# incident

plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  2 08:44:09 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<WXY1Gl9HsBVniu0S>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  2 08:44:52 host2 pure-ftpd[4037608]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.187
country_id: 6252001
description:
Jan  2 08:45:00 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.187, lip=66.85.158.91, TLS, session=<nUllHV9HNPiTuYW7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.187
country_id: 6252001
description:
Jan  2 08:45:36 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.133.187, lip=66.85.158.91, TLS, session=<WSeBH19HquiTuYW7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  2 08:47:04 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<ksGYJF9HJMCi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  2 08:49:35 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<NmCeLV9HTK8vWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 08:53:59 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<ftpcPV9HtLcv/AU1>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.11.89.19
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 45.11.89.19 - kamechot "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  2 08:54:34 host2 sshd[4050140]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  2 09:00:05 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<YMEzU19H6rMyBsPO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.250.11.116
country_id: 1643084
description:
Jan  2 09:00:12 host2 sshd[4056312]: Disconnected from invalid user admin 103.250.11.116 port 57264 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.65.172.46
country_id: 6252001
description:
[2026-01-02 09:03:42 +0530] info [cpaneld] 159.65.172.46 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.250.11.116
country_id: 1643084
description:
Jan  2 09:04:38 host2 sshd[4060950]: Disconnected from invalid user ubuntu 103.250.11.116 port 44612 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.250.11.116
country_id: 1643084
description:
Jan  2 09:06:05 host2 sshd[4062662]: Disconnected from invalid user root2 103.250.11.116 port 60928 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 34.27.42.6
country_id: 6252001
description:
[2026-01-02 09:06:35 +0530] info [cpaneld] 34.27.42.6 - vdeployc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vdeployc (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.250.11.116
country_id: 1643084
description:
Jan  2 09:06:49 host2 sshd[4063349]: Disconnected from invalid user testftp 103.250.11.116 port 46442 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 09:07:16 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<N6fhbF9H/NieRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.246.151
country_id: 1269750
description:
Jan  2 09:08:31 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=103.164.246.151, lip=66.85.158.91, TLS, session=<emghcF9H76lnpPaX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.199.195
country_id: 3469034
description:
Jan  2 09:08:52 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=179.189.199.195, lip=66.85.158.91, TLS, session=<lzOhcV9HINKzvcfD>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.225.112
country_id: 1880251
description:
Jan  2 09:11:11 host2 sshd[4068175]: Disconnected from invalid user jerry 139.59.225.112 port 41404 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  2 09:11:47 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<et8BfV9H8JYFhXlo>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 95.38.101.192
country_id: 130758
description:
Jan  2 09:15:08 host2 sshd[4072422]: Disconnected from invalid user teamspeak 95.38.101.192 port 56106 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.143
country_id: 6252001
description:
Jan  2 09:16:55 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.143, lip=66.85.158.92, TLS: Connection closed, session=<S5KHj19HyNFChJmP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.76.82.176
country_id: 2750405
description:
Jan  2 09:17:26 host2 sshd[4074768]: Disconnected from invalid user ts 20.76.82.176 port 12288 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.38.101.192
country_id: 130758
description:
Jan  2 09:16:43 host2 sshd[4074045]: Disconnected from invalid user ts3server 95.38.101.192 port 56228 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.76.82.176
country_id: 2750405
description:
Jan  2 09:18:03 host2 sshd[4075413]: Disconnected from invalid user michael 20.76.82.176 port 12289 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.89.143.86
country_id: 6252001
description:
Jan  2 09:18:27 host2 sshd[4075956]: Disconnected from invalid user asep 159.89.143.86 port 50432 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.76.82.176
country_id: 2750405
description:
Jan  2 09:19:21 host2 sshd[4076900]: Disconnected from invalid user git 20.76.82.176 port 12288 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 159.89.143.86
country_id: 6252001
description:
Jan  2 09:19:29 host2 sshd[4077007]: Disconnected from invalid user jon 159.89.143.86 port 41512 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 159.89.143.86
country_id: 6252001
description:
Jan  2 09:18:58 host2 sshd[4076455]: Received disconnect from 159.89.143.86 port 57276:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.89.143.86
country_id: 6252001
description:
Jan  2 09:18:58 host2 sshd[4076455]: Disconnected from invalid user jerry 159.89.143.86 port 57276 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.225.112
country_id: 1880251
description:
Jan  2 09:20:18 host2 sshd[4077996]: Disconnected from invalid user asep 139.59.225.112 port 42114 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.23.218.198
country_id: 2921044
description:
Jan  2 09:19:30 host2 sshd[4077035]: Disconnected from invalid user orange 193.23.218.198 port 51006 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 09:19:50 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<z+vZmV9HhH0jupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.51.227
country_id: 6252001
description:
Jan  2 09:22:10 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=157.230.51.227, lip=66.85.158.92, session=<yRtGol9HKh+d5jPj>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 157.230.51.227
country_id: 6252001
description:
Jan  2 09:22:10 host2 pure-ftpd[4079881]: (?@157.230.51.227) [INFO] New connection from 157.230.51.227


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.51.227
country_id: 6252001
description:
Jan  2 09:22:30 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=157.230.51.227, lip=66.85.158.92, TLS handshaking: Connection closed, session=<FAZ5o19H3MSd5jPj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.23.218.198
country_id: 2921044
description:
Jan  2 09:23:48 host2 sshd[4081767]: Disconnected from invalid user mumbleserver 193.23.218.198 port 34234 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  2 09:24:04 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<cPDrqF9HCbR100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.160.102.30
country_id: 3489940
description:
2026-01-02 09:24:19 dovecot_plain authenticator failed for H=(8HRKD1AKEBBNP) [69.160.102.30]:18050: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 193.23.218.198
country_id: 2921044
description:
Jan  2 09:24:22 host2 sshd[4082428]: Disconnected from invalid user test01 193.23.218.198 port 58262 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 170.64.227.24
country_id: 2077456
description:
Jan  2 09:24:48 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=170.64.227.24, lip=66.85.158.91, session=<t1i5q19H/haqQOMY>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 170.64.227.24
country_id: 2077456
description:
Jan  2 09:24:48 host2 pure-ftpd[4082887]: (?@170.64.227.24) [INFO] New connection from 170.64.227.24


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 170.64.227.24
country_id: 2077456
description:
Jan  2 09:25:30 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=170.64.227.24, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<lIs8rl9HbF6qQOMY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 09:26:41 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<Tv9Ssl9HGqWeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  2 09:30:39 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<oZOCwF9HQLqi8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-02 09:30:48 dovecot_login authenticator failed for H=(QnC8Cz) [69.5.189.21]:51374: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.51.227
country_id: 6252001
description:
Jan  2 09:30:54 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=157.230.51.227, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<g+iIwV9HOQOd5jPj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-02 09:31:44 dovecot_login authenticator failed for H=(CAeeFEeW) [69.5.189.21]:60018: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 170.64.227.24
country_id: 2077456
description:
Jan  2 09:33:42 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=170.64.227.24, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<wZ+Fy19HngOqQOMY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  2 09:36:16 host2 sshd[4097362]: Disconnected from invalid user admin 2.57.121.112 port 32074 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  2 09:36:27 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<z1k/1V9HFtdn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.161.96.107
country_id: 6252001
description:
2026-01-02 09:37:18 dovecot_plain authenticator failed for H=c-73-161-96-107.hsd1.mi.comcast.net (cemer) [73.161.96.107]:57370: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.98.45.238
country_id: 6252001
description:
2026-01-02 09:37:22 dovecot_plain authenticator failed for H=c-24-98-45-238.hsd1.ga.comcast.net (clatic) [24.98.45.238]:41734: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 09:36:32 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<s0mT1V9HbIcjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  2 09:36:43 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<bHov1l9Hjqxnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Jan  2 09:39:01 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<vLdx3l9HtL2YNcU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  2 09:39:17 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<eb5m319HAh1niu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.227.236.175
country_id: 1861060
description:
Jan  2 09:39:19 host2 sshd[4100601]: Disconnected from invalid user anes 156.227.236.175 port 36708 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 09:39:22 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<s0us319Hmpcv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.140.204.135
country_id: 3996063
description:
Jan  2 09:39:37 host2 sshd[4100899]: Disconnected from invalid user ubuntu 187.140.204.135 port 53318 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.30
country_id: 1819730
description:
Jan  2 09:39:43 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=45.142.154.30, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<ffgJ4V9Hgpotjpoe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  2 09:39:55 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<GoSp4V9Hqhto7MS0>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.140.204.135
country_id: 3996063
description:
Jan  2 09:40:55 host2 sshd[4102427]: Disconnected from invalid user ubuntu 187.140.204.135 port 52882 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.28.214
country_id: 1819730
description:
Jan  2 09:41:12 host2 sshd[4102765]: Disconnected from invalid user test 154.221.28.214 port 55950 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.140.204.135
country_id: 3996063
description:
Jan  2 09:41:31 host2 sshd[4103124]: Disconnected from invalid user sftpuser 187.140.204.135 port 38532 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.140.204.135
country_id: 3996063
description:
Jan  2 09:42:44 host2 sshd[4104384]: Disconnected from invalid user ubuntu 187.140.204.135 port 38058 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.227.236.175
country_id: 1861060
description:
Jan  2 09:44:30 host2 sshd[4106132]: Disconnected from invalid user odoo 156.227.236.175 port 51418 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.90.59.75
country_id: 1880251
description:
Jan  2 09:43:33 host2 sshd[4105220]: Disconnected from invalid user ubuntu 154.90.59.75 port 43962 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.188.192
country_id: 1269750
description:
Jan  2 09:43:37 host2 sshd[4105316]: Disconnected from invalid user miguel 64.227.188.192 port 57804 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.111.162.34
country_id: 2589581
description:
Jan  2 09:43:47 host2 sshd[4105457]: Disconnected from invalid user django 41.111.162.34 port 5256 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.227.188.192
country_id: 1269750
description:
Jan  2 09:45:29 host2 sshd[4107430]: Disconnected from invalid user minh 64.227.188.192 port 42738 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.188.192
country_id: 1269750
description:
Jan  2 09:44:51 host2 sshd[4106464]: Disconnected from invalid user sshuser 64.227.188.192 port 35246 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.111.162.34
country_id: 2589581
description:
Jan  2 09:45:52 host2 sshd[4107896]: Disconnected from invalid user dino 41.111.162.34 port 21148 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.28.214
country_id: 1819730
description:
Jan  2 09:46:22 host2 sshd[4108530]: Disconnected from invalid user chen 154.221.28.214 port 58344 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.111.162.34
country_id: 2589581
description:
Jan  2 09:46:57 host2 sshd[4109378]: Disconnected from invalid user www 41.111.162.34 port 50484 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.188.192
country_id: 1269750
description:
Jan  2 09:47:19 host2 sshd[4109838]: Disconnected from invalid user ubuntu 64.227.188.192 port 44188 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.90.59.75
country_id: 1880251
description:
Jan  2 09:46:40 host2 sshd[4109035]: Disconnected from invalid user minh 154.90.59.75 port 53054 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.227.236.175
country_id: 1861060
description:
Jan  2 09:46:54 host2 sshd[4109341]: Disconnected from invalid user admin 156.227.236.175 port 60534 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  2 09:47:33 host2 pure-ftpd[4110124]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-02 09:47:38 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:65456: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  2 09:47:42 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<py1+/V9Hfsei8GQy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.28.214
country_id: 1819730
description:
Jan  2 09:47:46 host2 sshd[4110364]: Disconnected from invalid user ftp01 154.221.28.214 port 38344 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.28.214
country_id: 1819730
description:
Jan  2 09:49:11 host2 sshd[4111804]: Disconnected from invalid user server1 154.221.28.214 port 50644 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.18
country_id: 2186224
description:
2026-01-02 09:50:53 dovecot_login authenticator failed for H=([121.73.163.18]) [121.73.163.18]:54886: 535 Incorrect authentication data (set_id=office@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.214.212
country_id: 3144096
description:
2026-01-02 09:51:03 dovecot_login authenticator failed for H=(cm-84.210.214.212.get.no) [84.210.214.212]:37040: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.221.28.214
country_id: 1819730
description:
Jan  2 09:51:12 host2 sshd[4114342]: Disconnected from invalid user jimmy 154.221.28.214 port 48780 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.88.196.91
country_id: 6252001
description:
2026-01-02 09:53:05 dovecot_plain authenticator failed for H=c-73-88-196-91.hsd1.ky.comcast.net (amiscer) [73.88.196.91]:59810: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  2 09:55:47 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<csthGmBHLOKeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 10:02:31 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<Rk16MmBHUKkv/AU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  2 10:03:33 host2 dovecot[3680762]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<JzlLNmBHAIYDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  2 10:06:25 host2 dovecot[3680762]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<ZyyGQGBHcLADjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  2 10:06:38 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<1t0sQWBHnrZCdMzo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  2 10:08:53 host2 dovecot[3680762]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<bPJZSWBH3uYDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 10:09:31 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<jHuCS2BH/uueRdY+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  2 10:10:57 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<ds+7UGBHDrwDjyE/>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  2 10:11:49 host2 dovecot[3680762]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<MIzWU2BH7LUDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.122.43.59
country_id: 3469034
description:
Jan  2 10:13:17 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=138.122.43.59, lip=66.85.158.91, TLS, session=<u8v1V2BHKrOKeis7>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.178.229.240
country_id: 1880251
description:
Jan  2 10:19:30 host2 pure-ftpd[4145787]: (?@158.178.229.240) [INFO] New connection from 158.178.229.240


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.202
country_id: 1269750
description:
2026-01-02 10:19:30 dovecot_login authenticator failed for H=(dsl-ncr-static-137.78.16.125.airtelbroadband.in) [182.95.123.202]:58026: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 158.178.229.240
country_id: 1880251
description:
Jan  2 10:19:34 host2 pure-ftpd[4145862]: (?@158.178.229.240) [INFO] New connection from 158.178.229.240


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.114
country_id: 1269750
description:
2026-01-02 10:19:44 dovecot_login authenticator failed for H=([182.95.25.142]) [182.95.61.114]:58356: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.178.229.240
country_id: 1880251
description:
Jan  2 10:19:57 host2 pure-ftpd[4146294]: (?@158.178.229.240) [INFO] New connection from 158.178.229.240


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 158.178.229.240
country_id: 1880251
description:
Jan  2 10:19:59 host2 pure-ftpd[4146372]: (?@158.178.229.240) [INFO] New connection from 158.178.229.240


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.248
country_id: 1733045
description:
2026-01-02 10:20:06 dovecot_login authenticator failed for H=([49.124.152.248]) [49.124.152.248]:54778: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.89.120.125
country_id: 3469034
description:
2026-01-02 10:20:22 dovecot_login authenticator failed for H=(190.89.120.125-fo-dyn.redeultranet.com.br) [190.89.120.125]:57222: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.178.229.240
country_id: 1880251
description:
Jan  2 10:20:57 host2 pure-ftpd[4147609]: (?@158.178.229.240) [INFO] New connection from 158.178.229.240


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 158.178.229.240
country_id: 1880251
description:
Jan  2 10:20:59 host2 pure-ftpd[4147653]: (?@158.178.229.240) [INFO] New connection from 158.178.229.240


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  2 10:22:46 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<Ae/WemBH0u2eRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 10:24:10 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<jQjkf2BH0GkjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  2 10:25:17 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<tmzZg2BHnUJ100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 10:29:01 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<Y5U6kWBHupSeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  2 10:34:54 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=</2hHpmBHw0lniu0S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  2 10:34:05 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<Lo9To2BH2uSi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  2 10:34:32 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<K0n1pGBHRLwvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  2 10:35:43 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<9mowqWBHFu5n9M4G>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Jan  2 10:36:47 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.92, TLS: Connection closed, session=<4IklrWBHIpeLonHU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  2 10:38:02 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<XP5lsWBH1JkFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 10:41:04 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<MABSvGBH1okjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.59.119.141
country_id: 3017382
description:
Jan  2 10:43:08 host2 sshd[4172829]: Disconnected from invalid user vboxuser 37.59.119.141 port 38022 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  2 10:43:36 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<ieRpxWBHco0yBsPO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.124.23.196
country_id: 3996063
description:
Jan  2 10:42:57 host2 sshd[4172651]: Disconnected from invalid user test 201.124.23.196 port 36553 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.227.147.163
country_id: 6252001
description:
Jan  2 10:45:06 host2 sshd[4175135]: Disconnected from invalid user ftptest 23.227.147.163 port 34934 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.12.41.6
country_id: 6252001
description:
Jan  2 10:45:20 host2 sshd[4175572]: Disconnected from invalid user lighthouse 20.12.41.6 port 44772 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.248.104.31
country_id: 192950
description:
Jan  2 10:45:25 host2 sshd[4175629]: Disconnected from invalid user demo 197.248.104.31 port 46770 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 23.227.147.163
country_id: 6252001
description:
Jan  2 10:47:33 host2 sshd[4178140]: Disconnected from invalid user dmdba 23.227.147.163 port 37300 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  2 10:47:58 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<omD41GBH7pKi8GQy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.227.147.163
country_id: 6252001
description:
Jan  2 10:48:04 host2 sshd[4178770]: Disconnected from invalid user master 23.227.147.163 port 43722 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.12.41.6
country_id: 6252001
description:
Jan  2 10:48:11 host2 sshd[4178928]: Disconnected from invalid user milos 20.12.41.6 port 45420 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 10:48:41 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<ejKU12BH5owv/AU1>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 23.227.147.163
country_id: 6252001
description:
Jan  2 10:49:05 host2 sshd[4180078]: Received disconnect from 23.227.147.163 port 39582:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 37.59.119.141
country_id: 3017382
description:
Jan  2 10:49:03 host2 sshd[4179984]: Disconnected from invalid user fedora 37.59.119.141 port 40420 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  2 10:49:56 host2 pure-ftpd[4181094]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.12.41.6
country_id: 6252001
description:
Jan  2 10:51:04 host2 sshd[4182494]: Disconnected from invalid user server 20.12.41.6 port 48322 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.248.104.31
country_id: 192950
description:
Jan  2 10:51:27 host2 sshd[4183014]: Disconnected from invalid user bitwarden 197.248.104.31 port 35076 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.10.252.119
country_id: 1643084
description:
Jan  2 10:51:33 host2 sshd[4183160]: Disconnected from invalid user bitwarden 157.10.252.119 port 38284 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  2 10:50:59 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<ndLJ32BHYKFnmud6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.44
country_id: 6252001
description:
Jan  2 10:51:24 host2 dovecot[3680762]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=162.216.150.44, lip=66.85.158.92, session=<+1xj4WBHMvGi2JYs>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.12.41.6
country_id: 6252001
description:
Jan  2 10:52:14 host2 sshd[4184160]: Disconnected from invalid user debian 20.12.41.6 port 37176 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.124.23.196
country_id: 3996063
description:
Jan  2 10:52:29 host2 sshd[4184483]: Disconnected from invalid user postgres 201.124.23.196 port 34830 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.10.252.119
country_id: 1643084
description:
Jan  2 10:53:03 host2 sshd[4185130]: Disconnected from invalid user factorio 157.10.252.119 port 50562 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.12.41.6
country_id: 6252001
description:
Jan  2 10:55:42 host2 sshd[4188616]: Disconnected from invalid user devops 20.12.41.6 port 40566 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.124.23.196
country_id: 3996063
description:
Jan  2 10:55:24 host2 sshd[4188341]: Disconnected from invalid user ts3server 201.124.23.196 port 59966 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.16
country_id: 241170
description:
Jan  2 11:00:23 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.16, lip=66.85.158.91, session=<yZxTAWFHVNzE+2YQ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.48.78.29
country_id: 3469034
description:
Jan  2 11:09:48 host2 sshd[11575]: Disconnected from invalid user admin1 201.48.78.29 port 55002 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.48.78.29
country_id: 3469034
description:
Jan  2 11:10:10 host2 sshd[12123]: Disconnected from invalid user noaccess 201.48.78.29 port 58878 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.48.78.29
country_id: 3469034
description:
Jan  2 11:10:24 host2 sshd[12474]: Disconnected from invalid user pepper 201.48.78.29 port 33098 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  2 11:10:53 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<Ekr6JmFH9GBo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 11:11:48 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<MmdAKmFHHNov/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.145.163
country_id: 6252001
description:
Jan  2 11:11:59 host2 sshd[14172]: Disconnected from invalid user ftp_user 137.184.145.163 port 44314 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 11:12:16 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<ocPqK2FH4OqeRdY+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 137.184.145.163
country_id: 6252001
description:
Jan  2 11:12:55 host2 sshd[15197]: Disconnected from invalid user user33 137.184.145.163 port 35728 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.156.67.18
country_id: 6252001
description:
Jan  2 11:14:28 host2 sshd[17157]: Disconnected from invalid user ubuntu 12.156.67.18 port 52784 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 12.156.67.18
country_id: 6252001
description:
Jan  2 11:16:33 host2 sshd[19623]: Received disconnect from 12.156.67.18 port 38506:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 12.156.67.18
country_id: 6252001
description:
Jan  2 11:16:01 host2 sshd[19109]: Disconnected from invalid user ubuntu 12.156.67.18 port 59306 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.18.161.165
country_id: 1269750
description:
Jan  2 11:17:39 host2 sshd[20687]: Disconnected from invalid user cisco 182.18.161.165 port 50306 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.3.179.41
country_id: 6252001
description:
Jan  2 11:18:13 host2 sshd[21442]: Disconnected from invalid user ansible 192.3.179.41 port 46078 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.3.179.41
country_id: 6252001
description:
Jan  2 11:19:18 host2 sshd[22673]: Disconnected from invalid user user2 192.3.179.41 port 54840 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 192.3.179.41
country_id: 6252001
description:
Jan  2 11:20:24 host2 sshd[23904]: Disconnected from invalid user user33 192.3.179.41 port 37528 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.95
country_id: 6252001
description:
Jan  2 11:20:29 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 10 secs): user=<>, rip=162.216.150.95, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<IiVtSWFHXc+i2JZf>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 192.3.179.41
country_id: 6252001
description:
Jan  2 11:21:32 host2 sshd[25058]: Received disconnect from 192.3.179.41 port 60064:11: Bye Bye [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.95
country_id: 6252001
description:
Jan  2 11:21:49 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 24 secs): user=<>, rip=162.216.150.95, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<v9UvTmFHZP+i2JZf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.3.179.41
country_id: 6252001
description:
Jan  2 11:22:05 host2 sshd[25610]: Disconnected from invalid user ubuntu 192.3.179.41 port 50324 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.95
country_id: 6252001
description:
Jan  2 11:21:56 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 29 secs): user=<>, rip=162.216.150.95, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<SeCcTmFHivOi2JZf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.3.179.41
country_id: 6252001
description:
Jan  2 11:23:11 host2 sshd[26761]: Disconnected from invalid user ubuntu 192.3.179.41 port 36098 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.59.5.36
country_id: 1269750
description:
2026-01-02 11:25:49 dovecot_plain authenticator failed for H=(LE7AQH53ZALJ4) [152.59.5.36]:57610: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2026-01-02 11:25:59 dovecot_login authenticator failed for H=bb121-6-81-59.singnet.com.sg [121.6.81.59]:42379: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.38.0.39
country_id: 6252001
description:
2026-01-02 11:26:08 dovecot_login authenticator failed for H=([45.38.0.39]) [45.38.0.39]:2151: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.208.171
country_id: 798544
description:
Jan  2 11:27:20 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<charanaw>, method=PLAIN, rip=109.125.208.171, lip=66.85.158.91, TLS, session=<2bXtYGFHPrRtfdCr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  2 11:27:28 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<1NAnYmFHnIp100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.75.167.248
country_id: 3077311
description:
Jan  2 11:27:02 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=188.75.167.248, lip=66.85.158.91, TLS, session=<Zz/hX2FHZ6S8S6f4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  2 11:27:08 host2 dovecot[3680762]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<q+kwYWFHBuQDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  2 11:28:35 host2 dovecot[3680762]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<Vf1mZmFHgNsDhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 11:29:10 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<81JSaGFHmMkjupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.95
country_id: 6252001
description:
Jan  2 11:29:12 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.95, lip=66.85.158.92, TLS, session=<ARidaGFHxu+i2JZf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  2 11:29:46 host2 dovecot[3680762]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<FYujamFHss0DhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.95
country_id: 6252001
description:
Jan  2 11:30:28 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=162.216.150.95, lip=66.85.158.92, TLS, session=<1MEYbWFHVu6i2JZf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  2 11:31:01 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<X28cb2FHPMoDhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  2 11:31:25 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<F9ZYcGFHfCtniu0S>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  2 11:31:25 host2 dovecot[3680762]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<q+V/cGFHYN4DhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 11:32:00 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<qkR+cmFHPJWeRdY+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  2 11:32:12 host2 dovecot[3680762]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<pHlYc2FHwpQDhpQ7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.195.221.26
country_id: 934292
description:
Jan  2 11:33:55 host2 sshd[36840]: Disconnected from invalid user user1 45.195.221.26 port 64790 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  2 11:35:49 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<u4kfgGFHrLNn9M4G>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.195.221.26
country_id: 934292
description:
Jan  2 11:35:53 host2 sshd[39108]: Disconnected from invalid user git 45.195.221.26 port 19444 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.76.120.69
country_id: 1643084
description:
Jan  2 11:37:19 host2 sshd[40707]: Disconnected from invalid user dev 103.76.120.69 port 44440 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  2 11:38:22 host2 sshd[42101]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.76.120.69
country_id: 1643084
description:
Jan  2 11:38:01 host2 sshd[41634]: Disconnected from invalid user git 103.76.120.69 port 58014 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  2 11:38:14 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<fKLGiGFHlI2i8Jp9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.195.221.26
country_id: 934292
description:
Jan  2 11:38:29 host2 sshd[42185]: Disconnected from invalid user ubuntu 45.195.221.26 port 19640 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.195.221.26
country_id: 934292
description:
Jan  2 11:39:23 host2 sshd[43599]: Disconnected from invalid user max 45.195.221.26 port 55772 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.39.159
country_id: 953987
description:
Jan  2 11:40:24 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=102.64.39.159, lip=66.85.158.91, TLS, session=<Dwxjj2FHnpRmQCef>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.236.85.34
country_id: 3469034
description:
Jan  2 11:40:44 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=45.236.85.34, lip=66.85.158.91, TLS, session=<OWnAkGFH0bMt7FUi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.76.120.69
country_id: 1643084
description:
Jan  2 11:40:13 host2 sshd[44682]: Disconnected from invalid user paulo 103.76.120.69 port 51964 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  2 11:40:20 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<iPM9kGFHbulCdMzo>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.225
country_id: 6252001
description:
Jan  2 11:41:45 host2 pure-ftpd[46847]: (?@198.235.24.225) [INFO] New connection from 198.235.24.225


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Jan  2 11:45:21 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<NywvomFHgL2YNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 11:46:19 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<sVGppWFHGk8jupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  2 11:48:28 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<N2FXrWFH5IOi8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2026-01-02 11:48:55 dovecot_login authenticator failed for H=([210.177.143.61]) [210.177.143.61]:53168: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.144.14.204
country_id: 1210997
description:
2026-01-02 11:49:21 dovecot_login authenticator failed for H=(14.204.bol-online.com) [122.144.14.204]:59072: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  2 11:51:36 host2 sshd[58869]: Disconnected from invalid user user 2.57.121.25 port 30727 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  2 11:53:00 host2 pure-ftpd[60582]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 11:58:24 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<GaPe0GFHHIIv/AU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.64.98.14
country_id: 1655842
description:
Jan  2 12:01:15 host2 dovecot[3680762]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=64.64.98.14, lip=66.85.158.91, session=<oEcz22FHYMJAQGIO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 43.250.207.105
country_id: 2186224
description:
Jan  2 12:01:15 host2 dovecot[3680762]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=43.250.207.105, lip=66.85.158.91, session=<LRU222FHYNor+s9p>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.90.122.132
country_id: 3042058
description:
Jan  2 12:01:15 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.90.122.132, lip=66.85.158.91, session=<RbY222FHWMJbWnqE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.244.58.12
country_id: 2029969
description:
Jan  2 12:01:15 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=173.244.58.12, lip=66.85.158.91, session=<2B8922FHUtqt9DoM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.187.30
country_id: 1269750
description:
2026-01-02 12:03:47 dovecot_login authenticator failed for H=(nsg-corporate-81.166.185.122.airtel.in) [122.185.187.30]:50970: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.243.234.23
country_id: 6252001
description:
2026-01-02 12:03:59 dovecot_login authenticator failed for H=c-73-243-234-23.hsd1.co.comcast.net [73.243.234.23]:58476: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  2 12:05:53 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<cAmg62FH7Nhnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  2 12:05:23 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<lJTY6WFHpNIFhXlo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.26.25
country_id: 6252001
description:
Jan  2 12:10:38 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=18.97.26.25, lip=66.85.158.91, TLS handshaking: Connection closed, session=<9UnC/GFHZs4SYRoZ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  2 12:12:43 host2 sshd[82889]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 12:15:50 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<ptNBD2JH4MaeRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.149
country_id: 3996063
description:
2026-01-02 12:17:42 dovecot_login authenticator failed for H=([177.236.146.149]) [177.236.146.149]:46697: 535 Incorrect authentication data (set_id=postmaster@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.199.118.234
country_id: 1880251
description:
2026-01-02 12:18:00 dovecot_login authenticator failed for H=(448990.cloudwaysapps.com) [128.199.118.234]:58920: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.248.30.205
country_id: 1269750
description:
2026-01-02 12:20:58 dovecot_login authenticator failed for H=([103.248.30.205]) [103.248.30.205]:57039: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.98.28.43
country_id: 1269750
description:
2026-01-02 12:20:41 dovecot_login authenticator failed for H=([14.98.28.43]) [14.98.28.43]:57960: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 12:21:59 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<bHRBJWJHHJ0v/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  2 12:22:15 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<XfcrJmJHRs0vWBNS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.70.12.9
country_id: 1168579
description:
Jan  2 12:22:52 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=146.70.12.9, lip=66.85.158.91, session=<YyaKKGJHoomSRgwJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.225.28.9
country_id: 718075
description:
Jan  2 12:22:52 host2 dovecot[3680762]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=185.225.28.9, lip=66.85.158.91, session=<4U6FKGJHhOG54RwJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  2 12:29:00 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<Y4dWPmJHzQ1niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  2 12:30:13 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<zea2QmJHro4yBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  2 12:30:14 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<hki5QmJHCZp100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  2 12:34:08 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<test@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<UE5/UGJHkNmeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 12:35:14 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<dnqcVGJHkL4jupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.146
country_id: 6252001
description:
Jan  2 12:35:47 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.146, lip=66.85.158.91, session=<M6O3VmJHiu7N0h+S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 12:35:52 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<v97mVmJHkIKeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.128.110
country_id: 690791
description:
Jan  2 12:37:00 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 25 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=37.221.128.110, lip=66.85.158.91, TLS, session=<AmCaWWJH7aol3YBu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  2 12:37:08 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<L8JjW2JHdK5n9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.54.150
country_id: 953987
description:
Jan  2 12:37:50 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 25 secs): user=<env_eng>, method=PLAIN, rip=102.129.54.150, lip=66.85.158.91, TLS, session=<cGSWXGJHrLJmgTaW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.178.191.5
country_id: 2661886
description:
Jan  2 12:42:28 host2 sshd[113722]: Disconnected from invalid user lars 195.178.191.5 port 47538 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  2 12:43:40 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<nHfCcmJHlkto7MS0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  2 12:43:53 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<2uSRc2JHCjCi8Jp9>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 195.178.191.5
country_id: 2661886
description:
Jan  2 12:44:03 host2 sshd[115085]: Disconnected from invalid user public 195.178.191.5 port 53978 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.178.191.5
country_id: 2661886
description:
Jan  2 12:46:17 host2 sshd[117823]: Disconnected from invalid user justin 195.178.191.5 port 54298 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 194.164.107.5
country_id: 6252001
description:
Jan  2 12:47:13 host2 dovecot[114824]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=194.164.107.5, lip=66.85.158.92, TLS, session=<mMubf2JHqJDCpGsF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.204.219
country_id: 1643084
description:
Jan  2 12:47:35 host2 sshd[119103]: Disconnected from invalid user userftp 103.172.204.219 port 33064 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.68.9.182
country_id: 6252001
description:
Jan  2 12:48:29 host2 sshd[120077]: Disconnected from invalid user xudong 138.68.9.182 port 54928 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.172.204.219
country_id: 1643084
description:
Jan  2 12:48:34 host2 sshd[120124]: Disconnected from invalid user library 103.172.204.219 port 52568 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.17
country_id: 241170
description:
Jan  2 12:47:50 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.17, lip=66.85.158.91, session=<cx6sgWJHyu3E+2YR>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.68.9.182
country_id: 6252001
description:
Jan  2 12:48:58 host2 sshd[120526]: Disconnected from invalid user test123 138.68.9.182 port 34674 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.69
country_id: 3865483
description:
Jan  2 12:49:01 host2 dovecot[114824]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=179.0.250.69, lip=66.85.158.91, TLS, session=<JW/dhGJH0rSzAPpF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.59.125
country_id: 953987
description:
Jan  2 12:49:22 host2 dovecot[114824]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<charanaw>, method=PLAIN, rip=102.129.59.125, lip=66.85.158.91, TLS, session=<aBcphmJHZexmgTt9>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.68.9.182
country_id: 6252001
description:
Jan  2 12:49:57 host2 sshd[121737]: Disconnected from invalid user ubuntu 138.68.9.182 port 48364 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.190.155.43
country_id: 6252001
description:
2026-01-02 12:49:43 dovecot_plain authenticator failed for H=(vatmelized) [76.190.155.43]:48765: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  2 12:49:51 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<VkrliGJHRJOi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 12:52:46 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<EsRMk2JHltEjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.91.186.116
country_id: 6252001
description:
2026-01-02 12:53:59 dovecot_login authenticator failed for H=([107.91.186.116]) [107.91.186.116]:7440: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.98
country_id: 6252001
description:
2026-01-02 12:54:19 dovecot_login authenticator failed for H=syn-035-130-111-098.biz.spectrum.com [35.130.111.98]:47296: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.65.172.46
country_id: 6252001
description:
[2026-01-02 12:55:17 +0530] info [cpaneld] 159.65.172.46 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  2 12:55:53 host2 pure-ftpd[129355]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
country_id: 2510769
description:
2026-01-02 12:58:19 dovecot_login authenticator failed for H=(90.pool90-173-78.static.orange.es) [90.173.78.90]:46889: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.158.51.102
country_id: 1694008
description:
2026-01-02 12:58:40 dovecot_plain authenticator failed for H=(LF21D45A3WC8) [136.158.51.102]:26185: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.158.51.102
country_id: 1694008
description:
2026-01-02 12:58:47 dovecot_login authenticator failed for H=(LF21D45A3WC8) [136.158.51.102]:26185: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.71
country_id: 2635167
description:
Jan  2 13:00:09 host2 dovecot[114824]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.71, lip=66.85.158.92, TLS, session=<o0XZrWJH9di594lH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.234
country_id: 2635167
description:
Jan  2 13:00:10 host2 dovecot[114824]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.234, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<e1/krWJHW7lX7LDq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  2 13:00:37 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<AzlZr2JHBISeRdGr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-02 13:00:54 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:64843: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.212.194
country_id: 1269750
description:
2026-01-02 13:01:12 dovecot_login authenticator failed for H=([61.2.212.194]) [61.2.212.194]:59803: 535 Incorrect authentication data


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.239
country_id: 2635167
description:
Jan  2 13:01:16 host2 dovecot[114824]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.239, lip=66.85.158.92, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<nTvbsWJHp45X7LDv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.238
country_id: 2635167
description:
Jan  2 13:00:43 host2 dovecot[114824]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.238, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<4brfr2JHneRX7LDu>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  2 13:02:36 host2 sshd[136215]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.251
country_id: 2635167
description:
Jan  2 13:01:49 host2 dovecot[114824]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.251, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<83zWs2JHO+tX7LD7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.66
country_id: 1733045
description:
2026-01-02 13:02:00 dovecot_login authenticator failed for H=([49.124.151.66]) [49.124.151.66]:37560: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.226
country_id: 2635167
description:
Jan  2 13:02:23 host2 dovecot[114824]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.226, lip=66.85.158.92, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<rODRtWJHw+a594ni>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.242
country_id: 2635167
description:
Jan  2 13:02:56 host2 dovecot[114824]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.242, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<c0zLt2JHk+ZX7LDy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.210.73.33
country_id: 3469034
description:
2026-01-02 13:03:18 dovecot_login authenticator failed for H=(189-108-224-67.customer.tdatabrasil.net.br) [191.210.73.33]:33953: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.230
country_id: 2635167
description:
Jan  2 13:03:29 host2 dovecot[114824]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.230, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<GpPIuWJHT5K594nm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.14.36
country_id: 3144096
description:
2026-01-02 13:03:48 dovecot_login authenticator failed for H=(cm-84.211.14.36.get.no) [84.211.14.36]:39616: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.236
country_id: 2635167
description:
Jan  2 13:04:02 host2 dovecot[114824]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.236, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<x8/Du2JHaclX7LDs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.226
country_id: 2635167
description:
Jan  2 13:04:35 host2 dovecot[114824]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.226, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<a0C9vWJHvdhX7LDi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.222
country_id: 2635167
description:
Jan  2 13:05:09 host2 dovecot[114824]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.222, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<Npi4v2JHN5hX7LDe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.114
country_id: 1269750
description:
2026-01-02 13:06:18 dovecot_login authenticator failed for H=([152.52.238.86]) [182.95.184.114]:43008: 535 Incorrect authentication data (set_id=postmaster@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.54
country_id: 1149361
description:
2026-01-02 13:06:31 dovecot_login authenticator failed for H=([149.54.62.54]) [149.54.62.54]:44351: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-01-02 13:06:07 dovecot_login authenticator failed for H=([197.219.228.242]) [197.219.228.242]:37070: 535 Incorrect authentication data (set_id=postmaster@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.72.184.60
country_id: 6252001
description:
2026-01-02 13:07:55 dovecot_login authenticator failed for H=24-72-184-24-72-184-60.cpe.sparklight.net [24.72.184.60]:33016: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.90.94
country_id: 1269750
description:
2026-01-02 13:08:11 dovecot_login authenticator failed for H=([182.95.85.106]) [27.123.90.94]:41674: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 13:08:48 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<HrGlzGJHMrQv/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.5.63.166
country_id: 1694008
description:
2026-01-02 13:10:05 dovecot_login authenticator failed for H=([103.5.63.166]) [103.5.63.166]:45078: 535 Incorrect authentication data (set_id=office@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.251
country_id: 6252001
description:
Jan  2 13:10:24 host2 dovecot[114824]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.251, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<rtOB0mJHe9DG6xj7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  2 13:12:11 host2 sshd[145671]: Disconnected from invalid user user 2.57.121.25 port 6559 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  2 13:16:10 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<IKj/5mJHMNpCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 13:20:44 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<wL1f92JHirOeRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.243.234.23
country_id: 6252001
description:
2026-01-02 13:23:21 dovecot_login authenticator failed for H=c-73-243-234-23.hsd1.co.comcast.net [73.243.234.23]:49318: 535 Incorrect authentication data (set_id=contact@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  2 13:22:45 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<6DqE/mJH/o5nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  2 13:27:07 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<g9cqDmNHGDpniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.104
country_id: 3865483
description:
Jan  2 13:32:22 host2 dovecot[114824]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=179.0.250.104, lip=66.85.158.91, TLS, session=<Qu7wH2NHDdizAPpo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.30.113.241
country_id: 3175395
description:
Jan  2 13:32:01 host2 dovecot[114824]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=185.30.113.241, lip=66.85.158.91, TLS, session=<RJ2kHmNHcJC5HnHx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 13:32:15 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<ueyHIGNHDq8v/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  2 13:34:08 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<76pCJ2NH7od100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  2 13:34:22 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<uTMaKGNH7toFhXlo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.203
country_id: 3144096
description:
2026-01-02 13:34:35 dovecot_login authenticator failed for H=(cm-84.211.13.203.get.no) [84.211.13.203]:52887: 535 Incorrect authentication data (set_id=office@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.5.63.166
country_id: 1694008
description:
2026-01-02 13:34:39 dovecot_login authenticator failed for H=([103.5.63.166]) [103.5.63.166]:58065: 535 Incorrect authentication data (set_id=sales@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.254.91
country_id: 3865483
description:
2026-01-02 13:35:13 dovecot_login authenticator failed for H=(static.92.254.104.190.cps.com.ar) [190.104.254.91]:50930: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.98.8
country_id: 3144096
description:
2026-01-02 13:35:25 dovecot_login authenticator failed for H=(cm-84.215.98.8.get.no) [84.215.98.8]:50399: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2026-01-02 13:36:10 dovecot_plain authenticator failed for H=(pared) [65.20.129.28]:45006: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.15
country_id: 798549
description:
Jan  2 13:38:10 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.15, lip=66.85.158.91, session=<KW3RNWNHEKNV2ZUP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  2 13:38:26 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<VuGfNmNHWMpn9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.168.139.28
country_id: 2264397
description:
Jan  2 13:39:35 host2 sshd[173839]: Disconnected from invalid user postgres 79.168.139.28 port 50012 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 13:41:07 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<l3JAQGNHOrueRdY+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 79.168.139.28
country_id: 2264397
description:
Jan  2 13:41:10 host2 sshd[175802]: Disconnected from invalid user ubuntu 79.168.139.28 port 41930 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.14.237.154
country_id: 6252001
description:
Jan  2 13:40:52 host2 sshd[175477]: Disconnected from invalid user game 128.14.237.154 port 39586 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.108.174.4
country_id: 3469034
description:
Jan  2 13:42:03 host2 sshd[176687]: Disconnected from invalid user admin1 200.108.174.4 port 58328 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.242.226.85
country_id: 6252001
description:
Jan  2 13:42:22 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.242.226.85, lip=66.85.158.92, session=<VKLURGNHDr258uJV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.157.20
country_id: 1819730
description:
Jan  2 13:42:40 host2 sshd[177379]: Disconnected from invalid user es 150.5.157.20 port 56728 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.27.76.210
country_id: 3469034
description:
2026-01-02 13:42:08 dovecot_login authenticator failed for H=(187-8-89-120.customer.tdatabrasil.net.br) [177.27.76.210]:57069: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 13:42:24 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<fv7WRGNHOoYjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.162.102
country_id: 1269750
description:
2026-01-02 13:42:32 dovecot_login authenticator failed for H=([125.19.164.187]) [125.19.162.102]:46520: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.19.250.18
country_id: 3017382
description:
Jan  2 13:43:06 host2 sshd[177836]: Disconnected from invalid user postgres 162.19.250.18 port 43280 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 150.5.157.20
country_id: 1819730
description:
Jan  2 13:44:38 host2 sshd[179290]: Disconnected from invalid user postgres 150.5.157.20 port 41534 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 79.168.139.28
country_id: 2264397
description:
Jan  2 13:43:49 host2 sshd[178500]: Received disconnect from 79.168.139.28 port 37880:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.157.20
country_id: 1819730
description:
Jan  2 13:44:00 host2 sshd[178633]: Disconnected from invalid user devops 150.5.157.20 port 39002 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.123
country_id: 1819730
description:
Jan  2 13:44:24 host2 sshd[179069]: Disconnected from invalid user ubuntu 154.83.15.123 port 58934 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.168.139.28
country_id: 2264397
description:
Jan  2 13:44:53 host2 sshd[179540]: Disconnected from invalid user deployer 79.168.139.28 port 44282 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.52.18
country_id: 798544
description:
Jan  2 13:45:05 host2 sshd[179890]: Disconnected from invalid user eva 54.38.52.18 port 37812 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.157.20
country_id: 1819730
description:
Jan  2 13:45:56 host2 sshd[180896]: Disconnected from invalid user test 150.5.157.20 port 41164 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.243
country_id: 6252001
description:
Jan  2 13:46:33 host2 dovecot[114824]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.243, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<1pnOU2NH2tDN0h/z>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 54.38.52.18
country_id: 798544
description:
Jan  2 13:47:23 host2 sshd[182471]: Disconnected from invalid user devops 54.38.52.18 port 43602 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.238.157
country_id: 6252001
description:
Jan  2 13:46:45 host2 sshd[181738]: Disconnected from invalid user ubuntu 167.99.238.157 port 56780 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.52.18
country_id: 798544
description:
Jan  2 13:46:48 host2 sshd[181802]: Disconnected from invalid user rafael 54.38.52.18 port 38194 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 210.79.142.221
country_id: 1643084
description:
Jan  2 13:46:51 host2 sshd[181832]: Disconnected from invalid user github 210.79.142.221 port 33060 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.108.174.4
country_id: 3469034
description:
Jan  2 13:47:45 host2 sshd[182888]: Disconnected from invalid user ec2-user 200.108.174.4 port 33582 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.123
country_id: 1819730
description:
Jan  2 13:47:50 host2 sshd[183011]: Disconnected from invalid user yaroslav 154.83.15.123 port 46358 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 210.79.142.221
country_id: 1643084
description:
Jan  2 13:48:12 host2 sshd[183667]: Disconnected from invalid user nokia 210.79.142.221 port 43852 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.238.157
country_id: 6252001
description:
Jan  2 13:48:25 host2 sshd[183984]: Disconnected from invalid user deploy 167.99.238.157 port 58100 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Jan  2 13:49:14 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<TF48XWNH5MqYNcU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.19.250.18
country_id: 3017382
description:
Jan  2 13:49:03 host2 sshd[184685]: Disconnected from invalid user ubuntu 162.19.250.18 port 51398 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.238.157
country_id: 6252001
description:
Jan  2 13:49:29 host2 sshd[185525]: Disconnected from invalid user ai 167.99.238.157 port 46176 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 79.168.139.28
country_id: 2264397
description:
Jan  2 13:48:56 host2 sshd[184541]: Received disconnect from 79.168.139.28 port 60436:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.52.18
country_id: 798544
description:
Jan  2 13:49:02 host2 sshd[184619]: Disconnected from invalid user ai 54.38.52.18 port 52058 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  2 13:49:27 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<tkITXmNH6sKi8Jp9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.108.174.4
country_id: 3469034
description:
Jan  2 13:50:10 host2 sshd[186443]: Disconnected from invalid user est 200.108.174.4 port 50740 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 210.79.142.221
country_id: 1643084
description:
Jan  2 13:50:40 host2 sshd[187030]: Disconnected from invalid user adam 210.79.142.221 port 47752 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.19.250.18
country_id: 3017382
description:
Jan  2 13:49:44 host2 sshd[185778]: Disconnected from invalid user deployer 162.19.250.18 port 34298 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.108.174.4
country_id: 3469034
description:
Jan  2 13:51:01 host2 sshd[187417]: Disconnected from invalid user postgres 200.108.174.4 port 45468 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.52.18
country_id: 798544
description:
Jan  2 13:50:42 host2 sshd[187080]: Disconnected from invalid user coin 54.38.52.18 port 53670 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  2 13:51:53 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<06m+ZmNHlpWi8GQy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.70.59.165
country_id: 2264397
description:
Jan  2 13:54:49 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=146.70.59.165, lip=66.85.158.91, TLS handshaking: Connection closed, session=<MfdfcWNHqtGSRjul>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.239.217.42
country_id: 3041565
description:
Jan  2 13:54:51 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=173.239.217.42, lip=66.85.158.91, session=<CwZ3cWNH0oCt79kq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 86.106.74.252
country_id: 719819
description:
Jan  2 13:54:49 host2 dovecot[114824]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=86.106.74.252, lip=66.85.158.91, TLS, session=<JVlfcWNHbKlWakr8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 98.159.40.153
country_id: 1210997
description:
Jan  2 13:54:49 host2 dovecot[114824]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=98.159.40.153, lip=66.85.158.91, session=<zDxgcWNHzotinyiZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 156.146.55.164
country_id: 732800
description:
Jan  2 13:54:49 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=156.146.55.164, lip=66.85.158.91, TLS, session=<TIRgcWNHutGckjek>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.120.50
country_id: 1269750
description:
2026-01-02 13:55:01 dovecot_login authenticator failed for H=(nsg-static-89.234.75.182-airtel.com) [182.95.120.50]:41334: 535 Incorrect authentication data (set_id=office@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2026-01-02 13:55:22 dovecot_login authenticator failed for H=([178.250.191.189]) [178.250.191.189]:58648: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 176.125.230.135
country_id: 2562770
description:
Jan  2 13:54:49 host2 dovecot[114824]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=176.125.230.135, lip=66.85.158.91, TLS handshaking: Connection closed, session=<jSxfcWNHXKmwfeaH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.233.160
country_id: 2993457
description:
Jan  2 13:54:49 host2 dovecot[114824]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=95.181.233.160, lip=66.85.158.91, session=<41RkcWNHwItftemg>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 170.64.227.24
country_id: 2077456
description:
Jan  2 13:56:29 host2 dovecot[114824]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 2 secs): user=<>, rip=170.64.227.24, lip=66.85.158.92, TLS, session=<RW1Yd2NHvs2qQOMY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.192.85.86
country_id: 3175395
description:
2026-01-02 13:56:14 dovecot_login authenticator failed for H=([2.192.85.86]) [2.192.85.86]:55752: 535 Incorrect authentication data (set_id=postmaster@kiriaswanu.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 134.122.45.192
country_id: 6251999
description:
Jan  2 13:56:27 host2 dovecot[114824]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=134.122.45.192, lip=66.85.158.91, TLS, session=<n3M3d2NH7MSGei3A>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.142.184.55
country_id: 1210997
description:
2026-01-02 13:56:28 dovecot_login authenticator failed for H=([103.133.175.82]) [103.142.184.55]:54047: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 155.117.98.117
country_id: 6252001
description:
Jan  2 13:56:03 host2 pure-ftpd[193837]: (?@155.117.98.117) [INFO] New connection from 155.117.98.117


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.122.45.192
country_id: 6251999
description:
Jan  2 13:56:26 host2 pure-ftpd[194373]: (?@134.122.45.192) [INFO] New connection from 134.122.45.192


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.122.45.192
country_id: 6251999
description:
Jan  2 13:56:27 host2 dovecot[114824]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=134.122.45.192, lip=66.85.158.91, TLS: Connection closed, session=<Z+Uwd2NH4n2Gei3A>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 170.64.227.24
country_id: 2077456
description:
Jan  2 13:56:27 host2 dovecot[114824]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=170.64.227.24, lip=66.85.158.92, session=<P6M6d2NHuM2qQOMY>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  2 13:58:59 host2 pure-ftpd[197109]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.11
country_id: 3017382
description:
Jan  2 13:59:00 host2 dovecot[114824]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.231.89.11, lip=66.85.158.91, session=<GTROgGNH4eFb51kL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.9
country_id: 3017382
description:
Jan  2 13:59:10 host2 dovecot[114824]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.231.89.9, lip=66.85.158.91, session=<9OLsgGNHW9lb51kJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.129
country_id: 3017382
description:
Jan  2 13:59:24 host2 dovecot[114824]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=91.231.89.129, lip=66.85.158.91, session=<UmXDgWNHYehb51mB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 14:00:08 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<5qpAhGNHANAjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.226.182
country_id: 3469034
description:
2026-01-02 14:02:26 dovecot_login authenticator failed for H=(189-108-192-66.customer.tdatabrasil.net.br) [187.50.226.182]:46234: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  2 14:03:39 host2 sshd[202087]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.248.47.114
country_id: 6252001
description:
2026-01-02 14:02:43 dovecot_login authenticator failed for H=(syn-172-248-047-114.res.spectrum.com) [172.248.47.114]:53518: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.242.226.85
country_id: 6252001
description:
Jan  2 14:02:45 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.242.226.85, lip=66.85.158.91, session=</1nBjWNHtuy58uJV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.23.68
country_id: 3144096
description:
2026-01-02 14:03:04 dovecot_login authenticator failed for H=([178.232.23.68]) [178.232.23.68]:49730: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 155.117.98.117
country_id: 6252001
description:
Jan  2 14:04:47 host2 pure-ftpd[203244]: (?@155.117.98.117) [INFO] New connection from 155.117.98.117


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.172
country_id: 6252001
description:
Jan  2 14:07:10 host2 dovecot[114824]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.172, lip=66.85.158.92, TLS handshaking: Connection closed, session=<3sWDnWNHpNRAPpys>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.172
country_id: 6252001
description:
Jan  2 14:07:43 host2 dovecot[114824]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=64.62.156.172, lip=66.85.158.92, TLS: Connection closed, session=<h4J7n2NHRkBAPpys>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.63.103
country_id: 3144096
description:
2026-01-02 14:08:18 dovecot_login authenticator failed for H=([84.215.63.103]) [84.215.63.103]:39154: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.175.201.167
country_id: 3469034
description:
2026-01-02 14:15:56 dovecot_login authenticator failed for H=200.175.201.167.dynamic.dialup.gvt.net.br (corporate.static.gvt.net.br) [200.175.201.167]:43876: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.218
country_id: 337996
description:
2026-01-02 14:16:52 dovecot_login authenticator failed for H=([196.189.124.218]) [196.189.124.218]:40178: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.218.247.234
country_id: 1522867
description:
2026-01-02 14:16:37 dovecot_login authenticator failed for H=([89.218.247.234]) [89.218.247.234]:37650: 535 Incorrect authentication data (set_id=postmaster@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  2 14:19:29 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<ZBlPyWNHQpcyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 14:19:50 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<rXawymNHMJsv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  2 14:19:49 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<qFGcymNHAIBo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2026-01-02 14:21:21 dovecot_login authenticator failed for H=([103.50.5.94]) [103.50.5.94]:35979: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.40.215.162
country_id: 3469034
description:
2026-01-02 14:21:33 dovecot_login authenticator failed for H=187-40-215-162.user.veloxzone.com.br [187.40.215.162]:53278: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.24
country_id: 2186224
description:
2026-01-02 14:23:58 dovecot_login authenticator failed for H=([121.73.169.24]) [121.73.169.24]:45202: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  2 14:24:02 host2 sshd[223081]: Disconnected from invalid user admin 2.57.121.112 port 8249 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  2 14:24:58 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<IqMT3WNHGBtniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 14:26:34 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<uJHM4mNHlo+eRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.219.68.189
country_id: 3865483
description:
2026-01-02 14:30:42 dovecot_login authenticator failed for H=([201.219.68.189]) [201.219.68.189]:46398: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.155.55.174
country_id: 1880251
description:
Jan  2 14:35:35 host2 sshd[236022]: Disconnected from invalid user arma3server 107.155.55.174 port 36188 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2026-01-02 14:36:44 dovecot_plain authenticator failed for H=c-73-213-237-28.hsd1.va.comcast.net (facutroic) [73.213.237.28]:50926: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.155.55.174
country_id: 1880251
description:
Jan  2 14:36:57 host2 sshd[237422]: Disconnected from invalid user lia 107.155.55.174 port 55980 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.190
country_id: 1269750
description:
2026-01-02 14:37:12 dovecot_login authenticator failed for H=([27.123.98.190]) [27.123.98.190]:47116: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.26.194.79
country_id: 3017382
description:
2026-01-02 14:37:18 dovecot_login authenticator failed for H=([217.26.194.79]) [217.26.194.79]:39391: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.185.37.239
country_id: 1269750
description:
2026-01-02 14:37:30 dovecot_login authenticator failed for H=([136.185.37.239]) [136.185.37.239]:37545: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.155.55.174
country_id: 1880251
description:
Jan  2 14:37:38 host2 sshd[238109]: Disconnected from invalid user opc 107.155.55.174 port 39762 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.155.55.174
country_id: 1880251
description:
Jan  2 14:38:49 host2 sshd[239205]: Disconnected from invalid user cosmos 107.155.55.174 port 35540 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  2 14:39:32 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<DioiEWRHEtJn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  2 14:39:32 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<Jh4lEWRHmpZ100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  2 14:40:46 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<jj2TFWRHUItnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 14:43:52 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<WoSjIGRHJLgv/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.59.26
country_id: 1269750
description:
2026-01-02 14:44:38 dovecot_login authenticator failed for H=([125.23.125.209]) [122.187.59.26]:35486: 535 Incorrect authentication data (set_id=test@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.228.146
country_id: 1269750
description:
2026-01-02 14:44:54 dovecot_login authenticator failed for H=([125.16.32.137]) [125.20.228.146]:52098: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  2 14:45:28 host2 sshd[246647]: Disconnected from invalid user user 2.57.121.25 port 24857 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 14:46:49 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<Qmw0K2RHFOaeRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.237
country_id: 2186224
description:
2026-01-02 14:46:50 dovecot_login authenticator failed for H=([121.73.169.237]) [121.73.169.237]:46746: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 14:49:37 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<Mps+NWRHmpojupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.188.88
country_id: 6252001
description:
Jan  2 14:52:06 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=44.220.188.88, lip=66.85.158.92, TLS handshaking: Connection closed, session=<hjg9PmRHKKEs3LxY>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  2 14:53:29 host2 sshd[254728]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.241.132.152
country_id: 1269750
description:
2026-01-02 14:54:06 dovecot_login authenticator failed for H=(static.ill.117.248.107.130.bsnl.co.in) [43.241.132.152]:39602: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  2 14:54:19 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<DMv7RWRHxsqi8GQy>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 87.236.176.185
country_id: 2635167
description:
Jan  2 14:53:56 host2 pure-ftpd[255134]: (?@87.236.176.185) [INFO] New connection from 87.236.176.185


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.170.50.2
country_id: 3932488
description:
2026-01-02 14:54:38 dovecot_login authenticator failed for H=([45.170.50.2]) [45.170.50.2]:48510: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  2 14:54:47 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<VjSuR2RHHq9CdMzo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.50
country_id: 6252001
description:
Jan  2 14:54:52 host2 dovecot[114824]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.50, lip=66.85.158.91, TLS, session=<qGchSGRHkOzN0h8y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.156
country_id: 1269750
description:
2026-01-02 14:54:25 dovecot_login authenticator failed for H=([103.146.233.156]) [103.146.233.156]:34957: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  2 14:55:47 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<RBY8S2RHPhmi8Jp9>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  2 15:01:56 host2 pure-ftpd[262838]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.122
country_id: 1269750
description:
2026-01-02 15:01:59 dovecot_login authenticator failed for H=([128.185.253.122]) [128.185.253.122]:34032: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.33.112
country_id: 3144096
description:
2026-01-02 15:02:16 dovecot_login authenticator failed for H=([178.232.33.112]) [178.232.33.112]:40446: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2026-01-02 15:01:45 dovecot_login authenticator failed for H=([189.59.210.1]) [186.215.245.175]:50687: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.69.161.7
country_id: 6252001
description:
2026-01-02 15:02:01 dovecot_login authenticator failed for H=([208.69.161.7]) [208.69.161.7]:50021: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.37.179.83
country_id: 3932488
description:
2026-01-02 15:02:11 dovecot_login authenticator failed for H=([200.37.179.83]) [200.37.179.83]:51794: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 11009
name: WHM login success
abuser: 112.134.166.125
country_id: 1227603
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 112.134.166.125 NEW root:V7jHYG51wx5QRs62 address=112.134.166.125,app=whostmgrd,creator=root,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  2 16:08:32 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 6 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<ebEzT2VHhMEyBsPO>


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 112.134.166.125
country_id: 1227603
description:
Jan  2 16:09:26 host2 sshd[5286]: Accepted publickey for root from 112.134.166.125 port 54561 ssh2: RSA SHA256:C0En+cJtfOiiBlRxct5LWBK/MIchNWIDnkBuPMzsR+o


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.219.237.113
country_id: 6252001
description:
Jan  2 16:11:02 host2 pure-ftpd[6706]: (?@104.219.237.113) [INFO] New connection from 104.219.237.113


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 104.219.237.113
country_id: 6252001
description:
Jan  2 16:11:09 host2 pure-ftpd[6706]: (?@104.219.237.113) [WARNING] Authentication failed for user [neotechlk]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.131.83
country_id: 690791
description:
Jan  2 16:19:03 host2 dovecot[1870]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=37.221.131.83, lip=66.85.158.91, TLS, session=<pGMvdGVHwo8l3YNT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  2 16:18:18 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<V2phcmVHQARniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.202.100.196
country_id: 798544
description:
Jan  2 16:19:21 host2 dovecot[1870]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=85.202.100.196, lip=66.85.158.91, TLS, session=<N7dGdWVH4YxVymTE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.239.160.152
country_id: 3996063
description:
2026-01-02 16:19:36 dovecot_login authenticator failed for H=([177.239.160.152]) [177.239.160.152]:60710: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.57
country_id: 1168579
description:
2026-01-02 16:19:44 dovecot_login authenticator failed for H=(57.92.zcomnetworks.com.pk) [103.148.92.57]:34327: 535 Incorrect authentication data (set_id=test@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-02 16:20:21 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:64217: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  2 16:30:35 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<DOpTnmVHWqMFhXlo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.74.41
country_id: 1527747
description:
2026-01-02 16:31:38 dovecot_login authenticator failed for H=(92-62-74-41.saimanet.kg) [92.62.74.41]:52349: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.81
country_id: 1733045
description:
2026-01-02 16:31:19 dovecot_login authenticator failed for H=([49.124.151.81]) [49.124.151.81]:39226: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  2 16:33:46 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<xz63qWVHDL9CdMzo>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 140.245.98.125
country_id: 1880251
description:
Jan  2 16:39:11 host2 pure-ftpd[30405]: (?@140.245.98.125) [INFO] New connection from 140.245.98.125


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 140.245.98.125
country_id: 1880251
description:
Jan  2 16:39:17 host2 pure-ftpd[30496]: (?@140.245.98.125) [INFO] New connection from 140.245.98.125


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 140.245.98.125
country_id: 1880251
description:
Jan  2 16:40:06 host2 pure-ftpd[31543]: (?@140.245.98.125) [INFO] New connection from 140.245.98.125


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 140.245.98.125
country_id: 1880251
description:
Jan  2 16:40:11 host2 pure-ftpd[31698]: (?@140.245.98.125) [INFO] New connection from 140.245.98.125


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
country_id: 290557
description:
2026-01-02 16:40:18 dovecot_plain authenticator failed for H=(fetahs) [80.227.147.94]:38900: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.23.172.153
country_id: 6252001
description:
Jan  2 16:41:17 host2 sshd[32840]: Disconnected from invalid user pms 154.23.172.153 port 48460 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.0.19
country_id: 3469034
description:
2026-01-02 16:42:18 dovecot_login authenticator failed for H=(177-215-153-215.user.vivozap.com.br) [189.56.0.19]:41293: 535 Incorrect authentication data (set_id=office@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  2 16:42:19 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<McxLyGVHmuhn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.228
country_id: 99237
description:
2026-01-02 16:42:32 dovecot_login authenticator failed for H=([65.20.205.228]) [65.20.205.228]:46590: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.30.51
country_id: 6251999
description:
Jan  2 16:43:16 host2 sshd[34663]: Disconnected from invalid user alexis 51.222.30.51 port 37800 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.222.30.51
country_id: 6251999
description:
Jan  2 16:43:47 host2 sshd[35157]: Disconnected from invalid user sam 51.222.30.51 port 44966 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 16:43:53 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<zT/kzWVHoOAv/AU1>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  2 16:44:25 host2 sshd[35825]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.30.51
country_id: 6251999
description:
Jan  2 16:44:16 host2 sshd[35698]: Disconnected from invalid user rushi 51.222.30.51 port 42824 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.75.27.166
country_id: 3017382
description:
Jan  2 16:45:13 host2 sshd[36823]: Disconnected from invalid user alberto 51.75.27.166 port 39966 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.38.169
country_id: 1880251
description:
Jan  2 16:45:34 host2 sshd[37161]: Disconnected from invalid user nextcloud 128.1.38.169 port 42680 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.75.27.166
country_id: 3017382
description:
Jan  2 16:45:46 host2 sshd[37505]: Disconnected from invalid user guest1 51.75.27.166 port 56156 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.75.27.166
country_id: 3017382
description:
Jan  2 16:46:21 host2 sshd[38542]: Disconnected from invalid user michele 51.75.27.166 port 54036 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.102.57
country_id: 6252001
description:
Jan  2 16:47:21 host2 sshd[39445]: Disconnected from invalid user user 64.227.102.57 port 55878 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.48.243.18
country_id: 1819730
description:
Jan  2 16:47:31 host2 sshd[39563]: Disconnected from invalid user git 144.48.243.18 port 60282 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 128.1.38.169
country_id: 1880251
description:
Jan  2 16:48:40 host2 sshd[40605]: Disconnected from invalid user sam 128.1.38.169 port 33092 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.102.57
country_id: 6252001
description:
Jan  2 16:48:08 host2 sshd[40184]: Disconnected from invalid user sagar 64.227.102.57 port 56994 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.38.169
country_id: 1880251
description:
Jan  2 16:49:14 host2 sshd[41115]: Disconnected from invalid user elly 128.1.38.169 port 44940 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.102.57
country_id: 6252001
description:
Jan  2 16:50:24 host2 sshd[42570]: Disconnected from invalid user tempftp 64.227.102.57 port 47772 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.48.243.18
country_id: 1819730
description:
Jan  2 16:50:38 host2 sshd[42826]: Disconnected from invalid user username 144.48.243.18 port 45740 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.62
country_id: 1269750
description:
2026-01-02 16:51:47 dovecot_login authenticator failed for H=([182.95.58.62]) [182.95.58.62]:60966: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.156.1.127
country_id: 3469034
description:
2026-01-02 16:52:44 dovecot_login authenticator failed for H=([38.156.1.127]) [38.156.1.127]:41881: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  2 16:52:50 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<d7fa7WVHdbR100Db>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 144.48.243.18
country_id: 1819730
description:
Jan  2 16:53:42 host2 sshd[45687]: Disconnected from invalid user usr01 144.48.243.18 port 56328 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  2 16:57:54 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<SKL+/2VH/r6i8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 17:00:53 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<G9ewCmZHXkYjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.170
country_id: 1733045
description:
2026-01-02 17:02:51 dovecot_login authenticator failed for H=([49.124.154.170]) [49.124.154.170]:42782: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.70
country_id: 1269750
description:
2026-01-02 17:03:06 dovecot_login authenticator failed for H=([125.17.70.25]) [125.20.251.70]:45634: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 17:07:56 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<GeTaI2ZHxNsv/AU1>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  2 17:07:31 host2 pure-ftpd[61404]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.65.172.46
country_id: 6252001
description:
[2026-01-02 17:07:33 +0530] info [cpaneld] 159.65.172.46 - cloudtourssrilan_travel "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.123
country_id: 6252001
description:
Jan  2 17:07:41 host2 pure-ftpd[61596]: (?@66.132.153.123) [INFO] New connection from 66.132.153.123


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  2 17:07:52 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<MyiqI2ZHnFSi8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2026-01-02 17:12:33 dovecot_login authenticator failed for H=([182.95.228.194]) [182.95.228.194]:38822: 535 Incorrect authentication data (set_id=postmaster@kiriaswanu.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.240.219.146
country_id: 6252001
description:
Jan  2 17:12:42 host2 dovecot[1870]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=66.240.219.146, lip=66.85.158.92, session=<2nAPNWZHwt5C8NuS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.111.136.21
country_id: 294640
description:
2026-01-02 17:12:26 dovecot_login authenticator failed for H=([84.111.136.21]) [84.111.136.21]:37079: 535 Incorrect authentication data (set_id=postmaster@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.190.155.43
country_id: 6252001
description:
2026-01-02 17:13:59 dovecot_plain authenticator failed for H=(frentef) [76.190.155.43]:49409: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  2 17:14:13 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<EUhXOmZHrzRniu0S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.240.219.146
country_id: 6252001
description:
Jan  2 17:15:40 host2 dovecot[1870]: pop3-login: Disconnected: Inactivity (no auth attempts in 180 secs): user=<>, rip=66.240.219.146, lip=66.85.158.92, TLS, session=<Lv2sP2ZHBt1C8NuS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  2 17:16:51 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<4NrFQ2ZH9sZnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.250.51.2
country_id: 1168579
description:
2026-01-02 17:16:56 dovecot_login authenticator failed for H=([160.250.51.2]) [160.250.51.2]:36439: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.70.157.25
country_id: 6252001
description:
2026-01-02 17:17:11 dovecot_login authenticator failed for H=([152.70.157.25]) [152.70.157.25]:57452: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 17:17:20 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<1emCRWZH0kMjupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.10
country_id: 6252001
description:
Jan  2 17:19:28 host2 dovecot[1870]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.10, lip=66.85.158.91, TLS handshaking: Connection closed, session=<c4M+TWZHuthAPpwK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.195.4.247
country_id: 6252001
description:
2026-01-02 17:21:15 dovecot_login authenticator failed for H=(mobile-166-195-004-247.mycingular.net) [166.195.4.247]:46446: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2026-01-02 17:21:15 dovecot_login authenticator failed for H=([193.46.192.20]) [193.46.192.20]:33756: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.111.140
country_id: 1269750
description:
2026-01-02 17:21:25 dovecot_login authenticator failed for H=(abts-mum-static-140.111.170.122.airtelbroadband.in) [122.170.111.140]:35390: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.245.38
country_id: 1269750
description:
2026-01-02 17:21:29 dovecot_login authenticator failed for H=([152.52.12.201]) [152.52.245.38]:33266: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 140.245.98.125
country_id: 1880251
description:
Jan  2 17:24:45 host2 pure-ftpd[81398]: (?@140.245.98.125) [INFO] New connection from 140.245.98.125


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 140.245.98.125
country_id: 1880251
description:
Jan  2 17:24:50 host2 pure-ftpd[81504]: (?@140.245.98.125) [INFO] New connection from 140.245.98.125


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  2 17:26:05 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<XYfJZGZHxhdo7MS0>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 140.245.98.125
country_id: 1880251
description:
Jan  2 17:25:06 host2 pure-ftpd[81970]: (?@140.245.98.125) [INFO] New connection from 140.245.98.125


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 140.245.98.125
country_id: 1880251
description:
Jan  2 17:25:08 host2 pure-ftpd[82024]: (?@140.245.98.125) [INFO] New connection from 140.245.98.125


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.246.166
country_id: 798544
description:
2026-01-02 17:29:45 dovecot_login authenticator failed for H=89-67-246-166.dynamic.play.pl [89.67.246.166]:34620: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.123.45.2
country_id: 1269750
description:
2026-01-02 17:29:52 dovecot_login authenticator failed for H=([103.123.45.2]) [103.123.45.2]:57750: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.250.1
country_id: 3469034
description:
2026-01-02 17:30:06 dovecot_login authenticator failed for H=(ticons.static.gvt.net.br) [177.207.250.1]:50174: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.13.139.61
country_id: 2510769
description:
2026-01-02 17:38:37 dovecot_login authenticator failed for H=61.red-88-13-139.dynamicip.rima-tde.net [88.13.139.61]:38499: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.219.54
country_id: 1269750
description:
2026-01-02 17:38:49 dovecot_login authenticator failed for H=([128.185.219.54]) [128.185.219.54]:43768: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2026-01-02 17:38:48 dovecot_login authenticator failed for H=([125.19.175.94]) [122.184.120.98]:60798: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2026-01-02 17:41:25 dovecot_plain authenticator failed for H=c-174-166-153-20.hsd1.nj.comcast.net (hogef) [174.166.153.20]:45212: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.169.105.44
country_id: 6252001
description:
Jan  2 17:42:00 host2 dovecot[1870]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.169.105.44, lip=66.85.158.92, session=<YdHanWZHsJYUqWks>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.127.155.221
country_id: 6252001
description:
Jan  2 17:43:39 host2 dovecot[1870]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.127.155.221, lip=66.85.158.91, session=<ORO4o2ZHeOEUf5vd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  2 17:44:30 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<in+kpmZHgq9n9M4G>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.134.231
country_id: 6252001
description:
Jan  2 17:44:49 host2 dovecot[1870]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=71.6.134.231, lip=66.85.158.91, TLS, session=<LRLop2ZHVpBHBobn>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  2 17:45:40 host2 sshd[104896]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.238.122
country_id: 2542007
description:
2026-01-02 17:45:34 dovecot_plain authenticator failed for H=(deambadies) [154.146.238.122]:33656: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.218.18
country_id: 1269750
description:
2026-01-02 17:47:27 dovecot_login authenticator failed for H=([128.185.217.27]) [128.185.218.18]:39372: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.150
country_id: 1269750
description:
2026-01-02 17:47:35 dovecot_login authenticator failed for H=(nsg-corporate-177.246.185.122.airtel.in) [122.184.127.150]:50142: 535 Incorrect authentication data (set_id=test@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.9.247.58
country_id: 3469034
description:
2026-01-02 17:47:40 dovecot_login authenticator failed for H=([186.238.157.140]) [187.9.247.58]:39615: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2026-01-02 17:52:29 dovecot_plain authenticator failed for H=(herizatar) [176.113.155.132]:36835: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2026-01-02 17:52:24 dovecot_plain authenticator failed for H=c-24-15-216-41.hsd1.il.comcast.net (terry) [24.15.216.41]:48936: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.221.194
country_id: 3144096
description:
2026-01-02 17:56:11 dovecot_login authenticator failed for H=([178.232.221.194]) [178.232.221.194]:55576: 535 Incorrect authentication data (set_id=contact@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.80.73
country_id: 2077456
description:
2026-01-02 17:56:20 dovecot_login authenticator failed for H=([120.157.80.73]) [120.157.80.73]:39964: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.164.238.63
country_id: 6252001
description:
2026-01-02 17:56:25 dovecot_login authenticator failed for H=c-67-164-238-63.hsd1.il.comcast.net [67.164.238.63]:34690: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.229.14
country_id: 1269750
description:
2026-01-02 18:05:41 dovecot_login authenticator failed for H=([152.52.229.14]) [152.52.229.14]:60268: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.219.101.174
country_id: 1880251
description:
Jan  2 18:06:02 host2 sshd[127763]: Disconnected from invalid user design 8.219.101.174 port 51662 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.8.12
country_id: 614540
description:
2026-01-02 18:05:17 dovecot_login authenticator failed for H=([194.31.8.12]) [194.31.8.12]:64659: 535 Incorrect authentication data (set_id=office@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.170.150.178
country_id: 1605651
description:
2026-01-02 18:05:19 dovecot_login authenticator failed for H=([203.170.150.178]) [203.170.150.178]:56214: 535 Incorrect authentication data (set_id=office@kiriaswanu.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  2 18:10:59 host2 pure-ftpd[133272]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.226.154
country_id: 294640
description:
2026-01-02 18:14:38 dovecot_login authenticator failed for H=([147.235.226.154]) [147.235.226.154]:60412: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.164.148.87
country_id: 1512440
description:
2026-01-02 18:14:17 dovecot_login authenticator failed for H=([62.164.148.87]) [62.164.148.87]:58630: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.94.102
country_id: 290557
description:
2026-01-02 18:14:20 dovecot_login authenticator failed for H=([87.200.94.102]) [87.200.94.102]:56912: 535 Incorrect authentication data (set_id=sales@kiriaswanu.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.134.15.100
country_id: 1522867
description:
Jan  2 18:18:47 host2 sshd[141815]: Disconnected from invalid user lily 2.134.15.100 port 46566 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.106.113
country_id: 1819730
description:
Jan  2 18:21:04 host2 sshd[144460]: Disconnected from invalid user ubuntu 101.36.106.113 port 36588 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.134.15.100
country_id: 1522867
description:
Jan  2 18:21:51 host2 sshd[145578]: Disconnected from invalid user devuser 2.134.15.100 port 54396 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.70.19.11
country_id: 3469034
description:
2026-01-02 18:22:57 dovecot_login authenticator failed for H=(45-70-19-11.static.damsolutionsturbo.com.br) [45.70.19.11]:56514: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.232.114.16
country_id: 3865483
description:
2026-01-02 18:23:06 dovecot_login authenticator failed for H=(OL16-114.fibertel.com.ar) [24.232.114.16]:47743: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.106.113
country_id: 1819730
description:
Jan  2 18:22:23 host2 sshd[146534]: Disconnected from invalid user ubuntu 101.36.106.113 port 46906 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  2 18:22:51 host2 dovecot[1870]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<h4vyL2dHbLoDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.23.68
country_id: 3144096
description:
2026-01-02 18:23:15 dovecot_login authenticator failed for H=(cm-178.232.23.68.get.no) [178.232.23.68]:54025: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  2 18:23:16 host2 dovecot[1870]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: Connection closed, session=<uSJmMWdHmoYDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.126
country_id: 1269750
description:
2026-01-02 18:23:12 dovecot_login authenticator failed for H=([122.185.152.190]) [182.95.178.126]:60554: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.134.15.100
country_id: 1522867
description:
Jan  2 18:24:20 host2 sshd[148302]: Disconnected from invalid user rtc 2.134.15.100 port 38374 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.31.164.124
country_id: 6252001
description:
2026-01-02 18:25:32 dovecot_plain authenticator failed for H=c-76-31-164-124.hsd1.tx.comcast.net (gascrodge) [76.31.164.124]:42232: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  2 18:25:38 host2 dovecot[1870]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<QG/eOWdHOrYDhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  2 18:26:40 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<O6F1PWdHcqtIpyJ4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  2 18:26:38 host2 dovecot[1870]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS, session=<5l15PWdHBrIDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  2 18:27:32 host2 dovecot[1870]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS, session=</x2xQGdHTOoDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  2 18:28:31 host2 dovecot[1870]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<DQ43RGdHuOEDhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.225.40.153
country_id: 6252001
description:
Jan  2 18:28:56 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=64.225.40.153, lip=66.85.158.91, session=<Sw6NRWdH6spA4SiZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  2 18:29:19 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<dr3pRmdHTNFyB6Oa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  2 18:29:29 host2 dovecot[1870]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<hIChR2dHIKUDhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  2 18:30:25 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<46DVSmdHBIMUOAHJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  2 18:30:27 host2 dovecot[1870]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: Connection closed, session=<tBUaS2dHgrcDhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.234.136.51
country_id: 690791
description:
Jan  2 18:30:50 host2 dovecot[1870]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=91.234.136.51, lip=66.85.158.91, TLS, session=<DPJ9S2dHKrBb6ogz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  2 18:31:29 host2 dovecot[1870]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS, session=<FKnITmdHhOcDhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  2 18:31:31 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<LJPFTmdH8oVnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.164.148.87
country_id: 1512440
description:
2026-01-02 18:31:45 dovecot_login authenticator failed for H=([62.164.148.87]) [62.164.148.87]:58640: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.45.251
country_id: 953987
description:
Jan  2 18:31:13 host2 dovecot[1870]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<charanaw>, method=PLAIN, rip=102.64.45.251, lip=66.85.158.91, TLS, session=<vJukTGdH641mQC37>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.92.171.7
country_id: 6252001
description:
Jan  2 18:31:20 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@ceylondigest.com>, method=PLAIN, rip=190.92.171.7, lip=66.85.158.91, session=<pkUkTmdHdJ2+XKsH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.93.90
country_id: 1269750
description:
2026-01-02 18:31:23 dovecot_login authenticator failed for H=([182.95.20.228]) [122.186.93.90]:37808: 535 Incorrect authentication data (set_id=postmaster@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  2 18:33:53 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<bxFKV2dHAoIv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  2 18:33:40 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<xwh0VmdHBjquijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  2 18:33:48 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<L7L6VmdHss4v/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  2 18:34:39 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<y4gAWmdHpuwyBvlc>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  2 18:35:50 host2 sshd[161511]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  2 18:35:47 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<CfgIXmdH2IJn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.53.44.125
country_id: 1643084
description:
Jan  2 18:35:47 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=117.53.44.125, lip=66.85.158.91, session=<dt4JXmdH2rN1NSx9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.15
country_id: 241170
description:
Jan  2 18:36:24 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.15, lip=66.85.158.91, session=<1MpEYGdH5ofE+2YP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  2 18:36:26 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<LLZjYGdHFI5npBQq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.133
country_id: 6252001
description:
Jan  2 18:38:40 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.133, lip=66.85.158.91, TLS: Connection closed, session=<JGd/aGdH5L5ChJmF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan  2 18:38:44 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<8dCcaGdHcNov/lVz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.236.132
country_id: 614540
description:
Jan  2 18:40:06 host2 dovecot[165786]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=95.181.236.132, lip=66.85.158.91, session=<7YmcbWdHiLlfteyE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.239.220.5
country_id: 3658394
description:
Jan  2 18:40:07 host2 dovecot[165786]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=173.239.220.5, lip=66.85.158.91, TLS handshaking: Connection closed, session=<FoarbWdHwLyt79wF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.233.168
country_id: 2993457
description:
Jan  2 18:40:06 host2 dovecot[165786]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=95.181.233.168, lip=66.85.158.91, session=<Y12ZbWdHjrlftemo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.225.40.153
country_id: 6252001
description:
Jan  2 18:39:11 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=64.225.40.153, lip=66.85.158.91, session=<kYU4amdHAJNA4SiZ>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 188.241.80.140
country_id: 1814991
description:
Jan  2 18:40:01 host2 pure-ftpd[166747]: (?@188.241.80.140) [INFO] New connection from 188.241.80.140


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 176.125.229.135
country_id: 3194884
description:
Jan  2 18:40:02 host2 pure-ftpd[166873]: (?@176.125.229.135) [INFO] New connection from 176.125.229.135


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.6.31
country_id: 1880251
description:
2026-01-02 18:40:28 dovecot_login authenticator failed for H=(31.6.245.49.unknown.m1.com.sg) [49.245.6.31]:58045: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  2 18:40:30 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<OGTobmdHwJmygBt7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.222.238
country_id: 3144096
description:
2026-01-02 18:40:39 dovecot_login authenticator failed for H=(cm-178.232.222.238.get.no) [178.232.222.238]:48614: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.252.18
country_id: 1269750
description:
2026-01-02 18:40:45 dovecot_login authenticator failed for H=(dsl-kk-static-089.203.95.61.airtelbroadband.in) [125.20.252.18]:35902: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.103.27.217
country_id: 390903
description:
2026-01-02 18:40:20 dovecot_login authenticator failed for H=owniyj.static.otenet.gr ([2.85.77.70]) [62.103.27.217]:61755: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan  2 18:41:19 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@lezzarotech.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<BVTMcWdHErwvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  2 18:43:41 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<SCRMemdHVJ9o7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  2 18:44:02 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@askinternationalconsortium.com>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<Jf+He2dH9q9CdMcv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.249.23
country_id: 3865483
description:
Jan  2 18:44:18 host2 dovecot[165786]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=179.0.249.23, lip=66.85.158.91, TLS, session=<OtNve2dH6ZOzAPkX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.215.27
country_id: 732800
description:
Jan  2 18:44:35 host2 dovecot[165786]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.255.215.27, lip=66.85.158.91, TLS, session=<gAayfGdHxJm5/9cb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 18:45:40 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<vJtqgWdHqqsjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.110.7.34
country_id: 2464461
description:
2026-01-02 18:46:16 dovecot_login authenticator failed for H=([102.110.7.34]) [102.110.7.34]:4913: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Jan  2 18:46:19 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<uuqyg2dHEKwI04Sw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.39
country_id: 2186224
description:
2026-01-02 18:46:27 dovecot_login authenticator failed for H=([121.73.163.39]) [121.73.163.39]:59242: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.11
country_id: 241170
description:
Jan  2 18:46:45 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.11, lip=66.85.158.91, session=<YZFEhWdH1q7E+2YL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  2 18:49:03 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@dataesite.lk>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<Ykh+jWdHsJxCdMzo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.76.191.29
country_id: 1819730
description:
2026-01-02 18:48:41 dovecot_login authenticator failed for H=029.191.76.219.static.netvigator.com [219.76.191.29]:49181: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.218.54.218
country_id: 6252001
description:
Jan  2 18:48:48 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@monarchdss.com>, method=PLAIN, rip=104.218.54.218, lip=66.85.158.91, session=<KnCYjGdH3udo2jba>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.164.35.116
country_id: 2328926
description:
2026-01-02 18:49:04 dovecot_login authenticator failed for H=([102.164.35.116]) [102.164.35.116]:44754: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.92.171.7
country_id: 6252001
description:
Jan  2 18:49:46 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@ayuzonelanka.com>, method=PLAIN, rip=190.92.171.7, lip=66.85.158.91, session=<adURkGdHruW+XKsH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.53.44.125
country_id: 1643084
description:
Jan  2 18:52:31 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=117.53.44.125, lip=66.85.158.91, session=<2kTmmWdHFMB1NSx9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.131.211.168
country_id: 690791
description:
2026-01-02 18:53:03 dovecot_login authenticator failed for H=([94.131.211.168]) [94.131.211.168]:56506: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 184.105.247.252
country_id: 6252001
description:
Jan  2 18:53:03 host2 pure-ftpd[183799]: (?@184.105.247.252) [INFO] New connection from 184.105.247.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.188.102.28
country_id: 298795
description:
2026-01-02 18:53:47 dovecot_login authenticator failed for H=([78.188.102.28]) [78.188.102.28]:54678: 535 Incorrect authentication data (set_id=test@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2026-01-02 18:53:55 dovecot_plain authenticator failed for H=(odock) [65.20.160.107]:33131: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.152
country_id: 1269750
description:
2026-01-02 18:54:02 dovecot_login authenticator failed for H=(nsg-corporate-152.227.187.122.airtel.in) [122.187.227.152]:53847: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.3.163.126
country_id: 6252001
description:
Jan  2 18:53:13 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=192.3.163.126, lip=66.85.158.91, session=<+8ljnGdHuszAA6N+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.38.27
country_id: 798544
description:
2026-01-02 18:53:28 dovecot_login authenticator failed for H=89-67-38-27.dynamic.play.pl [89.67.38.27]:43794: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  2 18:55:00 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@maximsholdings.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<4pbGomdH+ONCdMzo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 68.183.62.218
country_id: 6252001
description:
Jan  2 18:56:11 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=68.183.62.218, lip=66.85.158.91, session=<p2odp2dHaKREtz7a>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 142.93.183.101
country_id: 6252001
description:
Jan  2 18:56:11 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=142.93.183.101, lip=66.85.158.91, TLS handshaking: Connection closed, session=<xC4fp2dHQN6OXbdl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.130
country_id: 1269750
description:
2026-01-02 18:57:01 dovecot_login authenticator failed for H=([27.123.114.130]) [27.123.114.130]:43222: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.227.75.125
country_id: 6252001
description:
Jan  2 18:56:11 host2 dovecot[165786]: imap-login: Disconnected: Connection closed (disconnected before auth was ready, waited 0 secs): user=<>, rip=165.227.75.125, lip=66.85.158.91, TLS handshaking: Connection closed, session=<A1Mep2dHcNml40t9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.169.77
country_id: 3469034
description:
2026-01-02 18:56:45 dovecot_login authenticator failed for H=179-125-169-77.static.desktop.com.br [179.125.169.77]:34569: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.142.45
country_id: 6252001
description:
Jan  2 18:58:01 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colourmarklabels.com>, method=PLAIN, rip=47.251.142.45, lip=66.85.158.91, session=<P1eSrWdHBqMv+44t>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  2 19:00:00 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<Cj2rtGdHnKai8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan  2 19:01:22 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<CJ+JuWdH4jsvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  2 19:03:00 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<cEdpv2dHyLpIpyJ4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  2 19:02:25 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<g/hLvWdHJsyeRdvj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.139
country_id: 6252001
description:
Jan  2 19:02:36 host2 dovecot[165786]: imap-login: Disconnected: Connection closed: read(size=704) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=66.132.153.139, lip=66.85.158.91, TLS: read(size=704) failed: Connection reset by peer, session=<hqgNvmdHmDxChJmL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Jan  2 19:03:22 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@venee.lk>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<Wwq3wGdHvtgI04Sw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.9.247.58
country_id: 3469034
description:
2026-01-02 19:03:38 dovecot_login authenticator failed for H=([186.238.157.140]) [187.9.247.58]:47517: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  2 19:04:32 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<XsTixGdHdqUUOAHJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.225.40.153
country_id: 6252001
description:
Jan  2 19:05:09 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=64.225.40.153, lip=66.85.158.91, session=<B/gQx2dHIOFA4SiZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.92.171.7
country_id: 6252001
description:
Jan  2 19:05:46 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=190.92.171.7, lip=66.85.158.91, session=<SvBGyWdHhLG+XKsH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  2 19:08:57 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<Av6l1GdH7Ipnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.137
country_id: 3144096
description:
2026-01-02 19:10:04 dovecot_login authenticator failed for H=(137-161-97-62.cust.smartcall.no) [62.97.161.137]:39827: 535 Incorrect authentication data (set_id=v-deploy@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  2 19:10:05 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<M8G02GdHmN5yB6Oa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  2 19:10:09 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<UIL32GdH+JIv/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  2 19:09:25 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<fyZU1mdHcNkyBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  2 19:10:27 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<atQH2mdHaLEv/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  2 19:10:19 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<PgCQ2WdHpqAv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.8
country_id: 2186224
description:
2026-01-02 19:10:20 dovecot_login authenticator failed for H=([121.73.163.8]) [121.73.163.8]:43764: 535 Incorrect authentication data (set_id=v-deploy)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  2 19:11:13 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<xErN3GdHRpuuijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  2 19:13:07 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<lqeQ42dHAKVnpBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.149.211
country_id: 1522867
description:
2026-01-02 19:12:57 dovecot_plain authenticator failed for H=(unous) [85.29.149.211]:55184: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.53.44.125
country_id: 1643084
description:
Jan  2 19:13:38 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=117.53.44.125, lip=66.85.158.91, session=<hORp5WdH7It1NSx9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  2 19:13:41 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<6iCf5WdHXstn9M4G>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  2 19:15:14 host2 pure-ftpd[208218]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.225.40.153
country_id: 6252001
description:
Jan  2 19:15:53 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=64.225.40.153, lip=66.85.158.91, session=<q6987WdHbqpA4SiZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan  2 19:16:29 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<2kOX72dHQowv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan  2 19:20:26 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lezzarotech.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<mJW5/WdHIsQvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.76
country_id: 2186224
description:
2026-01-02 19:20:28 dovecot_login authenticator failed for H=([121.73.168.76]) [121.73.168.76]:59112: 535 Incorrect authentication data (set_id=office@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 19:21:39 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<JD8eAmhHenUjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.254.91
country_id: 3865483
description:
2026-01-02 19:21:58 dovecot_login authenticator failed for H=(static.90.254.104.190.cps.com.ar) [190.104.254.91]:52034: 535 Incorrect authentication data (set_id=sales@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.90.128.97
country_id: 6252001
description:
2026-01-02 19:22:09 dovecot_login authenticator failed for H=(syn-172-090-128-097.res.spectrum.com) [172.90.128.97]:63947: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  2 19:21:13 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<TH+KAGhHrgho7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  2 19:21:20 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<SNX6AGhH1tyygBt7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.49.176.244
country_id: 1269750
description:
2026-01-02 19:21:35 dovecot_plain authenticator failed for H=(8HRKD1AKEBBNP) [157.49.176.244]:55766: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.154.237
country_id: 6252001
description:
Jan  2 19:22:26 host2 dovecot[165786]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.65.154.237, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<HpL+BGhHFOwUQZrt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  2 19:23:08 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<+9thB2hHuJBCdMcv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.92.171.7
country_id: 6252001
description:
Jan  2 19:24:04 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=190.92.171.7, lip=66.85.158.91, session=<SUi9CmhHwuW+XKsH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Jan  2 19:25:15 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<qvDxDmhHQpMI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  2 19:27:34 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@dataesite.lk>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<NEc7F2hHNuxCdMzo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.195.162.70
country_id: 3469034
description:
Jan  2 19:28:17 host2 sshd[220576]: Disconnected from invalid user ftpuser 200.195.162.70 port 39050 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.210.148.92
country_id: 953987
description:
Jan  2 19:30:08 host2 sshd[222713]: Disconnected from invalid user gitlab-runner 102.210.148.92 port 59748 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.53.44.125
country_id: 1643084
description:
Jan  2 19:30:56 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lezzarotech.com>, method=PLAIN, rip=117.53.44.125, lip=66.85.158.91, session=<OuRFI2hHTq51NSx9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.87
country_id: 1733045
description:
2026-01-02 19:31:03 dovecot_login authenticator failed for H=([49.125.201.87]) [49.125.201.87]:41174: 535 Incorrect authentication data (set_id=lezzarotech)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.172.221
country_id: 1861060
description:
Jan  2 19:31:03 host2 sshd[223631]: Disconnected from invalid user dev1 160.251.172.221 port 46504 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.195.162.70
country_id: 3469034
description:
Jan  2 19:31:07 host2 sshd[223684]: Disconnected from invalid user ubuntu 200.195.162.70 port 52922 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.201.209.172
country_id: 6252001
description:
2026-01-02 19:30:35 dovecot_login authenticator failed for H=mobile-166-201-209-172.mycingular.net [166.201.209.172]:56057: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.195.162.70
country_id: 3469034
description:
Jan  2 19:32:30 host2 sshd[224843]: Disconnected from invalid user dev1 200.195.162.70 port 51380 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 143.244.161.157
country_id: 6252001
description:
Jan  2 19:33:32 host2 dovecot[165786]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=143.244.161.157, lip=66.85.158.91, session=<U6muLGhHYrmP9KGd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.47.92.86
country_id: 1643084
description:
Jan  2 19:33:38 host2 sshd[225772]: Disconnected from invalid user ubuntu 38.47.92.86 port 47464 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.210.148.92
country_id: 953987
description:
Jan  2 19:33:30 host2 sshd[225689]: Disconnected from invalid user ubuntu 102.210.148.92 port 56320 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  2 19:33:33 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@maximsholdings.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<49mlLGhHdLxCdMzo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.195.162.70
country_id: 3469034
description:
Jan  2 19:34:36 host2 sshd[226796]: Disconnected from invalid user minecraft 200.195.162.70 port 59902 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.5
country_id: 798549
description:
Jan  2 19:35:44 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.5, lip=66.85.158.91, TLS: Connection closed, session=<eUaSNGhHRuRV2ZUF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.210.148.92
country_id: 953987
description:
Jan  2 19:35:49 host2 sshd[228249]: Disconnected from invalid user ftpuser 102.210.148.92 port 37026 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.142.45
country_id: 6252001
description:
Jan  2 19:35:56 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@colourmarklabels.com>, method=PLAIN, rip=47.251.142.45, lip=66.85.158.91, session=<zuYuNWhHAoIv+44t>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.5
country_id: 798549
description:
Jan  2 19:36:32 host2 dovecot[165786]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.5, lip=66.85.158.91, TLS: Connection closed, session=<aaVrN2hHWoNV2ZUF>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  2 19:37:25 host2 sshd[229724]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.5
country_id: 798549
description:
Jan  2 19:37:55 host2 dovecot[165786]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=85.217.149.5, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<lYZePGhHbpNV2ZUF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  2 19:38:00 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<JPKPPGhHxoqi8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.53.199.160
country_id: 6252001
description:
2026-01-02 19:38:10 dovecot_login authenticator failed for H=(136-53-199-160.googlefiber.net) [136.53.199.160]:36976: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.15
country_id: 798549
description:
Jan  2 19:37:38 host2 dovecot[165786]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.15, lip=66.85.158.91, session=<wpBYO2hHQuNV2ZUP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.148.174.234
country_id: 2017370
description:
2026-01-02 19:37:56 dovecot_login authenticator failed for H=([31.148.174.234]) [31.148.174.234]:56486: 535 Incorrect authentication data (set_id=postmaster@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.85.14.208
country_id: 6252001
description:
2026-01-02 19:38:26 dovecot_login authenticator failed for H=([107.85.14.208]) [107.85.14.208]:48815: 535 Incorrect authentication data (set_id=v-deploy@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2026-01-02 19:38:49 dovecot_login authenticator failed for H=h-155-4-31-215.a2204.priv.bahnhof.se [155.4.31.215]:36002: 535 Incorrect authentication data (set_id=v-deploy)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 160.251.172.221
country_id: 1861060
description:
Jan  2 19:39:42 host2 sshd[232074]: Disconnected from invalid user user2 160.251.172.221 port 45740 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  2 19:39:56 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<xmhyQ2hH2LOeRdvj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.92.171.7
country_id: 6252001
description:
Jan  2 19:40:16 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ceylondigest.com>, method=PLAIN, rip=190.92.171.7, lip=66.85.158.91, session=<3pauRGhH3Oq+XKsH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.47.92.86
country_id: 1643084
description:
Jan  2 19:40:40 host2 sshd[233369]: Disconnected from invalid user ftpuser 38.47.92.86 port 39452 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  2 19:41:04 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<ZN+HR2hHXMxIpyJ4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.47.92.86
country_id: 1643084
description:
Jan  2 19:41:17 host2 sshd[234109]: Disconnected from invalid user gitlab-runner 38.47.92.86 port 37816 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  2 19:41:33 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<QBdHSWhHOokUOAHJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan  2 19:42:03 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<PBwES2hHDI8vTJuG>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.47.92.86
country_id: 1643084
description:
Jan  2 19:42:35 host2 sshd[235548]: Disconnected from invalid user postgres 38.47.92.86 port 49920 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Jan  2 19:42:44 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<2/h/TWhHuIMI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.225.40.153
country_id: 6252001
description:
Jan  2 19:43:12 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=64.225.40.153, lip=66.85.158.91, session=<mDAqT2hHdopA4SiZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.218.54.218
country_id: 6252001
description:
Jan  2 19:45:28 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=104.218.54.218, lip=66.85.158.91, session=<zwVHV2hH1Jho2jba>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-02 19:45:44 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:63592: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.130
country_id: 1269750
description:
2026-01-02 19:45:25 dovecot_login authenticator failed for H=([27.123.114.130]) [27.123.114.130]:37608: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 135.84.209.254
country_id: 6252001
description:
[2026-01-02 19:45:30 +0530] info [cpaneld] 135.84.209.254 - cloudtourssrilan "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.110.96
country_id: 3144096
description:
2026-01-02 19:45:37 dovecot_login authenticator failed for H=(cm-84.215.110.96.get.no) [84.215.110.96]:47576: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  2 19:46:02 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<X2JHWWhHfI4yBvlc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 114.130.85.36
country_id: 1210997
description:
Jan  2 19:46:10 host2 sshd[239975]: Disconnected from invalid user julien 114.130.85.36 port 48956 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 114.130.85.36
country_id: 1210997
description:
Jan  2 19:46:59 host2 sshd[240790]: Disconnected from invalid user ts1 114.130.85.36 port 57388 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  2 19:47:04 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=</FL4XGhHSptnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.137.144
country_id: 1605651
description:
Jan  2 19:47:24 host2 sshd[241168]: Disconnected from invalid user rahul 27.254.137.144 port 50516 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.233.92.123
country_id: 1269750
description:
2026-01-02 19:47:23 dovecot_login authenticator failed for H=([103.233.92.123]) [103.233.92.123]:47736: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.34
country_id: 2186224
description:
2026-01-02 19:47:11 dovecot_login authenticator failed for H=([121.73.168.34]) [121.73.168.34]:39130: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  2 19:47:10 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<1x9YXWhHpp8v/VJZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.178.45
country_id: 298795
description:
2026-01-02 19:48:52 dovecot_login authenticator failed for H=([188.59.178.45]) [188.59.178.45]:55905: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  2 19:49:05 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<efIzZGhHuEmuijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  2 19:48:09 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<lg/aYGhHsMAv+wDY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.19.156.18
country_id: 3932488
description:
Jan  2 19:49:56 host2 sshd[243395]: Disconnected from invalid user mata 38.19.156.18 port 55054 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.32.248
country_id: 1269750
description:
2026-01-02 19:49:14 dovecot_login authenticator failed for H=(nsg-corporate-90.179.185.122.airtel.in) [49.37.32.248]:38512: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.189
country_id: 6252001
description:
2026-01-02 19:49:37 dovecot_login authenticator failed for H=([209.23.72.189]) [209.23.72.189]:39346: 535 Incorrect authentication data (set_id=postmaster@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.103.27.217
country_id: 390903
description:
2026-01-02 19:49:47 dovecot_login authenticator failed for H=owniyj.static.otenet.gr (lime36.static.otenet.gr) [62.103.27.217]:55133: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.19.156.18
country_id: 3932488
description:
Jan  2 19:50:40 host2 sshd[244332]: Disconnected from invalid user ubuntu 38.19.156.18 port 38628 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  2 19:50:44 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<4b4TamhH/utyB6Oa>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 114.130.85.36
country_id: 1210997
description:
Jan  2 19:50:49 host2 sshd[244448]: Disconnected from invalid user xiaoli 114.130.85.36 port 59732 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.233.96.247
country_id: 6252001
description:
Jan  2 19:51:08 host2 dovecot[165786]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=135.233.96.247, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Osyma2hHzuOH6WD3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  2 19:50:21 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<F4a1aGhHppVnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  2 19:51:43 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<jB+ZbWhHZJNn9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.31.73.16
country_id: 2921044
description:
Jan  2 19:52:23 host2 sshd[245853]: Disconnected from invalid user koha 144.31.73.16 port 40934 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.128.182.5
country_id: 2635167
description:
Jan  2 19:52:30 host2 sshd[245956]: Disconnected from invalid user monitor 57.128.182.5 port 50082 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.53.44.125
country_id: 1643084
description:
Jan  2 19:52:17 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=117.53.44.125, lip=66.85.158.91, session=<UHqgb2hHqsp1NSx9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.93.249.106
country_id: 1643084
description:
Jan  2 19:53:34 host2 sshd[246973]: Disconnected from invalid user postgres 36.93.249.106 port 48586 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 57.128.182.5
country_id: 2635167
description:
Jan  2 19:53:38 host2 sshd[247039]: Disconnected from invalid user tester 57.128.182.5 port 35046 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.208.177.56
country_id: 6252001
description:
2026-01-02 19:54:08 dovecot_login authenticator failed for H=([74.208.177.56]) [74.208.177.56]:44930: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.137.144
country_id: 1605651
description:
Jan  2 19:53:32 host2 sshd[246934]: Disconnected from invalid user esearch 27.254.137.144 port 53982 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.225.40.153
country_id: 6252001
description:
Jan  2 19:53:57 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=64.225.40.153, lip=66.85.158.91, session=<bgKXdWhHfsJA4SiZ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.137.144
country_id: 1605651
description:
Jan  2 19:54:55 host2 sshd[248789]: Disconnected from invalid user admin 27.254.137.144 port 45086 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.93.249.106
country_id: 1643084
description:
Jan  2 19:54:17 host2 sshd[248102]: Disconnected from invalid user raghu 36.93.249.106 port 54350 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.194.231
country_id: 3144096
description:
2026-01-02 19:54:19 dovecot_login authenticator failed for H=(cm-178.232.194.231.get.no) [178.232.194.231]:42802: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.57.172
country_id: 1643084
description:
Jan  2 19:54:25 host2 sshd[248278]: Disconnected from invalid user administrator 103.179.57.172 port 60126 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.31.73.16
country_id: 2921044
description:
Jan  2 19:54:34 host2 sshd[248427]: Disconnected from invalid user karla 144.31.73.16 port 56440 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.110
country_id: 1149361
description:
2026-01-02 19:54:54 dovecot_login authenticator failed for H=([180.94.75.110]) [180.94.75.110]:32965: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 144.31.73.16
country_id: 2921044
description:
Jan  2 19:55:43 host2 sshd[249769]: Disconnected from invalid user pzuser 144.31.73.16 port 44170 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.57.172
country_id: 1643084
description:
Jan  2 19:55:20 host2 sshd[249345]: Disconnected from invalid user postgres 103.179.57.172 port 40626 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan  2 19:55:29 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<7b0Qe2hHOq4v/lVz>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 161.118.239.99
country_id: 1880251
description:
Jan  2 19:57:11 host2 pure-ftpd[251174]: (?@161.118.239.99) [INFO] New connection from 161.118.239.99


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 161.118.239.99
country_id: 1880251
description:
Jan  2 19:57:16 host2 pure-ftpd[251297]: (?@161.118.239.99) [INFO] New connection from 161.118.239.99


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 19:57:58 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<n5X6g2hH3n0jupN+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 161.118.239.99
country_id: 1880251
description:
Jan  2 19:58:10 host2 pure-ftpd[252218]: (?@161.118.239.99) [INFO] New connection from 161.118.239.99


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 161.118.239.99
country_id: 1880251
description:
Jan  2 19:58:11 host2 pure-ftpd[252231]: (?@161.118.239.99) [INFO] New connection from 161.118.239.99


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.92.171.7
country_id: 6252001
description:
Jan  2 19:58:42 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=190.92.171.7, lip=66.85.158.91, session=<aiWahmhHFr++XKsH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  2 19:59:21 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<+87siGhH5jxo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan  2 20:01:25 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lezzarotech.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<NWlOkGhH7mMvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Jan  2 20:01:33 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<DbHEkGhH8uoFhH+s>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 98.80.4.47
country_id: 6252001
description:
Jan  2 20:01:45 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=98.80.4.47, lip=66.85.158.91, TLS handshaking: Connection closed, session=<nMWakWhHZpViUAQv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  2 20:01:59 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<inJckmhHupxCdMcv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  2 20:02:39 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<wZKxlGhHoKKygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Jan  2 20:04:41 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@sivagnanamfoundation.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<l7sCnGhHNOMI04Sw>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.57.154.177
country_id: 3175395
description:
Jan  2 20:04:15 host2 sshd[258030]: Disconnected from invalid user harold 151.57.154.177 port 64291 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  2 20:06:40 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@dataesite.lk>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<s+0To2hH7qNCdMzo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.173.10.75
country_id: 6252001
description:
2026-01-02 20:07:28 dovecot_login authenticator failed for H=([209.173.10.75]) [209.173.10.75]:52456: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.57
country_id: 1733045
description:
2026-01-02 20:07:44 dovecot_login authenticator failed for H=([49.124.153.57]) [49.124.153.57]:33754: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.53.44.125
country_id: 1643084
description:
Jan  2 20:09:35 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lezzarotech.com>, method=PLAIN, rip=117.53.44.125, lip=66.85.158.91, session=<LHt9rWhHupx1NSx9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.190
country_id: 1269750
description:
2026-01-02 20:12:00 dovecot_login authenticator failed for H=([128.185.223.185]) [27.123.114.190]:47958: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.147.96
country_id: 1733045
description:
2026-01-02 20:12:16 dovecot_login authenticator failed for H=([49.124.147.96]) [49.124.147.96]:60044: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  2 20:12:39 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@maximsholdings.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<Yk59uGhH5NBCdMzo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.164.177.6
country_id: 390903
description:
2026-01-02 20:13:06 dovecot_login authenticator failed for H=([95.164.177.6]) [95.164.177.6]:58268: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.142.45
country_id: 6252001
description:
Jan  2 20:13:48 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colourmarklabels.com>, method=PLAIN, rip=47.251.142.45, lip=66.85.158.91, session=<SGKVvGhH3r4v+44t>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.57.154.177
country_id: 3175395
description:
Jan  2 20:14:49 host2 sshd[269213]: Disconnected from invalid user ivan 151.57.154.177 port 64237 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.92.171.7
country_id: 6252001
description:
Jan  2 20:14:55 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=190.92.171.7, lip=66.85.158.91, session=<1lCGwGhHkpq+XKsH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.93.7.194
country_id: 1821275
description:
Jan  2 20:15:54 host2 sshd[270604]: Disconnected from invalid user ubuntu 182.93.7.194 port 43816 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.93.7.194
country_id: 1821275
description:
Jan  2 20:16:22 host2 sshd[271041]: Disconnected from invalid user brandon 182.93.7.194 port 33280 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.23.88.153
country_id: 798544
description:
Jan  2 20:16:23 host2 sshd[271058]: Disconnected from invalid user ftproot 94.23.88.153 port 55112 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.93.7.194
country_id: 1821275
description:
Jan  2 20:16:50 host2 sshd[271469]: Disconnected from invalid user pub 182.93.7.194 port 59016 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  2 20:16:16 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<Pk9hxWhHroOi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  2 20:17:26 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<7ViWyWhHRsOeRdvj>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 102.204.223.112
country_id: 2328926
description:
Jan  2 20:18:20 host2 pure-ftpd[273064]: (?@102.204.223.112) [INFO] New connection from 102.204.223.112


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.218.54.218
country_id: 6252001
description:
Jan  2 20:19:19 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=104.218.54.218, lip=66.85.158.91, session=<dq9V0GhHyNlo2jba>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  2 20:19:21 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<a85x0GhHBN5IpyJ4>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  2 20:19:30 host2 pure-ftpd[274125]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  2 20:19:51 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<n+E20mhHJLIUOAHJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.225.40.153
country_id: 6252001
description:
Jan  2 20:20:17 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=64.225.40.153, lip=66.85.158.91, session=<cpTD02hHaqNA4SiZ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.23.88.153
country_id: 798544
description:
Jan  2 20:21:20 host2 sshd[276766]: Disconnected from invalid user es 94.23.88.153 port 60218 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 94.23.88.153
country_id: 798544
description:
Jan  2 20:23:04 host2 sshd[278621]: Disconnected from invalid user mine 94.23.88.153 port 39434 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Jan  2 20:22:17 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@venee.lk>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<G9nn2mhHaqoI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  2 20:22:55 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<Xxcy3WhHlNYyBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan  2 20:23:05 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<yW/H3WhHhpQvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  2 20:24:22 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<b1Ni4mhHBpMv/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  2 20:25:21 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<6wzj5WhHmN9nmud6>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.219.237.111
country_id: 6252001
description:
Jan  2 20:26:05 host2 pure-ftpd[281645]: (?@104.219.237.111) [INFO] New connection from 104.219.237.111


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  2 20:26:19 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<0y1h6WhHnOEv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.153.103.233
country_id: 1210997
description:
2026-01-02 20:26:38 dovecot_plain authenticator failed for H=(R27PCKV70FQ2DWX) [59.153.103.233]:60368: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  2 20:27:00 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<HhzP62hHWMKuijvy>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  2 20:28:05 host2 sshd[283518]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  2 20:30:24 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<zPn492hHUOtnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.225.40.153
country_id: 6252001
description:
Jan  2 20:31:07 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=64.225.40.153, lip=66.85.158.91, session=<RYyA+mhH/NpA4SiZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  2 20:31:13 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<fzjn+mhHEItyB6Oa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.53.44.125
country_id: 1643084
description:
Jan  2 20:31:45 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@mathsmotorcysle.xyz>, method=PLAIN, rip=117.53.44.125, lip=66.85.158.91, session=<iGHN/GhH6q11NSx9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.2.98.122
country_id: 719819
description:
2026-01-02 20:32:11 dovecot_plain authenticator failed for H=5402627a.dsl.pool.telekom.hu (7J2Z8VH88YREWO) [84.2.98.122]:60007: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.214
country_id: 1269750
description:
2026-01-02 20:32:15 dovecot_login authenticator failed for H=([182.95.181.214]) [182.95.181.214]:43278: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.1.58.85
country_id: 6251999
description:
2026-01-02 20:32:32 dovecot_login authenticator failed for H=([96.1.58.85]) [96.1.58.85]:55746: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  2 20:32:34 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<+gWz/2hH3Lpn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.92.171.7
country_id: 6252001
description:
Jan  2 20:33:28 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=190.92.171.7, lip=66.85.158.91, session=<k7XxAmlHoIC+XKsH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan  2 20:35:10 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<zpgBCWlHUtEv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 20:34:31 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<zE2zBmlHWGEjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  2 20:34:33 host2 sshd[290229]: Disconnected from invalid user user 2.57.121.25 port 28893 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.130.171.210
country_id: 3469034
description:
Jan  2 20:35:33 host2 dovecot[165786]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=177.130.171.210, lip=66.85.158.91, TLS, session=<lk9VCWlH8dOxgqvS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 169.239.117.181
country_id: 2215636
description:
Jan  2 20:35:52 host2 dovecot[165786]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw>, method=PLAIN, rip=169.239.117.181, lip=66.85.158.91, TLS, session=<uQKPCmlH6oip73W1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  2 20:37:57 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<ocjzEmlHerRo7MS0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.112.196
country_id: 6252001
description:
Jan  2 20:38:34 host2 sshd[295277]: Disconnected from invalid user ubuntu 146.190.112.196 port 49196 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.89.28.139
country_id: 1643084
description:
Jan  2 20:39:42 host2 sshd[296425]: Disconnected from invalid user ivan 36.89.28.139 port 56654 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.112.196
country_id: 6252001
description:
Jan  2 20:39:48 host2 sshd[296578]: Disconnected from invalid user runner 146.190.112.196 port 47046 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 146.190.112.196
country_id: 6252001
description:
Jan  2 20:40:58 host2 sshd[298148]: Disconnected from invalid user ivan 146.190.112.196 port 53442 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.89.28.139
country_id: 1643084
description:
Jan  2 20:41:43 host2 sshd[298805]: Disconnected from invalid user runner 36.89.28.139 port 37052 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.112.196
country_id: 6252001
description:
Jan  2 20:42:05 host2 sshd[299327]: Disconnected from invalid user pt 146.190.112.196 port 51172 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  2 20:41:11 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<oup/HmlHHKJCdMcv>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.89.28.139
country_id: 1643084
description:
Jan  2 20:43:01 host2 sshd[300294]: Disconnected from invalid user jamshid 36.89.28.139 port 38594 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan  2 20:42:34 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<office@lezzarotech.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<rBdVI2lHDFgvTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.112.196
country_id: 6252001
description:
Jan  2 20:42:39 host2 sshd[299810]: Disconnected from invalid user devuser 146.190.112.196 port 42890 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.89.28.139
country_id: 1643084
description:
Jan  2 20:43:43 host2 sshd[301061]: Disconnected from invalid user pt 36.89.28.139 port 42100 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  2 20:43:23 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@kiriaswanu.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<nXtfJmlHOsCygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.226
country_id: 3469034
description:
Jan  2 20:45:02 host2 dovecot[165786]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=190.89.136.226, lip=66.85.158.91, TLS, session=<9Kk/K2lHBei+WYji>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Jan  2 20:44:19 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<tPu1KWlHqpwI04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.190.79.74
country_id: 3469034
description:
Jan  2 20:44:40 host2 dovecot[165786]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=177.190.79.74, lip=66.85.158.91, TLS, session=<0f/gKWlHRa6xvk9K>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  2 20:45:26 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@dataesite.lk>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<is6xLWlH5oFCdMzo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.76.142
country_id: 1269750
description:
2026-01-02 20:46:04 dovecot_login authenticator failed for H=([128.185.213.82]) [182.78.76.142]:53370: 535 Incorrect authentication data (set_id=office@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.163.187
country_id: 3144096
description:
2026-01-02 20:47:06 dovecot_login authenticator failed for H=(187-163-97-62.cust.smartcall.no) [62.97.163.187]:59275: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.236.51.254
country_id: 290291
description:
2026-01-02 20:46:54 dovecot_login authenticator failed for H=([87.236.51.254]) [87.236.51.254]:48039: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.253.95
country_id: 6252001
description:
Jan  2 20:48:05 host2 sshd[305985]: Disconnected from invalid user pt 199.195.253.95 port 46994 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.53.44.125
country_id: 1643084
description:
Jan  2 20:49:17 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@lezzarotech.com>, method=PLAIN, rip=117.53.44.125, lip=66.85.158.91, session=<ogaEO2lHDst1NSx9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.92.171.7
country_id: 6252001
description:
Jan  2 20:49:48 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=190.92.171.7, lip=66.85.158.91, session=<HL1bPWlHgpC+XKsH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  2 20:51:28 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@maximsholdings.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<q79IQ2lHcuJCdMzo>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 66.116.204.232
country_id: 1269750
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[66.116.204.232] [Remote Port]=[57970] [Authentication Database]=[mail] [Username]=[test@maximsholdings.com] (10/10 failures) (blocked until [Sat Jan  3 15:21:26 2026 UTC/Sat Jan  3 20:51:26 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.142.45
country_id: 6252001
description:
Jan  2 20:52:02 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colourmarklabels.com>, method=PLAIN, rip=47.251.142.45, lip=66.85.158.91, session=<YHxVRWlH3p0v+44t>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.221.8.135
country_id: 6252001
description:
2026-01-02 20:53:07 dovecot_login authenticator failed for H=(216-221-8-135.ind-pa.salsgiver.com) [216.221.8.135]:58692: 535 Incorrect authentication data (set_id=office@kiriaswanu.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 199.195.253.95
country_id: 6252001
description:
Jan  2 20:52:42 host2 sshd[310846]: Disconnected from invalid user ivan 199.195.253.95 port 54574 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2026-01-02 20:53:17 dovecot_login authenticator failed for H=([24.105.248.218]) [24.105.248.218]:51342: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  2 20:54:35 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<pJ9wTmlHaoCi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  2 20:55:03 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<BVghUGlHXueeRdvj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.5.178.229
country_id: 3865483
description:
2026-01-02 20:56:33 dovecot_login authenticator failed for H=([186.5.178.229]) [186.5.178.229]:45778: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.85
country_id: 1210997
description:
2026-01-02 20:56:55 dovecot_login authenticator failed for H=([103.115.252.60]) [103.115.252.85]:44375: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  2 20:58:19 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<hMXMW2lHCIVIpyJ4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  2 20:58:30 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<xDJ5XGlHMKkUOAHJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.225.40.153
country_id: 6252001
description:
Jan  2 20:58:39 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=64.225.40.153, lip=66.85.158.91, session=<7079XGlH1LpA4SiZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  2 21:00:01 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<PCXkYWlHcIsyBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Jan  2 21:01:48 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@venee.lk>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<K5hHaGlHHtII04Sw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  2 21:01:48 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<zss/aGlHErMv/VJZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.191.69.170
country_id: 6252001
description:
Jan  2 21:02:50 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=18.191.69.170, lip=66.85.158.92, session=<MPoObGlHlssSv0Wq>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 47.253.82.89
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[47.253.82.89] [Remote Port]=[52504] [Authentication Database]=[mail] [Username]=[admin@dataesite.lk] (10/10 failures) (blocked until [Sat Jan  3 15:32:04 2026 UTC/Sat Jan  3 21:02:04 2026 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.200
country_id: 1269750
description:
2026-01-02 21:02:15 dovecot_login authenticator failed for H=([103.146.233.200]) [103.146.233.200]:52360: 535 Incorrect authentication data (set_id=postmaster@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  2 21:04:05 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<QfRocGlH3Lpnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan  2 21:04:08 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@mathsmotorcysle.xyz>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<4AaacGlHxGAvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  2 21:04:46 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<zonicmlH4JYv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  2 21:05:05 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@lankaherbalsolutions.com>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<7OYFdGlHiqOuijvy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.218.54.218
country_id: 6252001
description:
Jan  2 21:05:08 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=104.218.54.218, lip=66.85.158.91, session=<xycwdGlHfr5o2jba>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.134.27.194
country_id: 1210997
description:
2026-01-02 21:04:17 dovecot_login authenticator failed for H=([103.134.27.194]) [103.134.27.194]:55138: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.119
country_id: 1819730
description:
2026-01-02 21:05:58 dovecot_login authenticator failed for H=(m121-202-206-119.smartone.com) [121.202.206.119]:50142: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.30.14.221
country_id: 6252001
description:
2026-01-02 21:06:13 dovecot_login authenticator failed for H=pool-108-30-14-221.nycmny.fios.verizon.net [108.30.14.221]:45236: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.92.171.7
country_id: 6252001
description:
Jan  2 21:08:33 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=190.92.171.7, lip=66.85.158.91, session=<S4dcgGlHqK6+XKsH>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 190.92.171.7
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[190.92.171.7] [Remote Port]=[44712] [Authentication Database]=[mail] [Username]=[contact@ayuzonelanka.com] (10/10 failures) (blocked until [Sat Jan  3 15:38:31 2026 UTC/Sat Jan  3 21:08:31 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  2 21:10:25 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<R8cOh2lHvOlnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.53.44.125
country_id: 1643084
description:
Jan  2 21:10:41 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=117.53.44.125, lip=66.85.158.91, session=<3jgAiGlHMMt1NSx9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 21:11:20 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<A1FVimlHdmQjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  2 21:11:46 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<Q4Hhi2lHfJhyB6Oa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.170.156.248
country_id: 6251999
description:
2026-01-02 21:13:23 dovecot_login authenticator failed for H=host-148-170-156-248.public.eastlink.ca [148.170.156.248]:57948: 535 Incorrect authentication data (set_id=contact@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.178.118
country_id: 1269750
description:
2026-01-02 21:13:39 dovecot_login authenticator failed for H=([125.19.178.118]) [125.19.178.118]:42730: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan  2 21:15:04 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<HpKnl2lH0Icv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.247.159.106
country_id: 1269750
description:
2026-01-02 21:15:39 dovecot_login authenticator failed for H=([115.247.159.106]) [115.247.159.106]:45536: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2026-01-02 21:16:10 dovecot_plain authenticator failed for H=(petums) [102.53.15.180]:52253: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  2 21:16:48 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<+SjnnWlHoIVo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.135.208.32
country_id: 1861060
description:
2026-01-02 21:18:50 dovecot_login authenticator failed for H=dsl-212-135-208-32.dsl.easynet.co.uk [212.135.208.32]:42877: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.78.124
country_id: 1819730
description:
2026-01-02 21:19:09 dovecot_login authenticator failed for H=(182.239.78.124.hk.chinamobile.com) [182.239.78.124]:35380: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.124.206
country_id: 1269750
description:
2026-01-02 21:21:01 dovecot_login authenticator failed for H=([182.95.87.3]) [182.95.124.206]:48792: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  2 21:23:41 host2 pure-ftpd[345237]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.107.6
country_id: 1269750
description:
2026-01-02 21:24:05 dovecot_login authenticator failed for H=([182.78.107.6]) [182.78.107.6]:39246: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  2 21:24:11 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<T5ZKuGlHqrNIpyJ4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  2 21:26:44 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<lHFlwWlHopxyB6Oa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.225.40.153
country_id: 6252001
description:
Jan  2 21:27:00 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ayuzonelanka.com>, method=PLAIN, rip=64.225.40.153, lip=66.85.158.91, session=<A9VgwmlHIJlA4SiZ>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 64.225.40.153
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[64.225.40.153] [Remote Port]=[39200] [Authentication Database]=[mail] [Username]=[hr@ayuzonelanka.com] (10/10 failures) (blocked until [Sat Jan  3 15:56:58 2026 UTC/Sat Jan  3 21:26:58 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  2 21:28:10 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<wKKSxmlHlusUOAHJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.92.171.7
country_id: 6252001
description:
Jan  2 21:28:35 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=190.92.171.7, lip=66.85.158.91, session=<OF8JyGlHwpe+XKsH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  2 21:29:11 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<roUzymlHCL5nmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.99.61.248
country_id: 1269750
description:
2026-01-02 21:30:48 dovecot_login authenticator failed for H=([14.99.61.248]) [14.99.61.248]:58918: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.247.189.189
country_id: 6252001
description:
2026-01-02 21:30:55 dovecot_login authenticator failed for H=([50.247.189.189]) [50.247.189.189]:28930: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  2 21:31:00 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@lankaherbalsolutions.com>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<V86z0GlHsNiuijvy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.70.126
country_id: 1269750
description:
2026-01-02 21:30:07 dovecot_login authenticator failed for H=([125.20.232.243]) [182.78.70.126]:45334: 535 Incorrect authentication data (set_id=office@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.199
country_id: 1733045
description:
2026-01-02 21:30:21 dovecot_login authenticator failed for H=([49.124.149.199]) [49.124.149.199]:60872: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  2 21:31:44 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<pT5Q02lHusEv/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  2 21:31:48 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<MP+H02lHZpwv+wDY>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  2 21:32:58 host2 sshd[354352]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  2 21:32:47 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<2gYR12lHtMgyBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.53.44.125
country_id: 1643084
description:
Jan  2 21:33:30 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=117.53.44.125, lip=66.85.158.91, session=<Xa6Z2WlHaOJ1NSx9>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 117.53.44.125
country_id: 1643084
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[117.53.44.125] [Remote Port]=[57960] [Authentication Database]=[mail] [Username]=[contact@mathsmotorcysle.xyz] (10/10 failures) (blocked until [Sat Jan  3 16:03:28 2026 UTC/Sat Jan  3 21:33:28 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  2 21:33:48 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<erOu2mlHaNNn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  2 21:34:46 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<Hjom3mlHjoFnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan  2 21:37:02 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<sbJB5mlHYosv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.203.205.37
country_id: 1168579
description:
2026-01-02 21:38:03 dovecot_login authenticator failed for H=([113.203.205.37]) [113.203.205.37]:47909: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.111
country_id: 2186224
description:
2026-01-02 21:38:12 dovecot_login authenticator failed for H=([121.73.169.111]) [121.73.169.111]:43362: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan  2 21:39:11 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@lezzarotech.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<++Ti7WlHlh8vTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  2 21:39:41 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<mDy172lHBNqygBt7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.241.177.151
country_id: 3469034
description:
Jan  2 21:40:25 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=188.241.177.151, lip=66.85.158.91, session=<vM9+8mlHtr+88bGX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2026-01-02 21:40:31 dovecot_plain authenticator failed for H=c-73-168-136-150.hsd1.il.comcast.net (epidable) [73.168.136.150]:47120: 535 Incorrect authentication data (set_id=sales@v-deploy.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 176.125.230.140
country_id: 2562770
description:
Jan  2 21:40:21 host2 pure-ftpd[362461]: (?@176.125.230.140) [INFO] New connection from 176.125.230.140


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.214.122.47
country_id: 357994
description:
Jan  2 21:40:24 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=188.214.122.47, lip=66.85.158.91, TLS, session=<rUNx8mlH6Iu81nov>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 43.250.207.103
country_id: 2186224
description:
Jan  2 21:40:26 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=43.250.207.103, lip=66.85.158.91, session=<P2+L8mlH7rIr+s9n>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  2 21:40:54 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<TroW9GlH0jho7MS0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 98.159.41.8
country_id: 1327865
description:
Jan  2 21:40:24 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=98.159.41.8, lip=66.85.158.91, TLS handshaking: Connection closed, session=<IDpy8mlH3ItinykI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.231.182.152
country_id: 453733
description:
Jan  2 21:40:26 host2 dovecot[360729]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=165.231.182.152, lip=66.85.158.91, session=<h2iG8mlH8rKl57aY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.234.143
country_id: 289688
description:
Jan  2 21:40:28 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=95.181.234.143, lip=66.85.158.91, TLS handshaking: Connection closed, session=<kDGh8mlHgIlfteqP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 86.106.74.250
country_id: 719819
description:
Jan  2 21:40:27 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=86.106.74.250, lip=66.85.158.91, session=<Huqa8mlHzoBWakr6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.70.10.8
country_id: 3624060
description:
Jan  2 21:40:27 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=146.70.10.8, lip=66.85.158.91, TLS handshaking: Connection closed, session=<wVOa8mlH2s2SRgoI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.193.244
country_id: 6252001
description:
Jan  2 21:41:18 host2 dovecot[360729]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.65.193.244, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<xoup9WlHuI8UQcH0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  2 21:41:50 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@askinternationalconsortium.com>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<qyFu92lHWLdCdMcv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.187.6.86
country_id: 2921044
description:
Jan  2 21:43:14 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=5.187.6.86, lip=66.85.158.91, session=<SU1o/GlHlqAFuwZW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 21:43:47 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<IPhj/mlH9okjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.230
country_id: 1149361
description:
2026-01-02 21:43:50 dovecot_login authenticator failed for H=([149.54.51.230]) [149.54.51.230]:58965: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.40.212
country_id: 290557
description:
2026-01-02 21:44:03 dovecot_login authenticator failed for H=([5.31.40.212]) [5.31.40.212]:50282: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2026-01-02 21:45:16 dovecot_login authenticator failed for H=([115.240.244.53]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=postmaster@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Jan  2 21:45:22 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<19QUBGpHNocI04Sw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.177.88.23
country_id: 3624060
description:
2026-01-02 21:45:26 dovecot_login authenticator failed for H=([186.177.88.23]) [186.177.88.23]:50381: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.165.219
country_id: 1605651
description:
2026-01-02 21:45:29 dovecot_login authenticator failed for H=([106.0.165.219]) [106.0.165.219]:43140: 535 Incorrect authentication data (set_id=office@kiriaswanu.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.105.243
country_id: 6252001
description:
Jan  2 21:45:51 host2 dovecot[360729]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.64.105.243, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<bMznBWpH4qYUQGnz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.62
country_id: 1269750
description:
2026-01-02 21:45:20 dovecot_login authenticator failed for H=([182.95.58.62]) [182.95.58.62]:47874: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.238.2.56
country_id: 3469034
description:
2026-01-02 21:45:45 dovecot_login authenticator failed for H=45-238-2-56.netmaisfibra.net.br [45.238.2.56]:42654: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  2 21:46:59 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@dataesite.lk>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<yvTUCWpHcrZCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.92.171.7
country_id: 6252001
description:
Jan  2 21:47:57 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ayuzonelanka.com>, method=PLAIN, rip=190.92.171.7, lip=66.85.158.91, session=<O+NODWpH1qm+XKsH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2026-01-02 21:48:07 dovecot_plain authenticator failed for H=c-98-40-101-10.hsd1.tn.comcast.net (acary) [98.40.101.10]:44612: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2026-01-02 21:50:48 dovecot_login authenticator failed for H=([115.240.244.52]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.53.44.125
country_id: 1643084
description:
Jan  2 21:50:55 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lezzarotech.com>, method=PLAIN, rip=117.53.44.125, lip=66.85.158.91, session=<uFLvF2pHOKB1NSx9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2026-01-02 21:51:00 dovecot_login authenticator failed for H=(c-50-188-204-213.unallocated.comcastbusiness.net) [50.188.204.213]:50233: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  2 21:52:55 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@maximsholdings.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<i7wNH2pHjJBCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan  2 21:55:39 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<I/vVKGpHCIcv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.11.79
country_id: 1733045
description:
2026-01-02 21:56:14 dovecot_login authenticator failed for H=([183.171.11.79]) [183.171.11.79]:58342: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  2 21:56:49 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<+qAELWpHLOui8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.142.45
country_id: 6252001
description:
Jan  2 21:56:57 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@colourmarklabels.com>, method=PLAIN, rip=47.251.142.45, lip=66.85.158.91, session=<8yV+LWpHxLov+44t>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan  2 22:00:00 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<mrFfOGpHaBMvTJuG>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 47.76.155.134
country_id: 1819730
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[47.76.155.134] [Remote Port]=[4968] [Authentication Database]=[mail] [Username]=[info@mathsmotorcysle.xyz] (10/10 failures) (blocked until [Sat Jan  3 16:29:58 2026 UTC/Sat Jan  3 21:59:58 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  2 21:59:25 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<0PRQNmpHJJ2eRdvj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.61
country_id: 2635167
description:
Jan  2 22:00:40 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.61, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<rC7fOmpHJaxX7LA9>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.73
country_id: 2635167
description:
Jan  2 22:00:04 host2 dovecot[360729]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.73, lip=66.85.158.92, TLS, session=<Z4HCOGpHQ8BX7LBJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.62
country_id: 2635167
description:
Jan  2 22:00:06 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.62, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<usDjOGpHqelX7LA+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.38
country_id: 2635167
description:
Jan  2 22:01:13 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.38, lip=66.85.158.92, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<YbzaPGpHl52594km>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.124
country_id: 6252001
description:
Jan  2 22:01:28 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=162.216.150.124, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<czi/PWpHIsei2JZ8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  2 22:01:44 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<XqiYPmpHlsRIpyJ4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.43
country_id: 2635167
description:
Jan  2 22:01:46 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.43, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<DOzbPmpHLe6594kr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.98.8
country_id: 3144096
description:
2026-01-02 22:01:58 dovecot_login authenticator failed for H=(cm-84.215.98.8.get.no) [84.215.98.8]:48788: 535 Incorrect authentication data (set_id=sales@kiriaswanu.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.39
country_id: 2635167
description:
Jan  2 22:02:53 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.39, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<mJ7QQmpH/YdX7LAn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.124
country_id: 6252001
description:
Jan  2 22:02:08 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 24 secs): user=<>, rip=162.216.150.124, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<sr8gQGpHLOOi2JZ8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.44
country_id: 2635167
description:
Jan  2 22:02:20 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.44, lip=66.85.158.92, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<XCfXQGpHteFX7LAs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.71
country_id: 2635167
description:
Jan  2 22:03:26 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.71, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<AtXNRGpHRbJX7LBH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.70
country_id: 2635167
description:
Jan  2 22:03:59 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.70, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<CgjJRmpHE+a594lG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Jan  2 22:03:18 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<X282RGpH6r4I04Sw>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 8.211.132.176
country_id: 1861060
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[8.211.132.176] [Remote Port]=[48874] [Authentication Database]=[mail] [Username]=[info@venee.lk] (10/10 failures) (blocked until [Sat Jan  3 16:33:16 2026 UTC/Sat Jan  3 22:03:16 2026 LOCAL])


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.173
country_id: 6252001
description:
Jan  2 22:04:15 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.173, lip=66.85.158.92, TLS handshaking: Connection closed, session=<ZXm4R2pHOaFAPsWt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.38
country_id: 2635167
description:
Jan  2 22:04:33 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.38, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<Hn/CSGpHCaO594km>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.167
country_id: 6252001
description:
Jan  2 22:04:33 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.167, lip=66.85.158.92, TLS handshaking: Connection closed, session=<D23JSGpHSnpAPsWn>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.64
country_id: 6252001
description:
Jan  2 22:04:37 host2 pure-ftpd[401827]: (?@147.185.132.64) [INFO] New connection from 147.185.132.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.199.59.18
country_id: 2750405
description:
2026-01-02 22:04:50 dovecot_plain authenticator failed for H=(slesughte) [128.199.59.18]:44764: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.92.171.7
country_id: 6252001
description:
Jan  2 22:04:07 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=190.92.171.7, lip=66.85.158.91, session=<DXEWR2pHRqm+XKsH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.67
country_id: 2635167
description:
Jan  2 22:05:06 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.67, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<i969SmpHebq594lD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  2 22:07:19 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<D02UUmpH3KlyB6Oa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  2 22:07:30 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<FqE4U2pHMsBnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  2 22:07:09 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=</RD6UWpHYpUUOAHJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2026-01-02 22:08:14 dovecot_plain authenticator failed for H=c-73-196-144-25.hsd1.nj.comcast.net (hookans) [73.196.144.25]:42430: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  2 22:08:38 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@lankaherbalsolutions.com>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<k4pHV2pHYFquijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  2 22:08:57 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<OKdfWGpHQsQv/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  2 22:09:15 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<Hc90WWpHWJYv/VJZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.124
country_id: 6252001
description:
Jan  2 22:09:19 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.124, lip=66.85.158.91, TLS, session=<xJTWWWpHGPKi2JZ8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  2 22:09:39 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<5/3mWmpHirwv+wDY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.124
country_id: 6252001
description:
Jan  2 22:10:19 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.124, lip=66.85.158.91, TLS, session=</XtnXWpHUuWi2JZ8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  2 22:10:07 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<poOVXGpHBOgyBvlc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 34.75.196.37
country_id: 6252001
description:
Jan  2 22:11:44 host2 dovecot[360729]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=34.75.196.37, lip=66.85.158.91, session=<g8Z/YmpH2KciS8Ql>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.53.44.125
country_id: 1643084
description:
Jan  2 22:12:24 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=117.53.44.125, lip=66.85.158.91, session=<od+7ZGpHfKd1NSx9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.130.118
country_id: 1819730
description:
Jan  2 22:12:48 host2 sshd[410097]: Disconnected from invalid user deploy 152.32.130.118 port 44270 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  2 22:14:01 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<UQKCampHsqhnpBQq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  2 22:13:28 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<jJ2QaGpH5Jpn9M4G>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.130.118
country_id: 1819730
description:
Jan  2 22:13:30 host2 sshd[410900]: Disconnected from invalid user alex 152.32.130.118 port 41184 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.130.118
country_id: 1819730
description:
Jan  2 22:14:39 host2 sshd[412133]: Disconnected from invalid user testu 152.32.130.118 port 45286 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan  2 22:16:34 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<voelc2pHoqgv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan  2 22:18:58 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@lezzarotech.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<c3EwfGpHnv8vTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  2 22:18:24 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<UXA2empHmp5o7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 22:20:00 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<3ifvf2pHoEwjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  2 22:20:42 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<J9ZfgmpHUruygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  2 22:20:50 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@askinternationalconsortium.com>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<MHvfgmpH6sVCdMcv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.92.171.7
country_id: 6252001
description:
Jan  2 22:22:36 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ayuzonelanka.com>, method=PLAIN, rip=190.92.171.7, lip=66.85.158.91, session=<BAo0iWpHFJm+XKsH>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  2 22:23:37 host2 sshd[421670]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.210.193.176
country_id: 6252001
description:
Jan  2 22:23:39 host2 sshd[421767]: Disconnected from invalid user bitrix 192.210.193.176 port 38546 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.75
country_id: 1733045
description:
2026-01-02 22:24:52 dovecot_login authenticator failed for H=([49.125.201.75]) [49.125.201.75]:51160: 535 Incorrect authentication data (set_id=v-deploy.com@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.211.31.222
country_id: 2510769
description:
2026-01-02 22:25:21 dovecot_login authenticator failed for H=([77.211.31.222]) [77.211.31.222]:57933: 535 Incorrect authentication data (set_id=v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  2 22:25:25 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<OjBFk2pHhKVCdMzo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.6.203.226
country_id: 6254930
description:
Jan  2 22:25:33 host2 sshd[423911]: Disconnected from invalid user myuser 213.6.203.226 port 56442 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 192.210.193.176
country_id: 6252001
description:
Jan  2 22:26:47 host2 sshd[424921]: Disconnected from invalid user nishant 192.210.193.176 port 38756 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.223.46
country_id: 1269750
description:
2026-01-02 22:26:49 dovecot_login authenticator failed for H=([182.95.223.46]) [182.95.223.46]:43352: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.114
country_id: 1269750
description:
2026-01-02 22:27:34 dovecot_login authenticator failed for H=([182.95.58.114]) [182.95.58.114]:45964: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.157.158
country_id: 1269750
description:
2026-01-02 22:27:18 dovecot_login authenticator failed for H=([128.185.217.150]) [125.19.157.158]:37488: 535 Incorrect authentication data (set_id=postmaster@kiriaswanu.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  2 22:27:19 host2 pure-ftpd[425356]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.6.203.226
country_id: 6254930
description:
Jan  2 22:27:24 host2 sshd[425382]: Disconnected from invalid user webmin 213.6.203.226 port 62886 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.211.55.20
country_id: 2328926
description:
Jan  2 22:28:37 host2 sshd[426499]: Disconnected from invalid user ubuntu 197.211.55.20 port 44066 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.72.22.61
country_id: 6251999
description:
2026-01-02 22:28:59 dovecot_login authenticator failed for H=static24-72-22-61.r.rev.accesscomm.ca [24.72.22.61]:34236: 535 Incorrect authentication data (set_id=test@epid.gov.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 213.6.203.226
country_id: 6254930
description:
Jan  2 22:28:32 host2 sshd[426446]: Disconnected from invalid user calvin 213.6.203.226 port 44449 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.53.44.125
country_id: 1643084
description:
Jan  2 22:29:33 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lezzarotech.com>, method=PLAIN, rip=117.53.44.125, lip=66.85.158.91, session=<cK0NompH9Ix1NSx9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.191.96.171
country_id: 2510769
description:
Jan  2 22:30:25 host2 sshd[428590]: Disconnected from invalid user jack 92.191.96.171 port 58662 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.56.205
country_id: 6252001
description:
Jan  2 22:30:11 host2 sshd[428246]: Disconnected from invalid user arjun 198.98.56.205 port 35344 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.211.55.20
country_id: 2328926
description:
Jan  2 22:31:18 host2 sshd[429669]: Disconnected from invalid user hl 197.211.55.20 port 36434 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  2 22:31:25 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@maximsholdings.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<jki8qGpHAuFCdMzo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.191.96.171
country_id: 2510769
description:
Jan  2 22:31:42 host2 sshd[430279]: Disconnected from invalid user deploy 92.191.96.171 port 43482 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.98.56.205
country_id: 6252001
description:
Jan  2 22:31:54 host2 sshd[430504]: Disconnected from invalid user dev 198.98.56.205 port 56818 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.56.205
country_id: 6252001
description:
Jan  2 22:32:59 host2 sshd[431329]: Disconnected from invalid user vpn 198.98.56.205 port 50628 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.118.138
country_id: 3144096
description:
2026-01-02 22:33:27 dovecot_login authenticator failed for H=(cm-46.212.118.138.get.no) [46.212.118.138]:36719: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.241.90
country_id: 3469034
description:
2026-01-02 22:33:41 dovecot_login authenticator failed for H=(ccabv.org9.static.gvt.net.br) [187.58.241.90]:52129: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.44.174.254
country_id: 357994
description:
2026-01-02 22:33:47 dovecot_plain authenticator failed for H=(distiolic) [102.44.174.254]:46524: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.211.55.20
country_id: 2328926
description:
Jan  2 22:33:55 host2 sshd[432261]: Disconnected from invalid user gustavo 197.211.55.20 port 59692 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.142.45
country_id: 6252001
description:
Jan  2 22:34:45 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@colourmarklabels.com>, method=PLAIN, rip=47.251.142.45, lip=66.85.158.91, session=<+H6wtGpHRpMv+44t>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  2 22:34:47 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<EiTGtGpH/MWi8GQy>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.19.251.24
country_id: 6251999
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 71.19.251.24 - env_eng@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan  2 22:36:18 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<cAIwumpHhOwv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  2 22:36:36 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<b1lEu2pHGLGeRdvj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.92.171.7
country_id: 6252001
description:
Jan  2 22:38:50 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=190.92.171.7, lip=66.85.158.91, session=<qQtHw2pH1MO+XKsH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.233
country_id: 6252001
description:
Jan  2 22:38:09 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.230.168.233, lip=66.85.158.92, TLS handshaking: Connection closed, session=<JMjzwGpHn4tb5qjp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.238
country_id: 6252001
description:
Jan  2 22:38:19 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.230.168.238, lip=66.85.158.92, TLS: Connection closed, session=<dUaPwWpHXdNb5qju>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.130
country_id: 6252001
description:
Jan  2 22:38:33 host2 dovecot[360729]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.230.168.130, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<Oz1gwmpHUaBb5qiC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.134
country_id: 6252001
description:
Jan  2 22:38:36 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.230.168.134, lip=66.85.158.92, TLS: Connection closed, session=<yX+OwmpHd61b5qiG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  2 22:39:23 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<QUs3xWpHftVIpyJ4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan  2 22:40:01 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<yCWGx2pHKrMvTJuG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.13
country_id: 6252001
description:
Jan  2 22:42:57 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.13, lip=66.85.158.92, TLS handshaking: Connection closed, session=<10Qk0mpHD67DuEwN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.234
country_id: 6252001
description:
Jan  2 22:43:08 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=195.184.76.234, lip=66.85.158.92, TLS: Connection closed, session=<I1PA0mpHhafDuEzq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.9
country_id: 6252001
description:
Jan  2 22:43:20 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=195.184.76.9, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<8uGB02pH/5DDuEwJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.232
country_id: 6252001
description:
Jan  2 22:43:23 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.232, lip=66.85.158.92, TLS: Connection closed, session=<Oc2w02pH67PDuEzo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.118
country_id: 2635167
description:
Jan  2 22:44:23 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=35.203.211.118, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<22VD12pHXdcjy9N2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.12.86.90
country_id: 1269750
description:
2026-01-02 22:44:32 dovecot_login authenticator failed for H=(mail.tataidc.com) [61.12.86.90]:59550: 535 Incorrect authentication data (set_id=lezzarotech.com@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  2 22:46:03 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<bKAW3WpHTLAv/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  2 22:45:11 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<Rfv72WpHUJwUOAHJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.44.40
country_id: 1522867
description:
2026-01-02 22:45:22 dovecot_login authenticator failed for H=([5.76.44.40]) [5.76.44.40]:57927: 535 Incorrect authentication data (set_id=office@kiriaswanu.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.118
country_id: 2635167
description:
Jan  2 22:45:23 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 4 secs): user=<>, rip=35.203.211.118, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<61jY2mpHLuojy9N2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.34.139
country_id: 3144096
description:
2026-01-02 22:45:35 dovecot_login authenticator failed for H=(cm-178.232.34.139.get.no) [178.232.34.139]:37149: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2026-01-02 22:45:38 dovecot_plain authenticator failed for H=c-71-235-225-181.hsd1.ct.comcast.net (unionade) [71.235.225.181]:50744: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  2 22:46:10 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<Td993WpHoqauijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  2 22:46:13 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<qtao3WpHgpBnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  2 22:46:21 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@dataesite.lk>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<Z+cn3mpHYqMv/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  2 22:46:32 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<My7S3mpHELIyBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  2 22:47:22 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<1O7I4WpHdLdyB6Oa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  2 22:47:34 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<FMiC4mpHnNwv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.53.44.125
country_id: 1643084
description:
Jan  2 22:50:46 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=117.53.44.125, lip=66.85.158.91, session=<URzw7WpHHrh1NSx9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.154
country_id: 3144096
description:
2026-01-02 22:51:56 dovecot_login authenticator failed for H=(cm-84.213.189.154.get.no) [84.213.189.154]:40425: 535 Incorrect authentication data (set_id=v-deploy.com@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  2 22:52:55 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<K+Km9WpH6udn9M4G>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.118
country_id: 2635167
description:
Jan  2 22:53:01 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.118, lip=66.85.158.92, TLS, session=<kJcj9mpHfOMjy9N2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.112.109.248
country_id: 6252001
description:
2026-01-02 22:52:24 dovecot_login authenticator failed for H=(host-24-112-109-248.vyvebroadband.net) [24.112.109.248]:37081: 535 Incorrect authentication data (set_id=contact@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.50
country_id: 1269750
description:
2026-01-02 22:52:34 dovecot_login authenticator failed for H=([27.123.102.50]) [27.123.102.50]:43008: 535 Incorrect authentication data (set_id=v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.58.83.146
country_id: 3175395
description:
2026-01-02 22:52:38 dovecot_login authenticator failed for H=([101.58.83.146]) [101.58.83.146]:63593: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  2 22:52:52 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<CnNz9WpHgOdnpBQq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.89.230.59
country_id: 6251999
description:
Jan  2 22:54:24 host2 sshd[454118]: error: maximum authentication attempts exceeded for invalid user admin from 24.89.230.59 port 54996 ssh2 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 24.89.230.59
country_id: 6251999
description:
Jan  2 22:54:27 host2 sshd[454177]: Disconnecting invalid user admin 24.89.230.59 port 42166: Too many authentication failures [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 24.89.230.59
country_id: 6251999
description:
Jan  2 22:54:15 host2 sshd[453933]: Disconnecting authenticating user root 24.89.230.59 port 54974: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 24.89.230.59
country_id: 6251999
description:
Jan  2 22:54:15 host2 sshd[453933]: error: maximum authentication attempts exceeded for root from 24.89.230.59 port 54974 ssh2 [preauth]


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 47.254.85.115
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[47.254.85.115] [Remote Port]=[47446] [Authentication Database]=[mail] [Username]=[sales@melanifinefood.com] (10/10 failures) (blocked until [Sat Jan  3 17:25:56 2026 UTC/Sat Jan  3 22:55:56 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  2 22:56:03 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<ywnYAGtHOrBo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan  2 22:55:58 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<EP2KAGtHVrkv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 22:56:14 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<buaEAWtH6FYjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.92.171.7
country_id: 6252001
description:
Jan  2 22:57:24 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=190.92.171.7, lip=66.85.158.91, session=<+6uxBWtHLqi+XKsH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.218.54.218
country_id: 6252001
description:
Jan  2 22:58:55 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=104.218.54.218, lip=66.85.158.91, session=<QggVC2tHpoto2jba>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan  2 22:58:58 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lezzarotech.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<pytMC2tHRnQvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  2 22:59:32 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<pTRGDWtHRrlCdMcv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2026-01-02 23:01:50 dovecot_login authenticator failed for H=(189-108-129-173.customer.tdatabrasil.net.br) [187.8.64.94]:43813: 535 Incorrect authentication data (set_id=postmaster@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.64.8
country_id: 2264397
description:
2026-01-02 23:02:02 dovecot_login authenticator failed for H=bl23-64-8.dsl.telepac.pt [144.64.64.8]:3021: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  2 23:01:21 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<OCXKE2tHKt2ygBt7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.36.113.62
country_id: 1269750
description:
2026-01-02 23:01:42 dovecot_login authenticator failed for H=([103.68.19.170]) [49.36.113.62]:38762: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.13
country_id: 241170
description:
Jan  2 23:03:03 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.13, lip=66.85.158.91, session=<nXPdGWtHwtfE+2YN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  2 23:03:52 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<fVfKHGtHrNBCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  2 23:06:10 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<iYAHJWtH2Kai8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan  2 23:06:12 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lezzarotech.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<CxEjJWtHFPsvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.218.54.218
country_id: 6252001
description:
Jan  2 23:07:08 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=104.218.54.218, lip=66.85.158.91, session=<JWtiKGtHholo2jba>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.53.44.125
country_id: 1643084
description:
Jan  2 23:08:22 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lezzarotech.com>, method=PLAIN, rip=117.53.44.125, lip=66.85.158.91, session=<tHzfLGtHXuJ1NSx9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.128.180.14
country_id: 3437598
description:
2026-01-02 23:09:18 dovecot_login authenticator failed for H=(static-14-180-128-190.telecel.com.py) [190.128.180.14]:34519: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  2 23:09:30 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<iLj2MGtHSs9CdMzo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2026-01-02 23:09:37 dovecot_login authenticator failed for H=(1522312565.colombiatel.co) [152.231.25.64]:47219: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.92.171.7
country_id: 6252001
description:
Jan  2 23:10:59 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=190.92.171.7, lip=66.85.158.91, session=<Up07NmtHGpi+XKsH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2026-01-02 23:11:33 dovecot_plain authenticator failed for H=c-174-166-153-20.hsd1.nj.comcast.net (montous) [174.166.153.20]:33612: 535 Incorrect authentication data (set_id=sales@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  2 23:16:39 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<GwmGSmtHKtmygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  2 23:18:07 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@maximsholdings.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<zqnGT2tHFudCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan  2 23:17:09 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<dDhMTGtHWKQv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-02 23:17:17 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:62936: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.23
country_id: 6252001
description:
Jan  2 23:19:07 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.23, lip=66.85.158.91, TLS handshaking: Connection closed, session=<WGx4U2tHlbVAPsUX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.17
country_id: 6252001
description:
Jan  2 23:19:24 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.17, lip=66.85.158.91, TLS handshaking: Connection closed, session=<a+V5VGtHlpZAPsUR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.53.44.125
country_id: 1643084
description:
Jan  2 23:19:49 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=117.53.44.125, lip=66.85.158.91, session=<oAnaVWtHisp1NSx9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.92.171.7
country_id: 6252001
description:
Jan  2 23:20:53 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ayuzonelanka.com>, method=PLAIN, rip=190.92.171.7, lip=66.85.158.91, session=<XEalWWtHsui+XKsH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  2 23:20:49 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<SWRiWWtH1LYyBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan  2 23:21:13 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<T+XVWmtH3IYv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  2 23:23:07 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<l8qeYWtH3sNyB6Oa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.88
country_id: 99237
description:
2026-01-02 23:23:19 dovecot_login authenticator failed for H=([65.20.204.88]) [65.20.204.88]:39091: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.177.81.194
country_id: 3624060
description:
2026-01-02 23:23:41 dovecot_login authenticator failed for H=([186.177.81.194]) [186.177.81.194]:33656: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  2 23:25:01 host2 sshd[487075]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  2 23:24:13 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=</IKZZWtHvtQUOAHJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  2 23:24:16 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<1Li5ZWtHStZnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  2 23:25:59 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<jCDka2tHVONIpyJ4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  2 23:26:25 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<PzRobWtH1qJn9M4G>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 103.244.206.6
country_id: 1643084
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[103.244.206.6] [Remote Port]=[41686] [Authentication Database]=[mail] [Username]=[support@bostonlanka.com] (10/10 failures) (blocked until [Sat Jan  3 17:56:23 2026 UTC/Sat Jan  3 23:26:23 2026 LOCAL])


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.130
country_id: 6252001
description:
Jan  2 23:26:58 host2 dovecot[360729]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=71.6.146.130, lip=66.85.158.91, session=<YlmIb2tHrrJHBpKC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  2 23:27:55 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<Oz3McmtHVNgv/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  2 23:28:12 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=</0bMc2tHWkto7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  2 23:28:23 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<B8V3dGtHzrUv/VJZ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  2 23:30:07 host2 sshd[492750]: Disconnected from invalid user user 2.57.121.25 port 9632 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  2 23:30:42 host2 pure-ftpd[493366]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.123
country_id: 2186224
description:
2026-01-02 23:30:49 dovecot_login authenticator failed for H=([121.73.163.123]) [121.73.163.123]:50288: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.102.148.242
country_id: 6252001
description:
2026-01-02 23:31:17 dovecot_login authenticator failed for H=syn-098-102-148-242.biz.spectrum.com [98.102.148.242]:55554: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.68.34
country_id: 1269750
description:
Jan  2 23:33:45 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<env_eng>, method=PLAIN, rip=43.225.68.34, lip=66.85.158.91, TLS, session=<L154hmtHSY8r4UQi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.58.115.154
country_id: 1269750
description:
Jan  2 23:33:19 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=103.58.115.154, lip=66.85.158.91, TLS, session=<6LIEhWtHXrVnOnOa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  2 23:34:24 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<jXkBimtH+LOeRdvj>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 102.204.223.27
country_id: 2328926
description:
Jan  2 23:34:39 host2 pure-ftpd[497163]: (?@102.204.223.27) [INFO] New connection from 102.204.223.27


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan  2 23:34:46 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<6w1Hi2tH/EUvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  2 23:35:19 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<Q75GjWtH3Owv+wDY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.120
country_id: 6252001
description:
Jan  2 23:35:26 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=66.132.153.120, lip=66.85.158.92, TLS: Connection closed, session=<XQrOjWtHcKlChJl4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.187.240
country_id: 3144096
description:
2026-01-02 23:36:03 dovecot_login authenticator failed for H=(cm-84.213.187.240.get.no) [84.213.187.240]:41308: 535 Incorrect authentication data (set_id=postmaster@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan  2 23:36:06 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<tXwPkGtH+N8v/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.8.12
country_id: 614540
description:
2026-01-02 23:36:16 dovecot_login authenticator failed for H=([194.31.8.12]) [194.31.8.12]:53568: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.70.122.245
country_id: 1269750
description:
2026-01-02 23:36:59 dovecot_login authenticator failed for H=(abts-mum-static-245.122.70.182.airtelbroadband.in) [182.70.122.245]:59161: 535 Incorrect authentication data (set_id=sales@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.114.143.79
country_id: 3865483
description:
2026-01-02 23:37:17 dovecot_login authenticator failed for H=host-cotesma-114-143-79.smandes.com.ar [181.114.143.79]:43258: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  2 23:37:52 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<0hFklmtHatFnpBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.255.189.56
country_id: 298795
description:
2026-01-02 23:42:19 dovecot_login authenticator failed for H=(88.255.189.56.static.ttnet.com.tr) [88.255.189.56]:50618: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.200.10
country_id: 1269750
description:
2026-01-02 23:42:29 dovecot_login authenticator failed for H=([125.19.175.85]) [122.186.200.10]:56254: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  2 23:43:57 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<tiEqrGtHPuSi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan  2 23:44:57 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lezzarotech.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<85jAr2tHBikvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.53.44.125
country_id: 1643084
description:
Jan  2 23:46:05 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lezzarotech.com>, method=PLAIN, rip=117.53.44.125, lip=66.85.158.91, session=<3JDGs2tH3Ml1NSx9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.241.90
country_id: 3469034
description:
2026-01-02 23:45:37 dovecot_login authenticator failed for H=(ccabv.org.cta.gvt.net.br) [187.58.241.90]:51667: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.226.163
country_id: 3144096
description:
2026-01-02 23:45:48 dovecot_login authenticator failed for H=(cm-178.232.226.163.get.no) [178.232.226.163]:41740: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.217.204.91
country_id: 2658434
description:
2026-01-02 23:47:03 dovecot_login authenticator failed for H=adsl-89-217-204-91.adslplus.ch [89.217.204.91]:54018: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.33.112
country_id: 3144096
description:
2026-01-02 23:47:12 dovecot_login authenticator failed for H=(cm-178.232.33.112.get.no) [178.232.33.112]:40622: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 23:48:27 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<TE9EvGtHgN8jupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.71
country_id: 6252001
description:
Jan  2 23:50:26 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.71, lip=66.85.158.92, TLS, session=<NnVxw2tHrOjG6xhH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  2 23:50:49 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<yeewxGtHirdCdMcv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.0.142.131
country_id: 1819730
description:
2026-01-02 23:53:05 dovecot_login authenticator failed for H=14-0-142-131.static.pccw-hkt.com [14.0.142.131]:45306: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.133.161.162
country_id: 130758
description:
2026-01-02 23:52:45 dovecot_login authenticator failed for H=([85.133.161.162]) [85.133.161.162]:43772: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.170.173.26
country_id: 1210997
description:
Jan  2 23:56:50 host2 sshd[522303]: Disconnected from invalid user william 103.170.173.26 port 41409 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.53.44.125
country_id: 1643084
description:
Jan  2 23:57:39 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=117.53.44.125, lip=66.85.158.91, session=<rhoa3WtHMMB1NSx9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  2 23:57:58 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<+RRG3mtHdNqygBt7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.170.173.26
country_id: 1210997
description:
Jan  2 23:59:07 host2 sshd[524881]: Disconnected from invalid user kapsch 103.170.173.26 port 55159 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.210.61.208
country_id: 2802361
description:
Jan  2 23:58:12 host2 sshd[523728]: Disconnected from invalid user ll 35.210.61.208 port 48408 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.43.161
country_id: 3017382
description:
Jan  2 23:58:42 host2 sshd[524235]: Disconnected from invalid user test 51.178.43.161 port 51558 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.210.61.208
country_id: 2802361
description:
Jan  2 23:59:26 host2 sshd[525207]: Disconnected from invalid user alireza 35.210.61.208 port 49232 [preauth]


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 50.6.249.92
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[50.6.249.92] [Remote Port]=[37674] [Authentication Database]=[mail] [Username]=[support@lakwelholdings.com] (10/10 failures) (blocked until [Sat Jan  3 18:29:27 2026 UTC/Sat Jan  3 23:59:27 2026 LOCAL])


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.43.161
country_id: 3017382
description:
Jan  2 23:59:47 host2 sshd[525559]: Disconnected from invalid user ftpuser 51.178.43.161 port 48648 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  2 23:59:29 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<yeaw42tHKpMyBvlc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.170.173.26
country_id: 1210997
description:
Jan  2 23:59:46 host2 sshd[525534]: Disconnected from invalid user ll 103.170.173.26 port 60989 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.9.22
country_id: 1733045
description:
2026-01-02 23:59:58 dovecot_login authenticator failed for H=([183.171.9.22]) [183.171.9.22]:48038: 535 Incorrect authentication data (set_id=office@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.144.113
country_id: 1643084
description:
Jan  3 00:01:04 host2 sshd[527250]: Disconnected from invalid user alireza 103.217.144.113 port 51496 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.100.104
country_id: 294640
description:
2026-01-03 00:00:14 dovecot_login authenticator failed for H=(2-55-100-104.orange.net.il) [2.55.100.104]:55568: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.210.61.208
country_id: 2802361
description:
Jan  3 00:00:29 host2 sshd[526673]: Disconnected from invalid user postgre 35.210.61.208 port 48596 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.210.61.208
country_id: 2802361
description:
Jan  3 00:01:02 host2 sshd[527232]: Disconnected from invalid user kapsch 35.210.61.208 port 34162 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.43.161
country_id: 3017382
description:
Jan  3 00:01:18 host2 sshd[527470]: Disconnected from invalid user minecraft 51.178.43.161 port 58398 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.210.61.208
country_id: 2802361
description:
Jan  3 00:01:32 host2 sshd[527705]: Disconnected from invalid user proradis 35.210.61.208 port 47962 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.170.173.26
country_id: 1210997
description:
Jan  3 00:01:39 host2 sshd[527808]: Disconnected from invalid user user53 103.170.173.26 port 50238 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  3 00:01:51 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<pBIn7GtHgt4UOAHJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  3 00:02:06 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<8O4I7WtHdIxnmud6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.210.61.208
country_id: 2802361
description:
Jan  3 00:02:35 host2 sshd[528928]: Disconnected from invalid user jy 35.210.61.208 port 47326 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.43.161
country_id: 3017382
description:
Jan  3 00:02:48 host2 sshd[529201]: Disconnected from invalid user admin 51.178.43.161 port 39932 [preauth]


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 103.154.231.122
country_id: 1643084
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[103.154.231.122] [Remote Port]=[35956] [Authentication Database]=[mail] [Username]=[info@askinternationalconsortium.com] (10/10 failures) (blocked until [Sat Jan  3 18:32:04 2026 UTC/Sun Jan  4 00:02:04 2026 LOCAL])


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.144.113
country_id: 1643084
description:
Jan  3 00:03:21 host2 sshd[530007]: Disconnected from invalid user tempuser 103.217.144.113 port 37846 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.140.250
country_id: 3469034
description:
2026-01-03 00:03:24 dovecot_login authenticator failed for H=([181.233.140.250]) [181.233.140.250]:57686: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.43.161
country_id: 3017382
description:
Jan  3 00:03:49 host2 sshd[530551]: Disconnected from invalid user devops 51.178.43.161 port 37018 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.220.126
country_id: 1269750
description:
2026-01-03 00:03:12 dovecot_login authenticator failed for H=([152.52.220.126]) [152.52.220.126]:35412: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 51.178.43.161
country_id: 3017382
description:
Jan  3 00:03:17 host2 sshd[529947]: Received disconnect from 51.178.43.161 port 52588:11: Bye Bye [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  3 00:03:28 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<Wc7t8WtHEIZIpyJ4>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 72.167.34.120
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[72.167.34.120] [Remote Port]=[34320] [Authentication Database]=[mail] [Username]=[admin@monarchdss.com] (10/10 failures) (blocked until [Sat Jan  3 18:33:26 2026 UTC/Sun Jan  4 00:03:26 2026 LOCAL])


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.170.173.26
country_id: 1210997
description:
Jan  3 00:04:08 host2 sshd[530985]: Disconnected from invalid user postgre 103.170.173.26 port 45321 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 00:03:23 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<tWek8WtHTNFyB6Oa>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.217.144.113
country_id: 1643084
description:
Jan  3 00:04:51 host2 sshd[531851]: Disconnected from invalid user saiful 103.217.144.113 port 39988 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 00:04:54 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<snET92tHmrIv/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 00:05:22 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@dataesite.lk>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<HEi/+GtH8N8v/VJZ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.144.113
country_id: 1643084
description:
Jan  3 00:05:36 host2 sshd[532996]: Disconnected from invalid user william 103.217.144.113 port 43440 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 00:06:01 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<pEQT+2tHkIVn9M4G>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 104.236.196.180
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[104.236.196.180] [Remote Port]=[38686] [Authentication Database]=[mail] [Username]=[admin@monarchdss.com] (10/10 failures) (blocked until [Sat Jan  3 18:36:24 2026 UTC/Sun Jan  4 00:06:24 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  3 00:06:26 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<vN1+/GtHHpdo7MS0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.216.119.134
country_id: 1819730
description:
Jan  3 00:09:12 host2 sshd[536955]: Disconnected from invalid user jira 185.216.119.134 port 46998 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  3 00:11:28 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<2mqMDmxH/IyeRdvj>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.216.119.134
country_id: 1819730
description:
Jan  3 00:11:48 host2 sshd[539832]: Disconnected from invalid user redmine 185.216.119.134 port 54576 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.216.119.134
country_id: 1819730
description:
Jan  3 00:12:26 host2 sshd[540584]: Disconnected from invalid user emma 185.216.119.134 port 38056 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  3 00:12:58 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<hJTlE2xHap8v+wDY>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 47.251.0.216
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[47.251.0.216] [Remote Port]=[40810] [Authentication Database]=[mail] [Username]=[support@rehanseo.online] (10/10 failures) (blocked until [Sat Jan  3 18:42:56 2026 UTC/Sun Jan  4 00:12:56 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan  3 00:13:30 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<V7jXFWxHNuIvTJuG>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 00:15:14 host2 sshd[544229]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.251.13.59
country_id: 6252001
description:
Jan  3 00:15:29 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=47.251.13.59, lip=66.85.158.91, session=<YSwEHWxH4Ngv+w07>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.37
country_id: 1269750
description:
2026-01-03 00:15:38 dovecot_login authenticator failed for H=([203.193.147.41]) [203.193.147.37]:50183: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.73.205
country_id: 6252001
description:
2026-01-03 00:15:51 dovecot_login authenticator failed for H=([209.23.73.205]) [209.23.73.205]:36642: 535 Incorrect authentication data (set_id=info)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 103.164.20.42
country_id: 1643084
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[103.164.20.42] [Remote Port]=[39372] [Authentication Database]=[mail] [Username]=[contact@melanifinefood.com] (10/10 failures) (blocked until [Sat Jan  3 18:46:48 2026 UTC/Sun Jan  4 00:16:48 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  3 00:16:50 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<jUK3IWxHzJlnpBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.227
country_id: 1819730
description:
2026-01-03 00:19:29 dovecot_login authenticator failed for H=227.42.246.220.static.netvigator.com [220.246.42.227]:51336: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-01-03 00:19:46 dovecot_login authenticator failed for H=(ip-103-29-185-162.pascalwave.com) [103.29.185.162]:37602: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.170.50.2
country_id: 3932488
description:
2026-01-03 00:19:59 dovecot_login authenticator failed for H=([45.170.50.2]) [45.170.50.2]:45171: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.251.249.79
country_id: 2300660
description:
2026-01-03 00:20:12 dovecot_login authenticator failed for H=([197.251.249.79]) [197.251.249.79]:35738: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  3 00:21:52 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<BMS9M2xHVLyi8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.192.166
country_id: 1269750
description:
2026-01-03 00:22:52 dovecot_login authenticator failed for H=([27.123.105.234]) [128.185.192.166]:39362: 535 Incorrect authentication data (set_id=bostonlanka@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.46
country_id: 3865483
description:
2026-01-03 00:23:14 dovecot_login authenticator failed for H=([131.161.184.46]) [131.161.184.46]:47132: 535 Incorrect authentication data (set_id=bostonlanka)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan  3 00:23:48 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lezzarotech.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<PtGuOmxH6m8vTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.53.44.125
country_id: 1643084
description:
Jan  3 00:23:56 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@lezzarotech.com>, method=PLAIN, rip=117.53.44.125, lip=66.85.158.91, session=<hwIcO2xHENp1NSx9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.218.49
country_id: 3469034
description:
2026-01-03 00:24:58 dovecot_login authenticator failed for H=([179.184.218.49]) [179.184.218.49]:56309: 535 Incorrect authentication data (set_id=office@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  3 00:24:37 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<uGOPPWxHnOUjupN+>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 35.186.147.126
country_id: 1880251
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[35.186.147.126] [Remote Port]=[58780] [Authentication Database]=[mail] [Username]=[contact@colperlab.com] (10/10 failures) (blocked until [Sat Jan  3 18:54:35 2026 UTC/Sun Jan  4 00:24:35 2026 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2026-01-03 00:25:14 dovecot_login authenticator failed for H=(nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:35113: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.190.246
country_id: 3017382
description:
Jan  3 00:26:15 host2 sshd[555952]: Disconnected from invalid user louwg 54.38.190.246 port 37148 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.109.56.72
country_id: 6252001
description:
2026-01-03 00:27:06 dovecot_login authenticator failed for H=(dfw-206-109-56-72.ip4.99.network) [206.109.56.72]:37668: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.81
country_id: 2077456
description:
2026-01-03 00:27:21 dovecot_login authenticator failed for H=210.0.90.81.static.nexnet.net.au [210.0.90.81]:38024: 535 Incorrect authentication data (set_id=contacto)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 66.116.199.47
country_id: 1269750
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[66.116.199.47] [Remote Port]=[39842] [Authentication Database]=[mail] [Username]=[contact@askinternationalconsortium.com] (10/10 failures) (blocked until [Sat Jan  3 18:59:12 2026 UTC/Sun Jan  4 00:29:12 2026 LOCAL])


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.190.246
country_id: 3017382
description:
Jan  3 00:29:37 host2 sshd[559087]: Disconnected from invalid user cristian 54.38.190.246 port 37596 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  3 00:29:14 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<a9MZTmxHoptCdMcv>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 54.38.190.246
country_id: 3017382
description:
Jan  3 00:30:11 host2 sshd[559747]: Disconnected from invalid user move 54.38.190.246 port 55734 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.192
country_id: 6252001
description:
Jan  3 00:30:25 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.192, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<tuxsUmxHYdjN0h/A>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.223
country_id: 6252001
description:
Jan  3 00:31:09 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.223, lip=66.85.158.92, session=<0mQNVWxH1VJAPpzf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.190.246
country_id: 3017382
description:
Jan  3 00:31:12 host2 sshd[560883]: Disconnected from invalid user ehsan 54.38.190.246 port 57484 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.222
country_id: 6252001
description:
Jan  3 00:31:20 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.222, lip=66.85.158.92, TLS: Connection closed, session=<E5OzVWxHEI9APpze>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.134
country_id: 6252001
description:
Jan  3 00:33:14 host2 dovecot[360729]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 1 secs): user=<>, rip=66.132.153.134, lip=66.85.158.92, session=<Gpt9XGxHeLlChJmG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2026-01-03 00:33:39 dovecot_login authenticator failed for H=([185.255.212.178]) [185.255.212.178]:1406: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.57
country_id: 6252001
description:
Jan  3 00:33:53 host2 dovecot[360729]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=167.94.146.57, lip=66.85.158.92, session=<zIHRXmxHDMmnXpI5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.170.251.33
country_id: 2017370
description:
2026-01-03 00:33:53 dovecot_login authenticator failed for H=(178.170.251.33.leadertelecom.ru) [178.170.251.33]:58176: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.82.194
country_id: 1269750
description:
2026-01-03 00:33:53 dovecot_login authenticator failed for H=([59.145.171.168]) [182.78.82.194]:39834: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  3 00:33:13 host2 pure-ftpd[562583]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.166.78
country_id: 1819730
description:
2026-01-03 00:34:12 dovecot_login authenticator failed for H=(223-197-166-78.static.imsbiz.com) [223.197.166.78]:60699: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.224.242.137
country_id: 2635167
description:
2026-01-03 00:35:19 dovecot_login authenticator failed for H=([109.224.242.136]) [109.224.242.137]:51386: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2026-01-03 00:35:48 dovecot_login authenticator failed for H=(237-166.adsl.static.espeed.com.bn) [119.160.166.237]:37738: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.76.55.177
country_id: 3175395
description:
2026-01-03 00:35:09 dovecot_login authenticator failed for H=([151.76.55.177]) [151.76.55.177]:41068: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 00:37:05 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<VRApamxHTLYyBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  3 00:38:47 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<TXpBcGxHktOygBt7>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 178.128.27.123
country_id: 1880251
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[178.128.27.123] [Remote Port]=[54162] [Authentication Database]=[mail] [Username]=[contact@kiriaswanu.com] (10/10 failures) (blocked until [Sat Jan  3 19:08:45 2026 UTC/Sun Jan  4 00:38:45 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  3 00:39:58 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<nieCdGxHcJdnmud6>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 20.56.1.201
country_id: 2750405
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[20.56.1.201] [Remote Port]=[59442] [Authentication Database]=[mail] [Username]=[admin@monarchdss.com] (10/10 failures) (blocked until [Sat Jan  3 19:09:52 2026 UTC/Sun Jan  4 00:39:52 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  3 00:39:54 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<JrE2dGxHMugUOAHJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  3 00:41:12 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<ShPqeGxHDpdIpyJ4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 00:42:06 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<oq0efGxHcoYv/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 00:42:34 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<i6bKfWxHxMQv/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 00:43:34 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<IG9egWxH7N5yB6Oa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  3 00:44:38 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<O0EwhWxHyIto7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.191.100
country_id: 3144096
description:
2026-01-03 00:45:07 dovecot_login authenticator failed for H=(cm-84.213.191.100.get.no) [84.213.191.100]:52339: 535 Incorrect authentication data (set_id=postmaster@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.98.41.27
country_id: 1269750
description:
2026-01-03 00:45:16 dovecot_login authenticator failed for H=([59.98.41.27]) [59.98.41.27]:46498: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 00:45:49 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<HBpjiWxHkrFn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  3 00:48:55 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<gLJ5lGxHiNeeRdvj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.38.0.39
country_id: 6252001
description:
2026-01-03 00:49:03 dovecot_login authenticator failed for H=([45.38.0.39]) [45.38.0.39]:3717: 535 Incorrect authentication data (set_id=contact@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
country_id: 2510769
description:
2026-01-03 00:50:08 dovecot_login authenticator failed for H=(90.pool90-173-78.static.orange.es) [90.173.78.90]:34563: 535 Incorrect authentication data (set_id=office@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.61.215.87
country_id: 3469034
description:
2026-01-03 00:49:13 dovecot_login authenticator failed for H=201-61-215-87.bbone.telesp.net.br [201.61.215.87]:43577: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.30.170
country_id: 3144096
description:
2026-01-03 00:50:01 dovecot_login authenticator failed for H=(cm-178.232.30.170.get.no) [178.232.30.170]:44967: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.157.158
country_id: 1269750
description:
2026-01-03 00:50:12 dovecot_login authenticator failed for H=([128.185.217.150]) [125.19.157.158]:38820: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.85.43.162
country_id: 3686110
description:
2026-01-03 00:50:22 dovecot_login authenticator failed for H=([190.85.43.162]) [190.85.43.162]:57605: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  3 00:50:53 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<LB6Hm2xHRsUv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.248.111.238
country_id: 6252001
description:
2026-01-03 00:51:50 dovecot_plain authenticator failed for H=(seyncosed) [38.248.111.238]:40143: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-03 00:51:54 dovecot_plain authenticator failed for H=(preed) [64.72.74.162]:36800: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.144.65
country_id: 1643084
description:
Jan  3 00:52:14 host2 sshd[583125]: Disconnected from invalid user practice 103.217.144.65 port 34326 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan  3 00:52:33 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<DBx6oWxHUBIvTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.198.76.173
country_id: 6252001
description:
Jan  3 00:52:13 host2 sshd[583129]: Disconnected from invalid user bb 143.198.76.173 port 45464 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.100.107.238
country_id: 1831722
description:
Jan  3 00:53:49 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=175.100.107.238, lip=66.85.158.91, session=<5zbjpWxHeO2vZGvu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.174
country_id: 1269750
description:
2026-01-03 00:54:04 dovecot_login authenticator failed for H=(nsg-corporate-217.166.185.122.airtel.in) [27.123.98.174]:43244: 535 Incorrect authentication data (set_id=postmaster@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.187.226.240
country_id: 1269750
description:
Jan  3 00:54:15 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<hr>, method=PLAIN, rip=122.187.226.240, lip=66.85.158.91, TLS, session=<Wqw+pmxHE5Z6u+Lw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.109
country_id: 1814991
description:
Jan  3 00:56:06 host2 dovecot[360729]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=94.231.206.109, lip=66.85.158.92, session=<TE5NrmxH0eZe585t>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.37
country_id: 1814991
description:
Jan  3 00:55:40 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=94.231.206.37, lip=66.85.158.92, session=<L8i9rGxH/91e584l>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.34
country_id: 1814991
description:
Jan  3 00:55:50 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=94.231.206.34, lip=66.85.158.92, session=<vtVcrWxH981e584i>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  3 00:56:04 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<LFoVrmxHXKtnpBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.54
country_id: 1269750
description:
2026-01-03 00:56:46 dovecot_login authenticator failed for H=(nsg-corporate-54.202.186.122.airtel.in) [122.186.202.54]:45306: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.198.76.173
country_id: 6252001
description:
Jan  3 00:56:58 host2 sshd[588609]: Disconnected from invalid user thomas 143.198.76.173 port 53566 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.33
country_id: 1814991
description:
Jan  3 00:56:10 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=94.231.206.33, lip=66.85.158.92, session=<Je2BrmxH14Ne584h>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.69.0.72
country_id: 6252001
description:
Jan  3 00:57:10 host2 sshd[588847]: Disconnected from invalid user backupuser 34.69.0.72 port 57320 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.194
country_id: 1269750
description:
2026-01-03 00:57:21 dovecot_login authenticator failed for H=([182.95.115.194]) [182.95.115.194]:59622: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.144.65
country_id: 1643084
description:
Jan  3 00:57:43 host2 sshd[589353]: Disconnected from invalid user thomas 103.217.144.65 port 38010 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.69.0.72
country_id: 6252001
description:
Jan  3 00:57:43 host2 sshd[589384]: Disconnected from invalid user duser 34.69.0.72 port 36660 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.69.0.72
country_id: 6252001
description:
Jan  3 00:58:16 host2 sshd[589923]: Disconnected from invalid user wyf 34.69.0.72 port 50904 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.144.65
country_id: 1643084
description:
Jan  3 00:58:32 host2 sshd[590176]: Disconnected from invalid user stack 103.217.144.65 port 38124 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.198.76.173
country_id: 6252001
description:
Jan  3 00:58:56 host2 sshd[590590]: Disconnected from invalid user itadmin 143.198.76.173 port 48066 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  3 01:00:04 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<ChJevGxHmKqi8GQy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.144.65
country_id: 1643084
description:
Jan  3 00:59:15 host2 sshd[590923]: Disconnected from invalid user admin1 103.217.144.65 port 42760 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.18.99.126
country_id: 1269750
description:
2026-01-03 00:59:43 dovecot_login authenticator failed for H=([125.18.99.126]) [125.18.99.126]:52390: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.217.144.65
country_id: 1643084
description:
Jan  3 01:00:00 host2 sshd[591637]: Disconnected from invalid user backupuser 103.217.144.65 port 56014 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  3 01:01:00 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<LSG4v2xHwN0jupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.117.148
country_id: 1819730
description:
Jan  3 01:01:22 host2 sshd[593581]: Disconnected from invalid user test 101.36.117.148 port 52188 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2026-01-03 01:01:25 dovecot_login authenticator failed for H=([185.134.179.106]) [185.101.16.250]:60057: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.71.52.51
country_id: 6252001
description:
Jan  3 01:01:27 host2 sshd[593727]: Disconnected from invalid user admin 34.71.52.51 port 33908 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.102
country_id: 1269750
description:
2026-01-03 01:01:41 dovecot_login authenticator failed for H=([27.123.119.99]) [182.95.224.102]:44090: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.198.76.173
country_id: 6252001
description:
Jan  3 01:01:41 host2 sshd[593977]: Disconnected from invalid user mongod 143.198.76.173 port 41448 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.196.50.91
country_id: 3469034
description:
Jan  3 01:02:46 host2 sshd[594978]: Disconnected from invalid user admin 200.196.50.91 port 36026 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan  3 01:02:55 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lezzarotech.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<nhGMxmxHlgYvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.70.19.11
country_id: 3469034
description:
2026-01-03 01:03:20 dovecot_login authenticator failed for H=(45-70-19-11.static.damsolutionsturbo.com.br) [45.70.19.11]:41470: 535 Incorrect authentication data (set_id=bostonlanka@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.16.194.197
country_id: 3865483
description:
Jan  3 01:03:36 host2 sshd[595840]: Disconnected from invalid user git 190.16.194.197 port 51606 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.198.76.173
country_id: 6252001
description:
Jan  3 01:03:42 host2 sshd[595942]: Disconnected from invalid user forum 143.198.76.173 port 52808 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.112.109.248
country_id: 6252001
description:
2026-01-03 01:03:48 dovecot_login authenticator failed for H=(host-24-112-109-248.vyvebroadband.net) [24.112.109.248]:41077: 535 Incorrect authentication data (set_id=bostonlanka)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.117.148
country_id: 1819730
description:
Jan  3 01:05:32 host2 sshd[598062]: Disconnected from invalid user test 101.36.117.148 port 46336 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.196.50.91
country_id: 3469034
description:
Jan  3 01:06:06 host2 sshd[598693]: Disconnected from invalid user test 200.196.50.91 port 40962 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 34.71.52.51
country_id: 6252001
description:
Jan  3 01:05:12 host2 sshd[597694]: Received disconnect from 34.71.52.51 port 47412:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.70.82.95
country_id: 1282988
description:
Jan  3 01:06:14 host2 sshd[598784]: Disconnected from invalid user ubuntu 202.70.82.95 port 11146 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.71.52.51
country_id: 6252001
description:
Jan  3 01:06:43 host2 sshd[599418]: Disconnected from invalid user admin 34.71.52.51 port 59736 [preauth]


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 199.229.220.185
country_id: 6251999
description:
2026-01-03 01:07:29 H=([199.229.220.185]) [199.229.220.185]:47084 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<contact@bostonlanka.com> A=dovecot_login:contact@bostonlanka.com rejected RCPT <mail22@winpukpik777.com>: Sender verify failed


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.117.148
country_id: 1819730
description:
Jan  3 01:07:46 host2 sshd[600343]: Disconnected from invalid user admin 101.36.117.148 port 49658 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  3 01:08:13 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@askinternationalconsortium.com>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<TvmC2WxH+M9CdMcv>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.70.82.95
country_id: 1282988
description:
Jan  3 01:09:19 host2 sshd[602105]: Disconnected from invalid user admin 202.70.82.95 port 9748 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 34.71.52.51
country_id: 6252001
description:
Jan  3 01:10:24 host2 sshd[603506]: Received disconnect from 34.71.52.51 port 42704:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.117.148
country_id: 1819730
description:
Jan  3 01:10:42 host2 sshd[603749]: Disconnected from invalid user admin 101.36.117.148 port 53656 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.71.52.51
country_id: 6252001
description:
Jan  3 01:10:57 host2 sshd[603955]: Disconnected from invalid user test 34.71.52.51 port 40286 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.182.130
country_id: 1269750
description:
2026-01-03 01:12:03 dovecot_login authenticator failed for H=([182.95.182.130]) [182.95.182.130]:40300: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.160.100
country_id: 6252001
description:
2026-01-03 01:11:50 dovecot_login authenticator failed for H=syn-024-105-160-100.biz.spectrum.com [24.105.160.100]:45326: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.16.194.197
country_id: 3865483
description:
Jan  3 01:13:49 host2 sshd[607078]: Disconnected from invalid user admin 190.16.194.197 port 33048 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.71.52.51
country_id: 6252001
description:
Jan  3 01:14:10 host2 sshd[607422]: Disconnected from invalid user ubuntu 34.71.52.51 port 59342 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.117.148
country_id: 1819730
description:
Jan  3 01:14:18 host2 sshd[607592]: Disconnected from invalid user git 101.36.117.148 port 45810 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  3 01:14:34 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<ajI78GxH9t0yBvlc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.210.118
country_id: 1269750
description:
2026-01-03 01:15:25 dovecot_login authenticator failed for H=([152.52.210.118]) [152.52.210.118]:34250: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  3 01:16:31 host2 sshd[610050]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.21
country_id: 1269750
description:
2026-01-03 01:16:08 dovecot_login authenticator failed for H=(nsg-corporate-21.226.187.122.airtel.in) [122.187.226.21]:35050: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.202.110.183
country_id: 798544
description:
Jan  3 01:16:47 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=85.202.110.183, lip=66.85.158.91, TLS, session=<HJtJ92xHzLNVym63>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.135.48
country_id: 3144096
description:
2026-01-03 01:17:10 dovecot_login authenticator failed for H=([188.124.135.48]) [188.124.135.48]:56150: 535 Incorrect authentication data (set_id=sales@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.253.154
country_id: 1269750
description:
2026-01-03 01:17:21 dovecot_login authenticator failed for H=([125.21.56.137]) [125.19.253.154]:56646: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.190.205.193
country_id: 3469034
description:
Jan  3 01:17:22 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info>, method=PLAIN, rip=45.190.205.193, lip=66.85.158.91, TLS, session=<uvsF+WxHdMktvs3B>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  3 01:18:00 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<zsF4/GxHbt1nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  3 01:19:25 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<kxqXAW1HJsuygBt7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.149.196
country_id: 1733045
description:
2026-01-03 01:19:34 dovecot_login authenticator failed for H=([183.171.149.196]) [183.171.149.196]:60978: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.158.216
country_id: 2510769
description:
2026-01-03 01:19:33 dovecot_login authenticator failed for H=([207.188.158.216]) [207.188.158.216]:21054: 535 Incorrect authentication data (set_id=bostonlanka@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.59.26
country_id: 1269750
description:
2026-01-03 01:19:48 dovecot_login authenticator failed for H=([125.23.125.209]) [122.187.59.26]:45192: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  3 01:19:52 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<x70wA21HvqEUOAHJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.174
country_id: 2186224
description:
2026-01-03 01:19:54 dovecot_login authenticator failed for H=([121.73.162.174]) [121.73.162.174]:56732: 535 Incorrect authentication data (set_id=bostonlanka)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  3 01:19:25 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<f7SSAW1HiKEv/VJZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.248
country_id: 2186224
description:
2026-01-03 01:21:04 dovecot_login authenticator failed for H=([121.73.162.248]) [121.73.162.248]:33642: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  3 01:21:10 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<BB3ZB21Haq1IpyJ4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.170
country_id: 1269750
description:
2026-01-03 01:21:23 dovecot_login authenticator failed for H=([122.184.128.193]) [182.95.185.170]:46060: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  3 01:23:22 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<Pru1D21HXJ9o7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  3 01:23:39 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<q0+0EG1HVOxyB6Oa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  3 01:25:53 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<5OytGG1HlK9n9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.113.241
country_id: 1819730
description:
Jan  3 01:26:39 host2 sshd[619840]: Disconnected from invalid user fivem 101.36.113.241 port 59372 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan  3 01:26:51 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<LhMcHG1HDN+eRdvj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.183.186.200
country_id: 2510769
description:
Jan  3 01:28:03 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=5.183.186.200, lip=66.85.158.91, TLS, session=<yxiMH21HxOwFt7rI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  3 01:29:04 host2 dovecot[360729]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<DWIVJG1Hjocv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 168.0.224.112
country_id: 3469034
description:
Jan  3 01:28:24 host2 dovecot[360729]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<charanaw>, method=PLAIN, rip=168.0.224.112, lip=66.85.158.91, TLS, session=<UDuyIG1HDuqoAOBw>


