: 6252001
description:
Jan  1 02:07:34 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.126, lip=66.85.158.92, TLS: Connection closed, session=<qu83ckVHpAZChJl+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.41
country_id: 6252001
description:
Jan  1 02:08:24 host2 pure-ftpd[2025984]: (?@205.210.31.41) [INFO] New connection from 205.210.31.41


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 02:10:14 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<mteWe0VHcLszTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 02:11:59 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<s8jigUVH8oKeRdY+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.195
country_id: 6252001
description:
Jan  1 02:12:17 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.195, lip=66.85.158.91, TLS, session=<gFoUg0VHLuPN0h/D>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  1 02:14:16 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<QT8EikVHXNoFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 02:17:47 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<iC6elkVHiLwv/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.67.22
country_id: 1269750
description:
2026-01-01 02:20:20 dovecot_login authenticator failed for H=(nsg-corporate-246.50.185.122.airtel.in) [182.78.67.22]:40072: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  1 02:20:23 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<dvjvn0VHWtBn9M4G>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.245.107.216
country_id: 6252001
description:
Jan  1 02:20:33 host2 pure-ftpd[2041401]: (?@104.245.107.216) [INFO] New connection from 104.245.107.216


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.223.240.239
country_id: 49518
description:
2026-01-01 02:21:00 dovecot_login authenticator failed for H=([196.223.240.239]) [196.223.240.239]:60264: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  1 02:21:22 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<nPhxo0VHXrCi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.47.85
country_id: 953987
description:
Jan  1 02:22:13 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=102.64.47.85, lip=66.85.158.91, TLS, session=<Cw1lpUVHM8lmQC9V>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.196.75
country_id: 3469034
description:
Jan  1 02:22:33 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=179.189.196.75, lip=66.85.158.91, TLS, session=<OD20pkVHEN2zvcRL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  1 02:25:03 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<oJeXsEVHuxlniu0S>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  1 02:24:32 host2 pure-ftpd[2046551]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 102.204.223.75
country_id: 2328926
description:
Jan  1 02:26:29 host2 pure-ftpd[2049407]: (?@102.204.223.75) [INFO] New connection from 102.204.223.75


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 02:26:38 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<E489tkVHEJIjupN+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 102.204.223.49
country_id: 2328926
description:
Jan  1 02:27:45 host2 pure-ftpd[2050871]: (?@102.204.223.49) [INFO] New connection from 102.204.223.49


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Jan  1 02:28:04 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<Ar1qu0VHAOCYNcU1>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  1 02:29:23 host2 sshd[2052804]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 02:30:13 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<ylMbw0VHuqWeRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.78.253.49
country_id: 1210997
description:
2026-01-01 02:32:25 dovecot_plain authenticator failed for H=(BLQ8UWWR76TP98) [103.78.253.49]:8760: 535 Incorrect authentication data (set_id=sanjanap@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.47.28
country_id: 6252001
description:
Jan  1 02:36:35 host2 sshd[2061353]: Disconnected from invalid user userm 128.1.47.28 port 51550 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 128.1.47.28
country_id: 6252001
description:
Jan  1 02:37:37 host2 sshd[2062489]: Disconnected from invalid user demo 128.1.47.28 port 46364 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.47.28
country_id: 6252001
description:
Jan  1 02:38:34 host2 sshd[2063715]: Disconnected from invalid user icp 128.1.47.28 port 41158 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  1 02:38:44 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<GeOF4UVHD1F100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.97.155.25
country_id: 6252001
description:
2026-01-01 02:40:46 dovecot_plain authenticator failed for H=c-76-97-155-25.hsd1.ga.comcast.net (ingin) [76.97.155.25]:40260: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.189.155.89
country_id: 337996
description:
Jan  1 02:40:53 host2 sshd[2066470]: Disconnected from invalid user alex 196.189.155.89 port 38860 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.139.192.90
country_id: 1643084
description:
Jan  1 02:41:15 host2 sshd[2067060]: Disconnected from invalid user git 103.139.192.90 port 43492 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.178.224.92
country_id: 1880251
description:
Jan  1 02:41:30 host2 pure-ftpd[2067311]: (?@158.178.224.92) [INFO] New connection from 158.178.224.92


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 158.178.224.92
country_id: 1880251
description:
Jan  1 02:41:35 host2 pure-ftpd[2067422]: (?@158.178.224.92) [INFO] New connection from 158.178.224.92


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 02:42:23 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<8oSS7kVHDIEjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  1 02:42:53 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<ZvpS8EVHuN1nmud6>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.178.224.92
country_id: 1880251
description:
Jan  1 02:42:08 host2 pure-ftpd[2068172]: (?@158.178.224.92) [INFO] New connection from 158.178.224.92


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 158.178.224.92
country_id: 1880251
description:
Jan  1 02:42:12 host2 pure-ftpd[2068259]: (?@158.178.224.92) [INFO] New connection from 158.178.224.92


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.238.122
country_id: 2542007
description:
2026-01-01 02:43:56 dovecot_plain authenticator failed for H=(phylly) [154.146.238.122]:36418: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.3
country_id: 798549
description:
Jan  1 02:44:00 host2 dovecot[1911092]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=85.217.140.3, lip=66.85.158.92, TLS, session=<JamE9EVHIuBV2YwD>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.123.53.88
country_id: 1269750
description:
Jan  1 02:43:12 host2 sshd[2069543]: Disconnected from invalid user ubuntu 103.123.53.88 port 35476 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.189.155.89
country_id: 337996
description:
Jan  1 02:43:17 host2 sshd[2069647]: Disconnected from invalid user yangfan 196.189.155.89 port 58572 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.155.253.241
country_id: 953987
description:
Jan  1 02:43:49 host2 sshd[2070253]: Disconnected from invalid user pivpn 156.155.253.241 port 59514 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.3
country_id: 798549
description:
Jan  1 02:44:08 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=85.217.140.3, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<Qpr39EVHnOBV2YwD>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.139.192.90
country_id: 1643084
description:
Jan  1 02:44:50 host2 sshd[2071664]: Disconnected from invalid user icp 103.139.192.90 port 41410 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.189.155.89
country_id: 337996
description:
Jan  1 02:45:33 host2 sshd[2072716]: Disconnected from invalid user morteza 196.189.155.89 port 48982 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.123.53.88
country_id: 1269750
description:
Jan  1 02:46:08 host2 sshd[2073437]: Disconnected from invalid user android 103.123.53.88 port 59740 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.155.253.241
country_id: 953987
description:
Jan  1 02:46:26 host2 sshd[2073860]: Disconnected from invalid user maintain 156.155.253.241 port 56580 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.155.253.241
country_id: 953987
description:
Jan  1 02:47:09 host2 sshd[2074611]: Disconnected from invalid user username 156.155.253.241 port 35816 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.123.53.88
country_id: 1269750
description:
Jan  1 02:47:15 host2 sshd[2074735]: Disconnected from invalid user gateway 103.123.53.88 port 52248 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  1 02:48:03 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<jk3eAkZHJOai8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  1 02:48:39 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<9WL7BEZHsBho7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  1 02:49:09 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<4J7LBkZHYooyBsPO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.139.192.90
country_id: 1643084
description:
Jan  1 02:48:17 host2 sshd[2076416]: Disconnected from invalid user userm 103.139.192.90 port 41864 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2026-01-01 02:51:11 dovecot_plain authenticator failed for H=c-73-195-211-98.hsd1.nj.comcast.net (coldelitty) [73.195.211.98]:44460: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 23.95.198.243
country_id: 6252001
description:
Jan  1 02:52:15 host2 sshd[2081015]: Disconnected from invalid user icp 23.95.198.243 port 40940 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.230.228.16
country_id: 6252001
description:
2026-01-01 02:55:03 dovecot_plain authenticator failed for H=c-71-230-228-16.hsd1.de.comcast.net (duase) [71.230.228.16]:49124: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.65.140.218
country_id: 3017382
description:
Jan  1 02:55:22 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<marketing@lezzarotech.com>, method=PLAIN, rip=82.65.140.218, lip=66.85.158.91, TLS, session=<6cIVHEZHuoVSQYza>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.154.202.101
country_id: 6252001
description:
Jan  1 02:56:05 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<marketing>, method=PLAIN, rip=165.154.202.101, lip=66.85.158.91, TLS, session=<Efy+HkZH3rGlmspl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.95.198.243
country_id: 6252001
description:
Jan  1 02:56:44 host2 sshd[2087092]: Disconnected from invalid user gateway 23.95.198.243 port 41154 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.95.198.243
country_id: 6252001
description:
Jan  1 02:59:36 host2 sshd[2090409]: Disconnected from invalid user username 23.95.198.243 port 41300 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  1 03:02:17 host2 sshd[2094526]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 03:06:04 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<7llPQ0ZHXJYv/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.230.228.16
country_id: 6252001
description:
2026-01-01 03:07:20 dovecot_plain authenticator failed for H=c-71-230-228-16.hsd1.de.comcast.net (bonave) [71.230.228.16]:53950: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 158.69.214.62
country_id: 6251999
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[158.69.214.62] [Remote Port]=[59658] [Authentication Database]=[mail] [Username]=[info@melanifinefood.com] (12/10 failures) (blocked until [Thu Jan  1 21:40:15 2026 UTC/Fri Jan  2 03:10:15 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 03:10:17 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<rbNaUkZHCumeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  1 03:12:57 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<KjfhW0ZHgLyeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  1 03:16:12 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<nQOKZ0ZHQrpCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  1 03:16:29 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<cIyPaEZHYsui8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  1 03:16:37 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<d6IBaUZHBIVn9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.137.235
country_id: 6252001
description:
Jan  1 03:17:26 host2 sshd[2113882]: Disconnected from invalid user composeruser 107.174.137.235 port 57428 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.225.122
country_id: 2921044
description:
[2026-01-01 03:17:28 +0530] info [cpaneld] 104.28.225.122 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  1 03:17:55 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<gXWmbUZHWEdniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.43.146
country_id: 6252001
description:
Jan  1 03:18:04 host2 sshd[2114780]: Disconnected from invalid user administrator 209.141.43.146 port 33164 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 03:18:34 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<xa8BcEZHVqczTcpt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.137.235
country_id: 6252001
description:
Jan  1 03:19:04 host2 sshd[2116011]: Disconnected from invalid user work 107.174.137.235 port 35508 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.174.137.235
country_id: 6252001
description:
Jan  1 03:20:06 host2 sshd[2117442]: Disconnected from invalid user publicftp 107.174.137.235 port 47862 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.43.146
country_id: 6252001
description:
Jan  1 03:19:51 host2 sshd[2116934]: Disconnected from invalid user ftpuser 209.141.43.146 port 56970 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.137.235
country_id: 6252001
description:
Jan  1 03:21:10 host2 sshd[2118645]: Disconnected from invalid user odoo13 107.174.137.235 port 38264 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.43.146
country_id: 6252001
description:
Jan  1 03:23:12 host2 sshd[2120978]: Disconnected from invalid user git 209.141.43.146 port 48108 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 03:23:37 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<VvoQgkZHHIwzTcpt>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  1 03:27:03 host2 pure-ftpd[2125732]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  1 03:26:12 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<UmtKi0ZHurUvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 03:26:51 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<dl+ijUZHusQjupN+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.141.43.146
country_id: 6252001
description:
Jan  1 03:27:21 host2 sshd[2126044]: Disconnected from invalid user oracle 209.141.43.146 port 51094 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 03:28:18 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<HLjPkkZHULeeRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.250
country_id: 1168579
description:
2026-01-01 03:28:42 dovecot_login authenticator failed for H=(250.92.zcomnetworks.com.pk) [103.148.92.250]:57766: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.254.91
country_id: 3865483
description:
2026-01-01 03:29:10 dovecot_login authenticator failed for H=(static.90.254.104.190.cps.com.ar) [190.104.254.91]:48701: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.178.27
country_id: 298795
description:
2026-01-01 03:29:28 dovecot_login authenticator failed for H=([188.59.178.27]) [188.59.178.27]:55355: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.223.116.246
country_id: 895949
description:
2026-01-01 03:30:07 dovecot_plain authenticator failed for H=(96H3V7R8Q2) [41.223.116.246]:24144: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 03:30:19 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<Qf8FmkZHrscv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  1 03:30:47 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<orejm0ZH9MWeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  1 03:32:48 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<QKHdokZHXZ5100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.202.197.108
country_id: 6252001
description:
2026-01-01 03:32:54 dovecot_plain authenticator failed for H=(unwriline) [50.202.197.108]:51565: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.223.116.246
country_id: 895949
description:
2026-01-01 03:32:56 dovecot_login authenticator failed for H=(96H3V7R8Q2) [41.223.116.246]:24144: 535 Incorrect authentication data


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  1 03:36:15 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<postfix@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<+Jcnr0ZHUu0FhXlo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-01 03:38:51 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:54748: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.83.71.110
country_id: 3017382
description:
Jan  1 03:39:49 host2 sshd[2140998]: Disconnected from invalid user donna 51.83.71.110 port 39250 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.23.189.160
country_id: 6252001
description:
Jan  1 03:40:37 host2 sshd[2142228]: Disconnected from invalid user sammy 64.23.189.160 port 39488 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  1 03:41:47 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<5Bb2wkZHmLJnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 03:42:18 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<NqzixEZH/uwjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.121.0.2
country_id: 1220409
description:
Jan  1 03:44:56 host2 sshd[2147979]: Disconnected from invalid user miladmim 185.121.0.2 port 36232 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.23.189.160
country_id: 6252001
description:
Jan  1 03:44:34 host2 sshd[2147323]: Disconnected from invalid user ansible 64.23.189.160 port 36320 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.183
country_id: 6252001
description:
Jan  1 03:46:00 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.183, lip=66.85.158.91, TLS, session=<YhYy0kZHqvPG6xi3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.83.71.110
country_id: 3017382
description:
Jan  1 03:45:15 host2 sshd[2148529]: Disconnected from invalid user admin 51.83.71.110 port 59040 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.23.189.160
country_id: 6252001
description:
Jan  1 03:46:16 host2 sshd[2150170]: Disconnected from invalid user yuri 64.23.189.160 port 55830 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  1 03:46:13 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<laLk0kZHWqai8Jp9>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.121.0.2
country_id: 1220409
description:
Jan  1 03:46:12 host2 sshd[2150004]: Disconnected from invalid user radarr 185.121.0.2 port 34014 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.78.149.220
country_id: 1605651
description:
Jan  1 03:47:32 host2 sshd[2152123]: Disconnected from invalid user bernardo 110.78.149.220 port 58380 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.121.0.2
country_id: 1220409
description:
Jan  1 03:47:59 host2 sshd[2152720]: Disconnected from invalid user cts 185.121.0.2 port 56464 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.121.0.2
country_id: 1220409
description:
Jan  1 03:48:32 host2 sshd[2153423]: Disconnected from invalid user luca 185.121.0.2 port 33936 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 110.78.149.220
country_id: 1605651
description:
Jan  1 03:48:13 host2 sshd[2153049]: Disconnected from invalid user smp 110.78.149.220 port 40710 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2026-01-01 03:55:41 dovecot_login authenticator failed for H=([65.191.211.33]) [65.191.211.33]:52568: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.56.228.149
country_id: 6252001
description:
2026-01-01 03:56:09 dovecot_login authenticator failed for H=ool-6038e495.static.optonline.net [96.56.228.149]:39682: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  1 03:59:03 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<MhDJAEdHRDFo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.85
country_id: 1210997
description:
2026-01-01 03:59:55 dovecot_login authenticator failed for H=([103.115.252.60]) [103.115.252.85]:51432: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.11.195.72
country_id: 3865483
description:
Jan  1 04:00:17 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=190.11.195.72, lip=66.85.158.91, TLS, session=<qBARBEdH8ai+C8NI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.132.223.71
country_id: 1210997
description:
2026-01-01 04:00:32 dovecot_login authenticator failed for H=([103.132.220.252]) [103.132.223.71]:45310: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.13.69.218
country_id: 3175395
description:
Jan  1 04:00:49 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<env_eng>, method=PLAIN, rip=45.13.69.218, lip=66.85.158.91, TLS, session=<nDMTBkdHGastDUXa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Jan  1 04:03:29 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<PiedEEdHDuCYNcU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.241.155.248
country_id: 6252001
description:
Jan  1 04:06:22 host2 sshd[2175374]: Disconnected from invalid user test 192.241.155.248 port 35410 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 96.8.126.57
country_id: 6252001
description:
Jan  1 04:06:51 host2 sshd[2176070]: Disconnected from invalid user test4 96.8.126.57 port 43794 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 04:07:31 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<92oKH0dHMrmeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  1 04:09:13 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<hscgJUdHCt8yBsPO>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 96.8.126.57
country_id: 6252001
description:
Jan  1 04:09:54 host2 sshd[2179993]: Disconnected from invalid user lorenzo 96.8.126.57 port 55340 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  1 04:10:54 host2 sshd[2181151]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  1 04:10:53 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<wTwUK0dHKCZniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 96.8.126.57
country_id: 6252001
description:
Jan  1 04:11:10 host2 sshd[2181776]: Disconnected from invalid user celia 96.8.126.57 port 40948 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  1 04:11:18 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<OUSXLEdHSKCi8GQy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.241.155.248
country_id: 6252001
description:
Jan  1 04:11:32 host2 sshd[2182161]: Disconnected from invalid user test 192.241.155.248 port 47118 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  1 04:15:11 host2 sshd[2186814]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 04:18:39 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<3ajURkdHWIkv/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2026-01-01 04:23:48 dovecot_plain authenticator failed for H=(permantly) [75.97.190.237]:54616: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.226.44.73
country_id: 294640
description:
2026-01-01 04:23:52 dovecot_plain authenticator failed for H=(exogeone) [109.226.44.73]:45843: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  1 04:25:00 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<78qYXUdHirdCdMzo>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.19
country_id: 2635167
description:
Jan  1 04:24:41 host2 dovecot[1911092]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.19, lip=66.85.158.92, TLS, session=<UzKVXEdH0+e594kT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.57
country_id: 6252001
description:
Jan  1 04:25:23 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.57, lip=66.85.158.92, TLS, session=<hH0UX0dHROXG6xg5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 04:25:31 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<sutrX0dHVr2eRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 04:25:51 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<HiSiYEdH9qkjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.69.9.148
country_id: 1269750
description:
Jan  1 04:25:55 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=103.69.9.148, lip=66.85.158.91, TLS, session=<BEPlX0dHlOlnRQmU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  1 04:26:40 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<AZ+NY0dH54B100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.214.138.56
country_id: 2510769
description:
Jan  1 04:26:14 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<charanaw>, method=PLAIN, rip=185.214.138.56, lip=66.85.158.91, TLS, session=<G2gWYUdHwZ651oo4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.4.145.50
country_id: 1210997
description:
Jan  1 04:26:22 host2 sshd[2202783]: Disconnected from invalid user hari 103.4.145.50 port 59906 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.4.145.50
country_id: 1210997
description:
Jan  1 04:27:59 host2 sshd[2205382]: Disconnected from invalid user nate 103.4.145.50 port 52942 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 180.23.7.134
country_id: 1861060
description:
Jan  1 04:28:20 host2 sshd[2206020]: Disconnected from invalid user ftpadmin 180.23.7.134 port 54327 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.4.145.50
country_id: 1210997
description:
Jan  1 04:28:36 host2 sshd[2206428]: Disconnected from invalid user erwin 103.4.145.50 port 36478 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.241.90
country_id: 3469034
description:
2026-01-01 04:28:52 dovecot_login authenticator failed for H=(ccabv.org.cta.gvt.net.br) [187.58.241.90]:40768: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.4.145.50
country_id: 1210997
description:
Jan  1 04:29:11 host2 sshd[2207339]: Disconnected from invalid user pokemon 103.4.145.50 port 48246 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.98.168
country_id: 3144096
description:
2026-01-01 04:29:23 dovecot_login authenticator failed for H=([84.214.98.168]) [84.214.98.168]:55252: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  1 04:29:35 host2 pure-ftpd[2207981]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 180.23.7.134
country_id: 1861060
description:
Jan  1 04:30:31 host2 sshd[2209556]: Disconnected from invalid user ansible 180.23.7.134 port 56730 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.143.71
country_id: 2328926
description:
Jan  1 04:31:16 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=152.32.143.71, lip=66.85.158.91, session=<Hf0bdEdHpuiYII9H>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 152.32.143.71
country_id: 2328926
description:
Jan  1 04:31:17 host2 dovecot[1911092]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=152.32.143.71, lip=66.85.158.91, TLS, session=<PNAwdEdHZuqYII9H>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 04:31:54 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<Ir5CdkdHYNIzTcpt>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 180.23.7.134
country_id: 1861060
description:
Jan  1 04:32:58 host2 sshd[2213061]: Disconnected from invalid user css 180.23.7.134 port 36708 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.192.212.88
country_id: 1733045
description:
2026-01-01 04:32:11 dovecot_plain authenticator failed for H=(T8FWR3M6R) [14.192.212.88]:18691: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 180.23.7.134
country_id: 1861060
description:
Jan  1 04:34:06 host2 sshd[2215027]: Disconnected from invalid user stan 180.23.7.134 port 54224 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 04:37:00 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<yyJ4iEdHGrozTcpt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.190.105
country_id: 1643084
description:
Jan  1 04:37:13 host2 sshd[2219939]: Disconnected from invalid user ubuntu 103.153.190.105 port 53435 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.198.3.69
country_id: 357994
description:
2026-01-01 04:38:52 dovecot_plain authenticator failed for H=(Q3OS5) [156.198.3.69]:22459: 535 Incorrect authentication data (set_id=lasithar@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.124.75
country_id: 1269750
description:
2026-01-01 04:39:24 dovecot_login authenticator failed for H=(abts-kk-static-182.209.166.122.airtelbroadband.in) [125.17.124.75]:38142: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.157.98.80
country_id: 453733
description:
2026-01-01 04:39:42 dovecot_login authenticator failed for H=80-98-157-37.dyn.estpak.ee [37.157.98.80]:56163: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  1 04:40:45 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<dz7jlUdHFppnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 04:41:23 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<BFcxmEdHMnQjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2026-01-01 04:41:33 dovecot_plain authenticator failed for H=c-98-204-134-124.hsd1.md.comcast.net (nicking) [98.204.134.124]:47622: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 04:42:57 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<zzDBnUdHJIsv/AU1>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.193.122
country_id: 2921044
description:
[2026-01-01 04:43:00 +0530] info [cpaneld] 104.28.193.122 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.153.190.105
country_id: 1643084
description:
Jan  1 04:44:06 host2 sshd[2230459]: Disconnected from invalid user ubuntu 103.153.190.105 port 56319 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  1 04:43:48 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<PGnRoEdH+h6i8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.142.157
country_id: 3017382
description:
2026-01-01 04:44:03 dovecot_login authenticator failed for H=157.ip-51-75-142.eu [51.75.142.157]:49354: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.51.34.229
country_id: 2510769
description:
2026-01-01 04:44:22 dovecot_login authenticator failed for H=([212.51.34.229]) [212.51.34.229]:37673: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.145.10.140
country_id: 6252001
description:
2026-01-01 04:45:04 dovecot_plain authenticator failed for H=c-76-145-10-140.hsd1.ga.comcast.net (trocatoly) [76.145.10.140]:54700: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  1 04:48:07 host2 sshd[2238234]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  1 04:48:54 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<DCAIs0dHLMIvWBNS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2026-01-01 04:48:40 dovecot_plain authenticator failed for H=c-73-195-211-98.hsd1.nj.comcast.net (synsutle) [73.195.211.98]:53910: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.81.23.49
country_id: 2750405
description:
Jan  1 04:52:39 host2 sshd[2243490]: Disconnected from invalid user odoo 45.81.23.49 port 49098 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.81.23.49
country_id: 2750405
description:
Jan  1 04:55:41 host2 sshd[2247880]: Disconnected from invalid user app 45.81.23.49 port 40770 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.81.23.49
country_id: 2750405
description:
Jan  1 04:56:51 host2 sshd[2249252]: Disconnected from invalid user ubuntu 45.81.23.49 port 48118 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  1 04:57:48 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<p5Lj0kdHzIMFhXlo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.81.23.49
country_id: 2750405
description:
Jan  1 04:57:22 host2 sshd[2250033]: Disconnected from invalid user radarr 45.81.23.49 port 33478 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.190.105
country_id: 1643084
description:
Jan  1 05:00:40 host2 sshd[2254416]: Disconnected from invalid user ali 103.153.190.105 port 45016 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  1 05:00:49 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<9ZOp3UdHOK+eRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  1 05:03:07 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<46Hd5UdHjgZniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.60.113
country_id: 953987
description:
Jan  1 05:03:32 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=102.129.60.113, lip=66.85.158.91, TLS, session=<StlQ5kdHoOpmgTxx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.139
country_id: 3469034
description:
Jan  1 05:04:03 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=187.120.72.139, lip=66.85.158.91, TLS, session=<iCs/6EdHe6W7eEiL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.109.234.38
country_id: 3625428
description:
Jan  1 05:04:17 host2 sshd[2259468]: Disconnected from invalid user anna 200.109.234.38 port 50828 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 05:05:13 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<I+pj7UdHmKWeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  1 05:06:11 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<X4ne8EdHoJmi8GQy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.108.134
country_id: 1819730
description:
Jan  1 05:05:45 host2 sshd[2261692]: Disconnected from invalid user redmine 101.36.108.134 port 40166 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.109.234.38
country_id: 3625428
description:
Jan  1 05:06:55 host2 sshd[2263190]: Disconnected from invalid user devuser 200.109.234.38 port 51898 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.5.189.133
country_id: 241170
description:
Jan  1 05:07:13 host2 sshd[2263703]: Disconnected from invalid user lisi 69.5.189.133 port 54794 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.26.153.102
country_id: 1819730
description:
2026-01-01 05:08:19 dovecot_login authenticator failed for H=([118.26.153.102]) [118.26.153.102]:39542: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.29.18.217
country_id: 1880251
description:
Jan  1 05:07:23 host2 sshd[2263880]: Disconnected from invalid user user 175.29.18.217 port 50364 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  1 05:07:42 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<PGBG9kdHLJBn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.15.93
country_id: 1269750
description:
2026-01-01 05:07:52 dovecot_login authenticator failed for H=(static.ill.117.211.15.106.bsnl.co.in) [117.211.15.93]:39748: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.232
country_id: 6252001
description:
Jan  1 05:08:56 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.232, lip=66.85.158.92, session=<bYzP+kdHLO3N0h/o>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.29.18.217
country_id: 1880251
description:
Jan  1 05:09:10 host2 sshd[2266103]: Disconnected from invalid user runner 175.29.18.217 port 46406 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.109.234.38
country_id: 3625428
description:
Jan  1 05:09:31 host2 sshd[2266488]: Disconnected from invalid user incoming 200.109.234.38 port 50772 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.29.18.217
country_id: 1880251
description:
Jan  1 05:09:44 host2 sshd[2266694]: Disconnected from invalid user john 175.29.18.217 port 55172 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  1 05:09:49 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<snDf/UdHBAdo7MS0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.109.234.38
country_id: 3625428
description:
Jan  1 05:10:48 host2 sshd[2268119]: Disconnected from invalid user ubuntu 200.109.234.38 port 37296 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.108.134
country_id: 1819730
description:
Jan  1 05:10:51 host2 sshd[2268178]: Disconnected from invalid user vikas 101.36.108.134 port 41528 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.241.24.186
country_id: 798544
description:
Jan  1 05:11:34 host2 sshd[2269058]: Disconnected from invalid user vlad 109.241.24.186 port 47424 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 175.29.18.217
country_id: 1880251
description:
Jan  1 05:11:53 host2 sshd[2269434]: Disconnected from invalid user sistema 175.29.18.217 port 51862 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.108.134
country_id: 1819730
description:
Jan  1 05:13:12 host2 sshd[2271302]: Disconnected from invalid user user 101.36.108.134 port 45448 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.5.189.133
country_id: 241170
description:
Jan  1 05:12:29 host2 sshd[2270330]: Disconnected from invalid user dev 69.5.189.133 port 36208 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.76
country_id: 6252001
description:
Jan  1 05:14:01 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.76, lip=66.85.158.92, TLS, session=<JScBDUhHuvvN0h9M>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.108.134
country_id: 1819730
description:
Jan  1 05:13:47 host2 sshd[2271963]: Disconnected from invalid user ubuntu 101.36.108.134 port 45756 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.194.250.47
country_id: 1605651
description:
Jan  1 05:13:57 host2 sshd[2272188]: Disconnected from invalid user redmine 118.194.250.47 port 55270 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.54
country_id: 1269750
description:
2026-01-01 05:16:07 dovecot_login authenticator failed for H=(nsg-corporate-54.202.186.122.airtel.in) [122.186.202.54]:39966: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.191.33
country_id: 6252001
description:
2026-01-01 05:15:46 dovecot_plain authenticator failed for H=c-73-0-191-33.hsd1.fl.comcast.net (iniciesty) [73.0.191.33]:43680: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.77.137.236
country_id: 1605651
description:
2026-01-01 05:15:48 dovecot_login authenticator failed for H=([110.77.137.236]) [110.77.137.236]:52482: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.53.254.168
country_id: 6252001
description:
2026-01-01 05:15:51 dovecot_plain authenticator failed for H=c-73-53-254-168.hsd1.fl.comcast.net (noniasslae) [73.53.254.168]:56712: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.179.128
country_id: 3996063
description:
2026-01-01 05:16:55 dovecot_login authenticator failed for H=([140.84.179.128]) [140.84.179.128]:51892: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.241.24.186
country_id: 798544
description:
Jan  1 05:17:09 host2 sshd[2276522]: Disconnected from invalid user koha 109.241.24.186 port 35314 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.138
country_id: 1269750
description:
2026-01-01 05:16:23 dovecot_login authenticator failed for H=([128.185.201.138]) [128.185.201.138]:53020: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.109.234.38
country_id: 3625428
description:
Jan  1 05:16:51 host2 sshd[2276040]: Disconnected from invalid user bot 200.109.234.38 port 60156 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  1 05:19:19 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<m2zJH0hH3tSeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  1 05:21:28 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<N7uAJ0hH/fd100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 05:23:21 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<4RdFLkhHgO2eRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 05:25:34 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<WK0oNkhH7mkjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  1 05:30:17 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<hzEKR0hHErgyBsPO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.201.208.112
country_id: 1831722
description:
2026-01-01 05:30:48 dovecot_plain authenticator failed for H=(LE7AQH53ZALJ4) [45.201.208.112]:51845: 535 Incorrect authentication data (set_id=sanjanap@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 05:31:20 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<jSTRSkhHUt4v/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  1 05:31:28 host2 sshd[2293287]: Disconnected from invalid user user 2.57.121.25 port 28224 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  1 05:31:43 host2 pure-ftpd[2293511]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  1 05:34:13 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<VgoZVUhHoqNCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Jan  1 05:39:42 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<Qga0aEhHNpWYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  1 05:40:05 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<ufMWakhHOq1nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 05:41:13 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<RRwgbkhHdt0jupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.170.26.169
country_id: 2077456
description:
2026-01-01 05:41:07 dovecot_login authenticator failed for H=(124-170-26-169.tpgi.com.au) [124.170.26.169]:33644: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  1 05:41:45 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<9kEPcEhHKtOi8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.122.247
country_id: 3144096
description:
2026-01-01 05:41:27 dovecot_login authenticator failed for H=(cm-178.232.122.247.get.no) [178.232.122.247]:43979: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 05:45:31 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<eNqKfUhHdLczTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2026-01-01 05:50:11 dovecot_plain authenticator failed for H=(sheae) [24.105.248.218]:57102: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 05:50:35 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<xWyfj0hHbMMzTcpt>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.178.224.92
country_id: 1880251
description:
Jan  1 05:53:06 host2 pure-ftpd[2314761]: (?@158.178.224.92) [INFO] New connection from 158.178.224.92


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 158.178.224.92
country_id: 1880251
description:
Jan  1 05:53:11 host2 pure-ftpd[2314831]: (?@158.178.224.92) [INFO] New connection from 158.178.224.92


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 05:54:34 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<Bk7knUhHfNIv/AU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  1 05:55:44 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<IEsLokhHlAtniu0S>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.15.108
country_id: 290557
description:
2026-01-01 05:58:47 dovecot_plain authenticator failed for H=(candrate) [5.31.15.108]:59773: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  1 06:01:04 host2 sshd[2323123]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.162
country_id: 6252001
description:
Jan  1 06:00:27 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=147.185.132.162, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<l50Os0hHMtGTuYSi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  1 06:01:19 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<74z4tUhHHsSi8GQy>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.111.228.241
country_id: 3374084
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 172.111.228.241 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 06:02:27 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<wQYRukhHWp2eRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  1 06:03:34 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<4K8RvkhHPOxn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.8.103
country_id: 3175395
description:
Jan  1 06:06:51 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=185.197.8.103, lip=66.85.158.91, TLS, session=<Ehj2yEhHhKq5xQhn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.17.125.36
country_id: 690791
description:
Jan  1 06:07:14 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<charanaw>, method=PLAIN, rip=185.17.125.36, lip=66.85.158.91, TLS, session=<vX8KykhHZLO5EX0k>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  1 06:11:37 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<r3Xh2khHvs8vWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  1 06:16:15 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<2mhq60hH0tl100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.44.77.29
country_id: 690791
description:
Jan  1 06:20:32 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=194.44.77.29, lip=66.85.158.91, TLS, session=<SYTn+UhHFKbCLE0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 06:20:40 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<TF01+0hHrr+eRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.84
country_id: 3175395
description:
Jan  1 06:21:00 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=217.26.179.84, lip=66.85.158.91, TLS, session=<R9GS+0hHldjZGrNU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  1 06:21:57 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<ocTU/0hHYnRo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 06:25:22 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<5zcIDElHnJ4jupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  1 06:27:41 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<Jk5ZFElHSr4FhXlo>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  1 06:34:21 host2 pure-ftpd[2356721]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.209
country_id: 6252001
description:
Jan  1 06:35:11 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.209, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<RDRIL0lHI9XN0h/R>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  1 06:40:11 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<15IIQUlH3JZnmud6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.70.65.25
country_id: 2328926
description:
Jan  1 06:39:40 host2 dovecot[2361401]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=146.70.65.25, lip=66.85.158.91, session=<H+lGP0lHvsaSRkEZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  1 06:39:40 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<NMAvP0lHePai8Jp9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 181.214.218.164
country_id: 2802361
description:
Jan  1 06:39:50 host2 dovecot[2361401]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=181.214.218.164, lip=66.85.158.91, TLS, session=<IobpP0lHkMi11tqk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.244.33.12
country_id: 1282988
description:
Jan  1 06:39:50 host2 dovecot[2361401]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=173.244.33.12, lip=66.85.158.91, TLS handshaking: Connection closed, session=<r9rqP0lHhsit9CEM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.133.193.28
country_id: 2629691
description:
Jan  1 06:39:39 host2 dovecot[2361401]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=45.133.193.28, lip=66.85.158.91, session=<KetDP0lHzMYthcEc>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.90.126.142
country_id: 3703430
description:
Jan  1 06:39:47 host2 pure-ftpd[2362343]: (?@91.90.126.142) [INFO] New connection from 91.90.126.142


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 98.159.40.18
country_id: 1227603
description:
Jan  1 06:39:47 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=98.159.40.18, lip=66.85.158.91, TLS handshaking: Connection closed, session=<KXGyP0lHSuVinygS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 06:41:00 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=</tLtQ0lHKOIjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 06:42:28 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<BKU0SUlHVuIv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  1 06:43:59 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<3WilTklHgopCdMzo>


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 98.191.229.175
country_id: 6252001
description:
Jan  1 06:46:09 host2 sshd[2369429]: Disconnecting authenticating user root 98.191.229.175 port 35148: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 98.191.229.175
country_id: 6252001
description:
Jan  1 06:46:09 host2 sshd[2369429]: error: maximum authentication attempts exceeded for root from 98.191.229.175 port 35148 ssh2 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 98.191.229.175
country_id: 6252001
description:
Jan  1 06:46:14 host2 sshd[2369541]: Disconnecting invalid user admin 98.191.229.175 port 36878: Too many authentication failures [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  1 06:48:30 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<zizFXklH3jdniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  1 06:50:56 host2 sshd[2373703]: Disconnected from invalid user admin 2.57.121.112 port 23638 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  1 06:52:01 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<VcBca0lHfICeRdGr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.184.108
country_id: 2921044
description:
Jan  1 06:52:53 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=46.101.184.108, lip=66.85.158.91, session=<4MiKbklHg6wuZbhs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.178.229
country_id: 2921044
description:
Jan  1 06:52:54 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=46.101.178.229, lip=66.85.158.91, session=<qoqZbklHPkQuZbLl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-01 06:54:13 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:54144: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  1 06:54:29 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<4bwrdElHjMgyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  1 06:56:43 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<iA4mfElHCq+i8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.23.68
country_id: 3144096
description:
2026-01-01 06:57:38 dovecot_login authenticator failed for H=([178.232.23.68]) [178.232.23.68]:59423: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.232.73.130
country_id: 1269750
description:
2026-01-01 06:57:58 dovecot_login authenticator failed for H=(nsg-corporate-90.179.185.122.airtel.in) [136.232.73.130]:54502: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 06:59:28 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<Rsz3hUlH8NczTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  1 07:00:28 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<OIeJiUlH/sVn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 07:00:32 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<ZuHPiUlHvpOeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 07:03:54 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<eJXelUlHyuUv/AU1>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 13.51.85.114
country_id: 2661886
description:
[2026-01-01 07:03:57 +0530] info [cpaneld] 13.51.85.114 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  1 07:03:25 host2 sshd[2386092]: Disconnected from invalid user user 2.57.121.25 port 27962 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2026-01-01 07:03:53 dovecot_plain authenticator failed for H=c-68-60-77-128.hsd1.mi.comcast.net (berdifts) [68.60.77.128]:57248: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 07:04:35 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<YwpNmElH5o8zTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  1 07:11:00 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<26c0r0lH1oSeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  1 07:11:55 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<GDiFsklHYep100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.190.155.43
country_id: 6252001
description:
2026-01-01 07:13:49 dovecot_plain authenticator failed for H=(pecebroyn) [76.190.155.43]:57848: 535 Incorrect authentication data (set_id=chris@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.190.155.43
country_id: 6252001
description:
2026-01-01 07:15:10 dovecot_plain authenticator failed for H=(procommant) [76.190.155.43]:34906: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.118.114.22
country_id: 1269750
description:
Jan  1 07:15:45 host2 sshd[2397773]: Disconnected from invalid user sysadmin 103.118.114.22 port 37426 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.62.87.27
country_id: 3469034
description:
Jan  1 07:16:36 host2 sshd[2398462]: Disconnected from invalid user ubuntu 187.62.87.27 port 42456 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Jan  1 07:17:21 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<K3/4xUlHIuWYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 07:18:40 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<6PKuyklHaIyeRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.51.34.229
country_id: 2510769
description:
2026-01-01 07:19:08 dovecot_login authenticator failed for H=(229.34.51.212.dynamic.reverse-mundo-r.com) [212.51.34.229]:60309: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.62.87.27
country_id: 3469034
description:
Jan  1 07:19:26 host2 sshd[2401207]: Disconnected from invalid user sysadmin 187.62.87.27 port 52718 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.152.90
country_id: 1605651
description:
Jan  1 07:19:37 host2 sshd[2401476]: Disconnected from invalid user scaner 27.254.152.90 port 43434 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.62.87.27
country_id: 3469034
description:
Jan  1 07:20:06 host2 sshd[2402177]: Disconnected from invalid user sftptest 187.62.87.27 port 39684 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.147.214
country_id: 1643084
description:
Jan  1 07:21:09 host2 sshd[2403141]: Disconnected from invalid user sftptest 103.187.147.214 port 55848 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.118.114.22
country_id: 1269750
description:
Jan  1 07:20:29 host2 sshd[2402566]: Disconnected from invalid user sftptest 103.118.114.22 port 54760 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.62.87.27
country_id: 3469034
description:
Jan  1 07:22:02 host2 sshd[2403838]: Disconnected from invalid user user 187.62.87.27 port 51572 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.152.90
country_id: 1605651
description:
Jan  1 07:21:28 host2 sshd[2403364]: Disconnected from invalid user zeppelin 27.254.152.90 port 40484 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.118.114.22
country_id: 1269750
description:
Jan  1 07:22:26 host2 sshd[2404169]: Disconnected from invalid user deployer 103.118.114.22 port 33832 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.62.87.27
country_id: 3469034
description:
Jan  1 07:24:02 host2 sshd[2405555]: Disconnected from invalid user test 187.62.87.27 port 42524 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 07:25:07 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<TBK24UlHYjsjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.147.92
country_id: 1643084
description:
Jan  1 07:24:52 host2 sshd[2406314]: Disconnected from invalid user webserver 103.187.147.92 port 33130 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.147.92
country_id: 1643084
description:
Jan  1 07:25:30 host2 sshd[2407195]: Disconnected from invalid user chris 103.187.147.92 port 46806 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.227.8.186
country_id: 934292
description:
Jan  1 07:25:38 host2 sshd[2407320]: Disconnected from invalid user minecraft 197.227.8.186 port 54852 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.49.129.67
country_id: 3175395
description:
Jan  1 07:25:40 host2 sshd[2407364]: Disconnected from invalid user user 151.49.129.67 port 40804 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.147.214
country_id: 1643084
description:
Jan  1 07:25:55 host2 sshd[2407566]: Disconnected from invalid user vyos 103.187.147.214 port 32936 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.187.147.92
country_id: 1643084
description:
Jan  1 07:26:06 host2 sshd[2407812]: Disconnected from invalid user user 103.187.147.92 port 33956 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.147.214
country_id: 1643084
description:
Jan  1 07:26:31 host2 sshd[2408181]: Disconnected from invalid user rabbit 103.187.147.214 port 48718 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.221.174.253
country_id: 1269750
description:
Jan  1 07:27:26 host2 sshd[2409032]: Disconnected from invalid user devuser 117.221.174.253 port 51915 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.227.8.186
country_id: 934292
description:
Jan  1 07:27:39 host2 sshd[2409228]: Disconnected from invalid user admin 197.227.8.186 port 17425 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.206.241.199
country_id: 453733
description:
Jan  1 07:27:46 host2 sshd[2409333]: Disconnected from invalid user socksuser 109.206.241.199 port 46028 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.49.129.67
country_id: 3175395
description:
Jan  1 07:29:08 host2 sshd[2410670]: Disconnected from invalid user hik 151.49.129.67 port 48974 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 98.142.247.37
country_id: 6252001
description:
Jan  1 07:29:57 host2 sshd[2411351]: Disconnected from invalid user minecraft 98.142.247.37 port 37488 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 109.206.241.199
country_id: 453733
description:
Jan  1 07:29:33 host2 sshd[2411030]: Disconnected from invalid user ubuntu 109.206.241.199 port 42000 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.49.129.67
country_id: 3175395
description:
Jan  1 07:29:44 host2 sshd[2411170]: Disconnected from invalid user otsmanager 151.49.129.67 port 40538 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 98.142.247.37
country_id: 6252001
description:
Jan  1 07:30:58 host2 sshd[2412466]: Disconnected from invalid user consultor 98.142.247.37 port 52264 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.206.241.199
country_id: 453733
description:
Jan  1 07:31:15 host2 sshd[2412686]: Disconnected from invalid user devuser 109.206.241.199 port 47906 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.53.161
country_id: 953987
description:
Jan  1 07:31:34 host2 dovecot[2361401]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=102.129.53.161, lip=66.85.158.91, TLS, session=<YGDH90lH69dmgTWh>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.49.129.67
country_id: 3175395
description:
Jan  1 07:31:56 host2 sshd[2413196]: Disconnected from invalid user toor 151.49.129.67 port 47696 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.221.174.253
country_id: 1269750
description:
Jan  1 07:31:58 host2 sshd[2413242]: Disconnected from invalid user ubuntu 117.221.174.253 port 38016 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 98.142.247.37
country_id: 6252001
description:
Jan  1 07:31:59 host2 sshd[2413266]: Received disconnect from 98.142.247.37 port 52454:11: Bye Bye [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.249.248
country_id: 3865483
description:
Jan  1 07:32:00 host2 dovecot[2361401]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info>, method=PLAIN, rip=179.0.249.248, lip=66.85.158.91, TLS, session=<Y/kV+UlHC46zAPn4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.206.241.199
country_id: 453733
description:
Jan  1 07:32:20 host2 sshd[2413553]: Disconnected from invalid user minecraft 109.206.241.199 port 42854 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 98.142.247.37
country_id: 6252001
description:
Jan  1 07:32:30 host2 sshd[2413690]: Disconnected from invalid user elasticsearch 98.142.247.37 port 34742 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 98.142.247.37
country_id: 6252001
description:
Jan  1 07:33:31 host2 sshd[2414610]: Disconnected from invalid user socksuser 98.142.247.37 port 58406 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.221.174.253
country_id: 1269750
description:
Jan  1 07:33:34 host2 sshd[2414649]: Disconnected from invalid user malik 117.221.174.253 port 52565 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.62
country_id: 1149361
description:
2026-01-01 07:33:57 dovecot_login authenticator failed for H=([149.54.62.62]) [149.54.62.62]:54002: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.127.128
country_id: 3144096
description:
2026-01-01 07:34:11 dovecot_login authenticator failed for H=(cm-46.212.127.128.get.no) [46.212.127.128]:57052: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  1 07:34:37 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<IJW5A0pHEqdo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.254.244.211
country_id: 798544
description:
2026-01-01 07:35:53 dovecot_plain authenticator failed for H=(lidgy) [94.254.244.211]:40913: 535 Incorrect authentication data (set_id=admin@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  1 07:36:10 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<lrdACUpHiOAvWBNS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.112.222.136
country_id: 3624060
description:
Jan  1 07:35:35 host2 sshd[2416582]: Disconnected from invalid user frappe 190.112.222.136 port 56486 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 117.221.174.253
country_id: 1269750
description:
Jan  1 07:36:51 host2 sshd[2417721]: Disconnected from invalid user deployment 117.221.174.253 port 53727 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  1 07:37:01 host2 pure-ftpd[2417907]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  1 07:37:41 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<MmOwDkpH8Hii8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  1 07:40:20 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<nhUcGEpHHMJnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  1 07:41:22 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<pPzTG0pHyRhniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 07:40:42 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<PRp4GUpHzlUjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.85.163.94
country_id: 6252001
description:
Jan  1 07:40:53 host2 sshd[2421563]: Disconnected from invalid user student01 34.85.163.94 port 50654 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.112.222.136
country_id: 3624060
description:
Jan  1 07:41:00 host2 sshd[2421676]: Disconnected from invalid user user 190.112.222.136 port 54712 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.85.163.94
country_id: 6252001
description:
Jan  1 07:42:10 host2 sshd[2422789]: Disconnected from invalid user user 34.85.163.94 port 51762 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 14.142.136.102
country_id: 1269750
description:
Jan  1 07:42:20 host2 sshd[2422922]: Disconnected from invalid user git 14.142.136.102 port 60984 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.92.81.41
country_id: 1819730
description:
Jan  1 07:41:43 host2 sshd[2422413]: Disconnected from invalid user ian 34.92.81.41 port 44370 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.169.138
country_id: 1819730
description:
Jan  1 07:42:33 host2 sshd[2423126]: Disconnected from invalid user nodeuser 150.5.169.138 port 59752 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.241.45.120
country_id: 1269750
description:
Jan  1 07:42:35 host2 sshd[2423141]: Disconnected from invalid user bitrix 103.241.45.120 port 56736 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.21.38.198
country_id: 1269750
description:
Jan  1 07:43:00 host2 sshd[2423494]: Disconnected from invalid user git 202.21.38.198 port 44856 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.169.138
country_id: 1819730
description:
Jan  1 07:43:54 host2 sshd[2424509]: Disconnected from invalid user bitrix 150.5.169.138 port 53296 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.254.166.113
country_id: 1269750
description:
Jan  1 07:44:20 host2 sshd[2424902]: Disconnected from invalid user user 205.254.166.113 port 54278 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.21.38.198
country_id: 1269750
description:
Jan  1 07:43:41 host2 sshd[2424349]: Disconnected from invalid user radio 202.21.38.198 port 38208 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 14.142.136.102
country_id: 1269750
description:
Jan  1 07:43:36 host2 sshd[2424283]: Disconnected from invalid user user2 14.142.136.102 port 56260 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.93.89.195
country_id: 2328926
description:
Jan  1 07:43:39 host2 sshd[2424323]: Disconnected from invalid user radio 155.93.89.195 port 52754 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.92.81.41
country_id: 1819730
description:
Jan  1 07:44:22 host2 sshd[2425002]: Disconnected from invalid user username 34.92.81.41 port 43426 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.85.163.94
country_id: 6252001
description:
Jan  1 07:44:38 host2 sshd[2425555]: Disconnected from invalid user oracle 34.85.163.94 port 42248 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.241.45.120
country_id: 1269750
description:
Jan  1 07:45:14 host2 sshd[2426379]: Disconnected from invalid user ubuntu 103.241.45.120 port 37380 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.226.118
country_id: 1880251
description:
Jan  1 07:45:44 host2 sshd[2426757]: Disconnected from invalid user dennis 45.78.226.118 port 49544 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 07:45:52 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<0jDuK0pH2usv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.85.163.94
country_id: 6252001
description:
Jan  1 07:45:52 host2 sshd[2426854]: Disconnected from invalid user test 34.85.163.94 port 60444 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.241.45.120
country_id: 1269750
description:
Jan  1 07:45:54 host2 sshd[2426880]: Disconnected from invalid user ftpuser 103.241.45.120 port 51646 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.216.211.19
country_id: 1269750
description:
Jan  1 07:45:57 host2 sshd[2426932]: Disconnected from invalid user milan 117.216.211.19 port 33154 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.169.138
country_id: 1819730
description:
Jan  1 07:46:28 host2 sshd[2427409]: Disconnected from invalid user ubuntu 150.5.169.138 port 42092 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.249.166.171
country_id: 3625428
description:
Jan  1 07:47:36 host2 sshd[2428473]: Disconnected from invalid user denise 201.249.166.171 port 41310 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.202.90
country_id: 1880251
description:
Jan  1 07:47:37 host2 sshd[2428481]: Disconnected from invalid user admin3 45.78.202.90 port 41256 [preauth]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 104.238.147.104
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 104.238.147.104: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 117.216.211.19
country_id: 1269750
description:
Jan  1 07:50:10 host2 sshd[2430858]: Disconnected from invalid user testing 117.216.211.19 port 57608 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.156.88
country_id: 1269750
description:
2026-01-01 07:51:49 dovecot_plain authenticator failed for H=(PMAJ2FF461FCD) [49.37.156.88]:59870: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.249.166.171
country_id: 3625428
description:
Jan  1 07:52:12 host2 sshd[2432710]: Disconnected from invalid user db2admin 201.249.166.171 port 36712 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.15
country_id: 1733045
description:
2026-01-01 07:52:21 dovecot_login authenticator failed for H=([49.124.151.15]) [49.124.151.15]:37138: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.226.118
country_id: 1880251
description:
Jan  1 07:51:35 host2 sshd[2432181]: Disconnected from invalid user mike 45.78.226.118 port 54208 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  1 07:51:58 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=</27CQUpHMoyi8GQy>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.189.237.92
country_id: 337996
description:
Jan  1 07:52:53 host2 sshd[2433381]: Disconnected from invalid user cloud 196.189.237.92 port 59774 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.249.166.171
country_id: 3625428
description:
Jan  1 07:52:57 host2 sshd[2433458]: Disconnected from invalid user pro 201.249.166.171 port 36718 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.202.90
country_id: 1880251
description:
Jan  1 07:53:17 host2 sshd[2433763]: Disconnected from invalid user production 45.78.202.90 port 45870 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.226.118
country_id: 1880251
description:
Jan  1 07:53:23 host2 sshd[2433898]: Disconnected from invalid user rustserver 45.78.226.118 port 56556 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-01 07:52:43 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (unhal) [87.103.126.54]:19504: 535 Incorrect authentication data (set_id=admin@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.189.237.92
country_id: 337996
description:
Jan  1 07:53:31 host2 sshd[2434065]: Disconnected from invalid user demo 196.189.237.92 port 39864 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.249.166.171
country_id: 3625428
description:
Jan  1 07:53:45 host2 sshd[2434311]: Disconnected from invalid user backups 201.249.166.171 port 36796 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.52.86
country_id: 6252001
description:
Jan  1 07:53:57 host2 sshd[2434520]: Disconnected from invalid user prova 107.174.52.86 port 34450 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  1 07:54:00 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<61cGSUpHELZCdMzo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.226.118
country_id: 1880251
description:
Jan  1 07:54:10 host2 sshd[2434998]: Disconnected from invalid user edward 45.78.226.118 port 44362 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.249.166.171
country_id: 3625428
description:
Jan  1 07:54:31 host2 sshd[2435423]: Disconnected from invalid user mysftp 201.249.166.171 port 34280 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.52.86
country_id: 6252001
description:
Jan  1 07:54:46 host2 sshd[2435603]: Disconnected from invalid user programacion 107.174.52.86 port 38856 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.226.118
country_id: 1880251
description:
Jan  1 07:55:00 host2 sshd[2435767]: Disconnected from invalid user sinusbot1 45.78.226.118 port 55052 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  1 07:55:28 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<OqI9TkpHfJkFhXlo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.52.86
country_id: 6252001
description:
Jan  1 07:55:40 host2 sshd[2436585]: Disconnected from invalid user mongod 107.174.52.86 port 34482 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.202.90
country_id: 1880251
description:
Jan  1 07:55:46 host2 sshd[2436638]: Disconnected from invalid user cloud 45.78.202.90 port 49378 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.174.52.86
country_id: 6252001
description:
Jan  1 07:56:19 host2 sshd[2437159]: Disconnected from invalid user logview 107.174.52.86 port 46154 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  1 07:56:31 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<kgL/UUpHysBn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.198.3.69
country_id: 357994
description:
2026-01-01 07:57:14 dovecot_plain authenticator failed for H=(648A5DR0V5VM) [156.198.3.69]:20437: 535 Incorrect authentication data (set_id=lasithar@ksoft.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  1 07:58:56 host2 sshd[2439851]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 07:58:33 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<DwpIWUpHFO6eRdY+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.202.90
country_id: 1880251
description:
Jan  1 07:59:26 host2 sshd[2440398]: Disconnected from invalid user webftp 45.78.202.90 port 36114 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  1 08:02:04 host2 sshd[2443591]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.81.134.125
country_id: 6252001
description:
Jan  1 08:04:31 host2 pure-ftpd[2446427]: (?@172.81.134.125) [INFO] New connection from 172.81.134.125


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  1 08:07:14 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<GgZZeEpHV9B100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  1 08:07:24 host2 sshd[2450255]: Disconnected from invalid user admin 2.57.121.112 port 39668 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 08:06:52 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<4IcNd0pHlKwv/AU1>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.219.237.116
country_id: 6252001
description:
Jan  1 08:11:35 host2 pure-ftpd[2455547]: (?@104.219.237.116) [INFO] New connection from 104.219.237.116


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2026-01-01 08:11:42 dovecot_login authenticator failed for H=([125.20.249.154]) [103.251.31.154]:39594: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.228.146
country_id: 1269750
description:
2026-01-01 08:12:13 dovecot_login authenticator failed for H=([125.20.228.146]) [125.20.228.146]:35798: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 08:13:45 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<n4yoj0pHYMgzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.34.195
country_id: 953987
description:
Jan  1 08:16:43 host2 dovecot[2361401]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=102.64.34.195, lip=66.85.158.91, TLS, session=<yKw0mUpHA8hmQCLD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 08:16:44 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<U0xWmkpHcr2eRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.89.14
country_id: 226074
description:
Jan  1 08:17:05 host2 dovecot[2361401]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<charanaw>, method=PLAIN, rip=196.0.89.14, lip=66.85.158.91, TLS, session=<gomWmkpH47fEAFkO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  1 08:17:12 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<J9H3m0pHeJwyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 08:18:52 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<deXsoUpH3KszTcpt>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.143
country_id: 6252001
description:
Jan  1 08:19:56 host2 pure-ftpd[2466524]: (?@66.132.153.143) [INFO] New connection from 66.132.153.143


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.46
country_id: 3865483
description:
2026-01-01 08:24:45 dovecot_login authenticator failed for H=([131.161.184.46]) [131.161.184.46]:38396: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 08:24:59 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<X/rMt0pHHOwjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.149.142.17
country_id: 630336
description:
2026-01-01 08:25:10 dovecot_login authenticator failed for H=([77.74.34.30]) [91.149.142.17]:40575: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.159
country_id: 6252001
description:
Jan  1 08:26:16 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 10 secs): user=<>, rip=162.216.150.159, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<s8eHvEpHr8Oi2Jaf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.159
country_id: 6252001
description:
Jan  1 08:27:15 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=162.216.150.159, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<elgIwEpHIvSi2Jaf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.159
country_id: 6252001
description:
Jan  1 08:33:00 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=162.216.150.159, lip=66.85.158.92, TLS, session=<3YiX1EpHZvei2Jaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  1 08:34:10 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<feyn2EpHv0Jniu0S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.159
country_id: 6252001
description:
Jan  1 08:34:31 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.159, lip=66.85.158.92, TLS, session=<lccK2kpHyu2i2Jaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  1 08:36:03 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<EjJr30pHgg6i8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.12.244
country_id: 3144096
description:
2026-01-01 08:38:21 dovecot_login authenticator failed for H=([84.211.12.244]) [84.211.12.244]:40932: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.136
country_id: 6252001
description:
Jan  1 08:38:29 host2 dovecot[2361401]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.136, lip=66.85.158.91, TLS: Connection closed, session=<0rM76EpH2FJChJmI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.194.94
country_id: 1733045
description:
2026-01-01 08:38:55 dovecot_login authenticator failed for H=([51.162.194.94]) [51.162.194.94]:54617: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  1 08:39:48 host2 pure-ftpd[2486705]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  1 08:40:39 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<+gTT70pHGJ1nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 08:40:43 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<+DYb8EpH3mIjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.124.202
country_id: 1269750
description:
2026-01-01 08:41:23 dovecot_login authenticator failed for H=([182.95.124.202]) [182.95.124.202]:40530: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.18.99.126
country_id: 1269750
description:
2026-01-01 08:41:35 dovecot_login authenticator failed for H=([125.18.99.126]) [125.18.99.126]:39920: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.182.134.75
country_id: 130758
description:
Jan  1 08:45:18 host2 sshd[2495019]: Disconnected from invalid user deploy 94.182.134.75 port 46488 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  1 08:45:43 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<4Bn3AUtHeMaeRdGr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 105.27.148.94
country_id: 192950
description:
Jan  1 08:45:52 host2 sshd[2496199]: Disconnected from invalid user furukawa 105.27.148.94 port 37966 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2026-01-01 08:46:03 dovecot_login authenticator failed for H=([24.105.248.218]) [24.105.248.218]:42084: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.247.47.169
country_id: 3175395
description:
2026-01-01 08:46:15 dovecot_login authenticator failed for H=host-95-247-47-169.retail.telecomitalia.it [95.247.47.169]:57476: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.161.190.230
country_id: 290291
description:
2026-01-01 08:46:20 dovecot_plain authenticator failed for H=109-161-190-230.rev.bb.zain.com (R27PCKV70FQ2DWX) [109.161.190.230]:35573: 535 Incorrect authentication data (set_id=sanjanap@ksoft.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 105.27.148.94
country_id: 192950
description:
Jan  1 08:46:33 host2 sshd[2497790]: Disconnected from invalid user ubuntu 105.27.148.94 port 52002 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.182.132.154
country_id: 1269750
description:
Jan  1 08:46:58 host2 sshd[2498487]: Disconnected from invalid user ubuntu 103.182.132.154 port 44236 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.182.132.154
country_id: 1269750
description:
Jan  1 08:48:11 host2 sshd[2500298]: Disconnected from invalid user ubuntu 103.182.132.154 port 54160 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  1 08:47:15 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<YwxuB0tHeuho7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  1 08:47:24 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<rrQBCEtHOu6i8GQy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  1 08:47:45 host2 sshd[2499749]: Disconnected from invalid user admin 2.57.121.112 port 36391 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 105.27.148.94
country_id: 192950
description:
Jan  1 08:48:31 host2 sshd[2500624]: Disconnected from invalid user ismail 105.27.148.94 port 37672 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 08:49:13 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<Kdh9DktHPtsv/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2026-01-01 08:49:53 dovecot_plain authenticator failed for H=c-71-235-225-181.hsd1.ct.comcast.net (phyng) [71.235.225.181]:52002: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.182.132.154
country_id: 1269750
description:
Jan  1 08:51:05 host2 sshd[2503249]: Disconnected from invalid user mine 103.182.132.154 port 43918 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.182.134.75
country_id: 130758
description:
Jan  1 08:51:26 host2 sshd[2503526]: Disconnected from invalid user bitrix 94.182.134.75 port 59460 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  1 08:52:30 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<y4VCGktH3rVn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Jan  1 08:55:56 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<IZ15JktHdIyYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 08:57:12 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<GJIPK0tHDtGeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  1 09:00:59 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<gXKUOEtH8IMvWBNS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.237.173.220
country_id: 6252001
description:
Jan  1 09:01:11 host2 dovecot[2361401]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.237.173.220, lip=66.85.158.92, TLS, session=<arNqOUtHMNgD7a3c>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  1 09:03:22 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<wmoSQUtH5Zt100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  1 09:05:19 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<zTQKSEtH+KxCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  1 09:05:24 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<wzhbSEtHJr2eRdGr>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.219.237.102
country_id: 6252001
description:
Jan  1 09:08:35 host2 pure-ftpd[2520765]: (?@104.219.237.102) [INFO] New connection from 104.219.237.102


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.182.187
country_id: 6252001
description:
Jan  1 09:09:46 host2 dovecot[2361401]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=165.154.182.187, lip=66.85.158.92, TLS, session=<MuYXWEtHKOelmra7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2026-01-01 09:09:13 dovecot_plain authenticator failed for H=c-174-161-27-82.hsd1.tn.comcast.net (bedroess) [174.161.27.82]:40293: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.182.187
country_id: 6252001
description:
Jan  1 09:10:14 host2 dovecot[2361401]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=165.154.182.187, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<zWbFWUtHiKqlmra7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 09:10:26 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<8aBeWktH1Osv/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.142.126.37
country_id: 6252001
description:
2026-01-01 09:10:57 dovecot_plain authenticator failed for H=c-69-142-126-37.hsd1.nj.comcast.net (dermok) [69.142.126.37]:57938: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.248.8.33
country_id: 192950
description:
Jan  1 09:11:32 host2 sshd[2523749]: Disconnected from invalid user ubuntu 197.248.8.33 port 39298 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.248.8.33
country_id: 192950
description:
Jan  1 09:13:07 host2 sshd[2525514]: Disconnected from invalid user user1 197.248.8.33 port 39124 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.171.230.200
country_id: 6252001
description:
2026-01-01 09:12:20 dovecot_plain authenticator failed for H=c-73-171-230-200.hsd1.fl.comcast.net (merfia) [73.171.230.200]:55011: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  1 09:15:44 host2 sshd[2528335]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.46.148.180
country_id: 6252001
description:
2026-01-01 09:16:03 dovecot_plain authenticator failed for H=c-68-46-148-180.hsd1.mi.comcast.net (parad) [68.46.148.180]:41712: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.194
country_id: 99237
description:
2026-01-01 09:15:28 dovecot_plain authenticator failed for H=(bebrandor) [65.20.148.194]:44938: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2026-01-01 09:15:31 dovecot_plain authenticator failed for H=c-24-1-200-187.hsd1.il.comcast.net (faldentig) [24.1.200.187]:43702: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 09:15:32 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<s6mbbEtHANWeRdY+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.248.8.33
country_id: 192950
description:
Jan  1 09:16:39 host2 sshd[2529247]: Disconnected from invalid user ubuntu 197.248.8.33 port 52778 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Jan  1 09:17:28 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.91, TLS: Connection closed, session=<RMShc0tHytWLonHU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  1 09:20:00 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<GWuNfEtHzMMFhXlo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.248.8.33
country_id: 192950
description:
Jan  1 09:20:11 host2 sshd[2533015]: Disconnected from invalid user sammy 197.248.8.33 port 38194 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  1 09:21:36 host2 sshd[2533962]: Disconnected from invalid user admin 2.57.121.112 port 28865 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.68.64.63
country_id: 2921044
description:
Jan  1 09:22:25 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=138.68.64.63, lip=66.85.158.91, session=<3sxWhUtHRyGKREA/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.248.36
country_id: 2921044
description:
Jan  1 09:22:25 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=46.101.248.36, lip=66.85.158.91, session=<avBbhUtHQnQuZfgk>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.205.128
country_id: 1880251
description:
Jan  1 09:24:25 host2 sshd[2537064]: Disconnected from invalid user ubuntu 165.154.205.128 port 43796 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 09:25:43 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<t/QKkUtHgtEjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.168.194.41
country_id: 1269750
description:
Jan  1 09:25:49 host2 sshd[2538506]: Disconnected from invalid user minecraft1 122.168.194.41 port 46038 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.168.194.41
country_id: 1269750
description:
Jan  1 09:26:30 host2 sshd[2539101]: Disconnected from invalid user engineering 122.168.194.41 port 46876 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  1 09:27:01 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<HzWrlUtH6yFniu0S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.9
country_id: 798549
description:
Jan  1 09:27:09 host2 dovecot[2361401]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=85.217.140.9, lip=66.85.158.92, TLS: Connection closed, session=<rstBlktHotlV2YwJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.9
country_id: 798549
description:
Jan  1 09:27:12 host2 dovecot[2361401]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=85.217.140.9, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<6iR3lktH7s5V2YwJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.248.8.33
country_id: 192950
description:
Jan  1 09:28:15 host2 sshd[2541010]: Disconnected from invalid user admin 197.248.8.33 port 51300 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 09:28:16 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<1nwrmktH7qQzTcpt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.205.128
country_id: 1880251
description:
Jan  1 09:28:56 host2 sshd[2541705]: Disconnected from invalid user admin 165.154.205.128 port 48422 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.25.210
country_id: 3923057
description:
Jan  1 09:31:14 host2 sshd[2544098]: Disconnected from invalid user user123 190.181.25.210 port 44859 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2026-01-01 09:31:42 dovecot_plain authenticator failed for H=c-73-213-237-28.hsd1.va.comcast.net (sorace) [73.213.237.28]:38742: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.7
country_id: 798549
description:
Jan  1 09:32:03 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=85.217.140.7, lip=66.85.158.92, session=<4U7Fp0tHTI5V2YwH>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.205.128
country_id: 1880251
description:
Jan  1 09:32:14 host2 sshd[2545125]: Disconnected from invalid user user1 165.154.205.128 port 55612 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 85.217.140.11
country_id: 798549
description:
Jan  1 09:33:19 host2 pure-ftpd[2546269]: (?@85.217.140.11) [INFO] New connection from 85.217.140.11


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 85.217.140.11
country_id: 798549
description:
Jan  1 09:33:25 host2 pure-ftpd[2546350]: (?@85.217.140.11) [INFO] New connection from 85.217.140.11


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 09:33:26 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<mbOkrEtHTLgzTcpt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.117
country_id: 6252001
description:
Jan  1 09:33:36 host2 dovecot[2361401]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=66.132.153.117, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<wZVdrUtH2hlChJl1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  1 09:35:28 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<1x/ks0tH8Cyi8Jp9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.25.210
country_id: 3923057
description:
Jan  1 09:37:31 host2 sshd[2550001]: Disconnected from invalid user ftpuser 190.181.25.210 port 43048 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.171.152.102
country_id: 783754
description:
Jan  1 09:38:55 host2 dovecot[2361401]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=31.171.152.102, lip=66.85.158.91, session=<Ie5cwEtHROAfq5hm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.133.46.26
country_id: 130758
description:
Jan  1 09:38:56 host2 dovecot[2361401]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=62.133.46.26, lip=66.85.158.91, TLS, session=<BA5kwEtHwOU+hS4a>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.25.210
country_id: 3923057
description:
Jan  1 09:39:12 host2 sshd[2551781]: Disconnected from invalid user elasticsearch 190.181.25.210 port 56715 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 217.182.64.115
country_id: 3017382
description:
Jan  1 09:38:49 host2 sshd[2551329]: Disconnected from invalid user auditor 217.182.64.115 port 56038 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.133.193.28
country_id: 2629691
description:
Jan  1 09:38:55 host2 dovecot[2361401]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=45.133.193.28, lip=66.85.158.91, session=<Hm9ZwEtHWuAthcEc>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.253.160.137
country_id: 174982
description:
Jan  1 09:38:51 host2 pure-ftpd[2551356]: (?@185.253.160.137) [INFO] New connection from 185.253.160.137


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 154.47.23.3
country_id: 1861060
description:
Jan  1 09:38:54 host2 dovecot[2361401]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=154.47.23.3, lip=66.85.158.91, session=<sZ1DwEtHTOCaLxcD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.239.194.65
country_id: 2077456
description:
Jan  1 09:38:56 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=173.239.194.65, lip=66.85.158.91, TLS, session=<FQNmwEtHlOqt78JB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.241.80.134
country_id: 1814991
description:
Jan  1 09:38:56 host2 dovecot[2361401]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=188.241.80.134, lip=66.85.158.91, TLS handshaking: Connection closed, session=<znpjwEtHvuW88VCG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 181.214.218.191
country_id: 2802361
description:
Jan  1 09:38:54 host2 dovecot[2361401]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=181.214.218.191, lip=66.85.158.91, session=<SWJHwEtHQOC11tq/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.234.138
country_id: 289688
description:
Jan  1 09:38:56 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=95.181.234.138, lip=66.85.158.91, TLS handshaking: Connection closed, session=<FMJlwEtHjOpfteqK>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 173.244.33.12
country_id: 1282988
description:
Jan  1 09:39:07 host2 pure-ftpd[2551728]: (?@173.244.33.12) [INFO] New connection from 173.244.33.12


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  1 09:40:12 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<rEzKxEtHNNEyBsPO>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.181.25.210
country_id: 3923057
description:
Jan  1 09:40:49 host2 sshd[2553632]: Disconnected from invalid user guest 190.181.25.210 port 42146 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 09:41:42 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<UqUvyktHlMwjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  1 09:41:45 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<QeNgyktHQK9nmud6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.131.195
country_id: 1819730
description:
Jan  1 09:42:56 host2 sshd[2555508]: Disconnected from invalid user airflow 152.32.131.195 port 55718 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.131.195
country_id: 1819730
description:
Jan  1 09:42:16 host2 sshd[2554979]: Disconnected from invalid user it 152.32.131.195 port 41986 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  1 09:42:42 host2 pure-ftpd[2555322]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.102.116.25
country_id: 6252001
description:
Jan  1 09:42:46 host2 sshd[2555379]: Disconnected from invalid user developer 20.102.116.25 port 38158 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.102.116.25
country_id: 6252001
description:
Jan  1 09:43:44 host2 sshd[2556294]: Disconnected from invalid user ftp_user 20.102.116.25 port 38090 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  1 09:44:00 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<k7xo0ktHFLyi8GQy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.131.195
country_id: 1819730
description:
Jan  1 09:44:15 host2 sshd[2556739]: Disconnected from invalid user django 152.32.131.195 port 54950 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.6.19.231
country_id: 3625428
description:
Jan  1 09:45:03 host2 sshd[2557926]: Disconnected from invalid user airflow 190.6.19.231 port 13696 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 217.182.64.115
country_id: 3017382
description:
Jan  1 09:45:31 host2 sshd[2558867]: Disconnected from invalid user ftp_user 217.182.64.115 port 38456 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 217.182.64.115
country_id: 3017382
description:
Jan  1 09:46:55 host2 sshd[2560293]: Disconnected from invalid user odoo17 217.182.64.115 port 45392 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.102.116.25
country_id: 6252001
description:
Jan  1 09:47:17 host2 sshd[2560643]: Disconnected from invalid user alex 20.102.116.25 port 35714 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 217.182.64.115
country_id: 3017382
description:
Jan  1 09:47:54 host2 sshd[2561203]: Received disconnect from 217.182.64.115 port 57942:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 217.182.64.115
country_id: 3017382
description:
Jan  1 09:48:23 host2 sshd[2561916]: Disconnected from invalid user west 217.182.64.115 port 47770 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  1 09:50:03 host2 sshd[2563671]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  1 09:49:14 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<2Sch5UtH3stn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 09:52:30 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<3mfL8EtHFqcv/AU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.115
country_id: 2635167
description:
Jan  1 09:52:54 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 45 secs): user=<>, rip=35.203.211.115, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<qh5i8ktHDsYjy9Nz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.115
country_id: 2635167
description:
Jan  1 09:53:24 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=35.203.211.115, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<xFQk9EtHQPYjy9Nz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 14.195.83.210
country_id: 1269750
description:
Jan  1 09:55:17 host2 sshd[2568789]: Disconnected from invalid user ftpuser 14.195.83.210 port 3770 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.151.151.79
country_id: 130758
description:
Jan  1 09:55:38 host2 sshd[2569093]: Disconnected from invalid user jacob 193.151.151.79 port 53382 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 09:56:03 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<xw+C/UtHluCeRdY+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 193.151.151.79
country_id: 130758
description:
Jan  1 09:56:34 host2 sshd[2569918]: Disconnected from invalid user proxyuser 193.151.151.79 port 59746 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.151.151.79
country_id: 130758
description:
Jan  1 09:57:25 host2 sshd[2570774]: Disconnected from invalid user dong 193.151.151.79 port 50282 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.80.35.45
country_id: 192950
description:
Jan  1 09:58:23 host2 sshd[2571814]: Disconnected from invalid user ftpuser 41.80.35.45 port 46800 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  1 09:59:57 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<B8ZtC0xHOc5100Db>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.80.35.45
country_id: 192950
description:
Jan  1 10:00:04 host2 sshd[2573610]: Disconnected from invalid user dmdba 41.80.35.45 port 42396 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 14.195.83.210
country_id: 1269750
description:
Jan  1 09:59:25 host2 sshd[2572846]: Disconnected from invalid user practicas 14.195.83.210 port 55270 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.115
country_id: 2635167
description:
Jan  1 10:00:20 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.115, lip=66.85.158.91, TLS, session=<CwT0DExHiPMjy9Nz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  1 10:00:53 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<aE7PDkxHagxo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-01 10:09:52 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:53527: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 10:13:43 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<vj+0PExHwKwv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 10:14:38 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<I3P4P0xHlMieRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  1 10:17:53 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<ZzyVS0xHVNRCdMzo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.190.155.43
country_id: 6252001
description:
2026-01-01 10:19:04 dovecot_plain authenticator failed for H=(reption) [76.190.155.43]:41402: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  1 10:20:41 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<lwWTVUxHsE1niu0S>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.159.14.187
country_id: 3469034
description:
2026-01-01 10:24:13 dovecot_login authenticator failed for H=(200-168-190-81.jandaia.com) [200.159.14.187]:53489: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.162.191
country_id: 3144096
description:
2026-01-01 10:24:43 dovecot_login authenticator failed for H=(cm-178.232.162.191.get.no) [178.232.162.191]:55206: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  1 10:26:58 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<blgQbExHjJcvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 10:27:18 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<+zA9bUxHsDcjupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.244
country_id: 6252001
description:
Jan  1 10:32:51 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 3 secs): user=<>, rip=205.210.31.244, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<e6Y5gUxHDs/N0h/0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.32.138
country_id: 953987
description:
Jan  1 10:34:33 host2 dovecot[2551472]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=102.64.32.138, lip=66.85.158.91, TLS, session=<zMHyhUxHjOlmQCCK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.212.245
country_id: 99237
description:
Jan  1 10:34:51 host2 dovecot[2551472]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=65.20.212.245, lip=66.85.158.91, TLS, session=<HqJmh0xHYI9BFNT1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  1 10:35:25 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<gQJNikxHInai8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Jan  1 10:37:21 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<7l86kUxHbIKYNcU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  1 10:40:01 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<MdXXmkxHTOYDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  1 10:41:17 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<Qjcsn0xHpOKi8GQy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  1 10:41:42 host2 dovecot[2551472]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<GPPnoExHRJoDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  1 10:42:20 host2 dovecot[2551472]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<h74lo0xH1qADjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  1 10:42:36 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<7vvzo0xHjLGeRdGr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  1 10:43:33 host2 dovecot[2551472]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<3Nl+p0xH5JEDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 10:43:36 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<ZBOLp0xHOOAjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  1 10:43:27 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<Rcz4pkxHvoxnmud6>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.178.224.92
country_id: 1880251
description:
Jan  1 10:44:22 host2 pure-ftpd[2620895]: (?@158.178.224.92) [INFO] New connection from 158.178.224.92


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 10:44:22 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<VpBLqkxHzMczTcpt>


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 158.178.224.92
country_id: 1880251
description:
Jan  1 10:44:28 host2 pure-ftpd[2620976]: (?@158.178.224.92) [INFO] New connection from 158.178.224.92


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  1 10:45:02 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<JxjLrExHMK4DjyE/>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  1 10:45:08 host2 dovecot[2551472]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<l+EsrUxHUsQDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.80.146.46
country_id: 3469034
description:
2026-01-01 10:45:44 dovecot_login authenticator failed for H=(18980204017.user.veloxzone.com.br) [189.80.146.46]:59260: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  1 10:45:44 host2 pure-ftpd[2622539]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.178.224.92
country_id: 1880251
description:
Jan  1 10:45:15 host2 pure-ftpd[2621998]: (?@158.178.224.92) [INFO] New connection from 158.178.224.92


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 158.178.224.92
country_id: 1880251
description:
Jan  1 10:45:18 host2 pure-ftpd[2622112]: (?@158.178.224.92) [INFO] New connection from 158.178.224.92


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  1 10:45:48 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<KBZZr0xHmpEFhXlo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.159.180
country_id: 1269750
description:
Jan  1 10:46:07 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=152.32.159.180, lip=66.85.158.92, TLS, session=<7VWmsExHMJWYIJ+0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.152.225.154
country_id: 6251999
description:
2026-01-01 10:46:08 dovecot_login authenticator failed for H=s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:53797: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  1 10:47:09 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<6i47tExHxORn9M4G>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  1 10:47:13 host2 dovecot[2551472]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<LGeXtExHKOkDjyE/>


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 158.178.224.92
country_id: 1880251
description:
Jan  1 10:46:12 host2 pure-ftpd[2623050]: (?@158.178.224.92) [INFO] New connection from 158.178.224.92


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.178.224.92
country_id: 1880251
description:
Jan  1 10:46:13 host2 pure-ftpd[2623067]: (?@158.178.224.92) [INFO] New connection from 158.178.224.92


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.159.180
country_id: 1269750
description:
Jan  1 10:46:17 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=152.32.159.180, lip=66.85.158.92, TLS handshaking: Connection closed, session=<7PVKsUxHRJWYIJ+0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  1 10:46:42 host2 dovecot[2551472]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<0JnKskxHkrcDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.159.180
country_id: 1269750
description:
Jan  1 10:48:04 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=152.32.159.180, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<hLert0xHDo6YIJ+0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.159.180
country_id: 1269750
description:
Jan  1 10:48:15 host2 dovecot[2551472]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=152.32.159.180, lip=66.85.158.91, TLS, session=<UCFUuExHjsGYIJ+0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  1 10:48:24 host2 dovecot[2551472]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<T9/UuExHVuYDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 10:49:45 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<JACIvUxHrJMzTcpt>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 93.174.95.106
country_id: 2750405
description:
Jan  1 10:54:09 host2 dovecot[2551472]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 3 secs): user=<>, rip=93.174.95.106, lip=66.85.158.91, session=<4dtizUxHzr1drl9q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 93.174.95.106
country_id: 2750405
description:
Jan  1 10:54:18 host2 dovecot[2551472]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=93.174.95.106, lip=66.85.158.91, session=<A83xzUxHvORdrl9q>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.6.19.231
country_id: 3625428
description:
Jan  1 10:55:08 host2 sshd[2632496]: Disconnected from invalid user test1 190.6.19.231 port 35385 [preauth]


