# incident

plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.196.9.133
country_id: 2635167
description:
Jan 10 02:01:16 host2 sshd[2190253]: Disconnected from invalid user admin 185.196.9.133 port 47492 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.9.133
country_id: 2635167
description:
Jan 10 02:02:14 host2 sshd[2191039]: Disconnected from invalid user steam 185.196.9.133 port 48722 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2026-01-10 02:02:50 dovecot_login authenticator failed for H=(ip-arana.net.id.as132673) [103.90.27.83]:52372: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.106
country_id: 1269750
description:
2026-01-10 02:03:25 dovecot_login authenticator failed for H=(nsg-corporate-121.229.185.122.airtel.in) [122.186.202.106]:44066: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.106
country_id: 1880251
description:
Jan 10 02:04:57 host2 sshd[2192953]: Disconnected from invalid user test 45.78.230.106 port 47110 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Jan 10 02:06:13 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.91, TLS: Connection closed, session=<vezuefpH1JSLonHU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.144.14.204
country_id: 1210997
description:
2026-01-10 02:07:26 dovecot_login authenticator failed for H=([122.144.14.204]) [122.144.14.204]:59621: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.18
country_id: 1269750
description:
2026-01-10 02:07:55 dovecot_login authenticator failed for H=([125.20.231.218]) [182.95.58.18]:38112: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.230.106
country_id: 1880251
description:
Jan 10 02:08:03 host2 sshd[2195761]: Disconnected from invalid user test 45.78.230.106 port 33134 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.144.20
country_id: 3996063
description:
2026-01-10 02:08:08 dovecot_login authenticator failed for H=([177.236.144.20]) [177.236.144.20]:50744: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.22.116.94
country_id: 1269750
description:
2026-01-10 02:15:52 dovecot_login authenticator failed for H=([152.52.234.222]) [125.22.116.94]:56224: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.150.115
country_id: 1819730
description:
2026-01-10 02:16:11 dovecot_login authenticator failed for H=115.150.48.116.static.netvigator.com [116.48.150.115]:58247: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.250.36
country_id: 1562822
description:
Jan 10 02:17:24 host2 dovecot[1180436]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=152.32.250.36, lip=66.85.158.91, session=<MVb0ofpHQpuYIPok>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.166
country_id: 2635167
description:
Jan 10 02:17:44 host2 dovecot[1180436]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.166, lip=66.85.158.91, TLS, session=<NCkmo/pHke2594mm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.250.36
country_id: 1562822
description:
Jan 10 02:19:17 host2 dovecot[1180436]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=152.32.250.36, lip=66.85.158.92, session=<mx2rqPpHkJqYIPok>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.252
country_id: 1880251
description:
Jan 10 02:21:00 host2 sshd[2207235]: Disconnected from invalid user steam 45.78.201.252 port 38162 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.118.215.192
country_id: 3865483
description:
2026-01-10 02:21:29 dovecot_login authenticator failed for H=(red.138.118.215.192.ssservicios.com.ar) [138.118.215.192]:38487: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.165
country_id: 6252001
description:
Jan 10 02:21:40 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=205.210.31.165, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<w8E0sfpHcNfN0h+l>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.134.27.194
country_id: 1210997
description:
2026-01-10 02:21:17 dovecot_login authenticator failed for H=([103.134.27.194]) [103.134.27.194]:40244: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.205.169
country_id: 1733045
description:
2026-01-10 02:23:36 dovecot_login authenticator failed for H=([49.124.205.169]) [49.124.205.169]:33528: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.214.209.153
country_id: 6252001
description:
Jan 10 02:29:56 host2 sshd[2210793]: Disconnected from invalid user ftpuser 172.214.209.153 port 58504 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.214.209.153
country_id: 6252001
description:
Jan 10 02:30:33 host2 sshd[2211460]: Disconnected from invalid user deployerer 172.214.209.153 port 56760 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.214.209.153
country_id: 6252001
description:
Jan 10 02:31:09 host2 sshd[2211735]: Disconnected from invalid user ftpuser 172.214.209.153 port 50354 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.214.209.153
country_id: 6252001
description:
Jan 10 02:31:46 host2 sshd[2211888]: Disconnected from invalid user vpn 172.214.209.153 port 50570 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.201.252
country_id: 1880251
description:
Jan 10 02:33:02 host2 sshd[2212250]: Disconnected from invalid user steam 45.78.201.252 port 59418 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.54
country_id: 1733045
description:
2026-01-10 02:34:35 dovecot_login authenticator failed for H=([49.124.151.54]) [49.124.151.54]:42638: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.194.190
country_id: 1269750
description:
2026-01-10 02:35:12 dovecot_login authenticator failed for H=([128.185.194.190]) [128.185.194.190]:33952: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.183
country_id: 3144096
description:
2026-01-10 02:35:40 dovecot_login authenticator failed for H=([84.213.189.183]) [84.213.189.183]:52697: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.174.182.38
country_id: 2077456
description:
2026-01-10 02:35:59 dovecot_login authenticator failed for H=203-174-182-38.ade.static-ipl.aapt.com.au [203.174.182.38]:59837: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.224.240.74
country_id: 6252001
description:
Jan 10 02:39:30 host2 sshd[2215353]: Disconnected from invalid user user1 52.224.240.74 port 60296 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.197.41
country_id: 1861060
description:
Jan 10 02:40:18 host2 sshd[2215869]: Disconnected from invalid user deployerer 160.251.197.41 port 46638 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 146.190.79.63
country_id: 6252001
description:
Jan 10 02:40:51 host2 sshd[2216168]: Disconnected from invalid user frappe 146.190.79.63 port 45416 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.197.41
country_id: 1861060
description:
Jan 10 02:40:57 host2 sshd[2216204]: Disconnected from invalid user steam 160.251.197.41 port 59328 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.109.221
country_id: 2921044
description:
Jan 10 02:41:19 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=157.230.109.221, lip=66.85.158.92, TLS, session=<wlNx9/pHftSd5m3d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.19
country_id: 241170
description:
Jan 10 02:41:23 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.19, lip=66.85.158.91, session=<ncCO9/pHOtXE+2YT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.89.154.59
country_id: 285570
description:
Jan 10 02:41:26 host2 sshd[2216420]: Disconnected from invalid user steam 78.89.154.59 port 54298 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.89.154.59
country_id: 285570
description:
Jan 10 02:41:59 host2 sshd[2216576]: Disconnected from invalid user user2 78.89.154.59 port 39366 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.10
country_id: 241170
description:
Jan 10 02:42:08 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.10, lip=66.85.158.91, session=<Jp9I+vpHdIHE+2YK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.79.63
country_id: 6252001
description:
Jan 10 02:42:10 host2 sshd[2216672]: Disconnected from invalid user server 146.190.79.63 port 36910 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 78.89.154.59
country_id: 285570
description:
Jan 10 02:42:32 host2 sshd[2216779]: Disconnected from invalid user steam 78.89.154.59 port 39502 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.193
country_id: 3865483
description:
Jan 10 02:44:36 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=179.0.252.193, lip=66.85.158.91, TLS, session=<XG0KAvtHGJyzAPzB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 189.201.197.8
country_id: 3469034
description:
Jan 10 02:44:14 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=189.201.197.8, lip=66.85.158.91, TLS, session=<RevXAPtHPMG9ycUI>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 52.224.240.74
country_id: 6252001
description:
Jan 10 02:45:55 host2 sshd[2218802]: Disconnected from invalid user server 52.224.240.74 port 34890 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan 10 02:46:14 host2 pure-ftpd[2218943]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2026-01-10 02:48:36 dovecot_plain authenticator failed for H=(huctomat) [91.73.188.251]:57161: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2026-01-10 02:50:02 dovecot_plain authenticator failed for H=c-71-224-169-28.hsd1.pa.comcast.net (cabing) [71.224.169.28]:53282: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan 10 02:53:07 host2 pure-ftpd[2223969]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.19.197
country_id: 6252001
description:
Jan 10 03:01:45 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=18.97.19.197, lip=66.85.158.92, TLS handshaking: Connection closed, session=<PMqLQPtHNsISYRPF>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 03:07:56 host2 sshd[2236422]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.190
country_id: 1269750
description:
2026-01-10 03:13:11 dovecot_login authenticator failed for H=([27.123.98.190]) [27.123.98.190]:58532: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Jan 10 03:15:35 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.92, TLS: Connection closed, session=<I1oIcvtHCJKLonHU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 10 03:17:48 host2 sshd[2245205]: Disconnected from invalid user admin 2.57.121.112 port 27465 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.116.31.97
country_id: 3017382
description:
Jan 10 03:17:54 host2 sshd[2245317]: Disconnected from invalid user vpn 89.116.31.97 port 36158 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.67.56.52
country_id: 1643084
description:
Jan 10 03:19:07 host2 sshd[2246322]: Disconnected from invalid user claude 36.67.56.52 port 5043 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.242.142
country_id: 1269750
description:
2026-01-10 03:20:43 dovecot_login authenticator failed for H=([125.19.172.137]) [182.78.242.142]:39376: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.50
country_id: 1269750
description:
2026-01-10 03:21:05 dovecot_login authenticator failed for H=(aes-static-225.77.144.59.airtel.in) [182.95.123.50]:41202: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 03:22:03 host2 sshd[2249237]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.67.56.52
country_id: 1643084
description:
Jan 10 03:21:32 host2 sshd[2248786]: Disconnected from invalid user vpn 36.67.56.52 port 5046 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.67.56.52
country_id: 1643084
description:
Jan 10 03:22:09 host2 sshd[2249280]: Disconnected from invalid user tester 36.67.56.52 port 5047 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.116.31.97
country_id: 3017382
description:
Jan 10 03:23:22 host2 sshd[2250290]: Disconnected from invalid user user2 89.116.31.97 port 57660 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.27.237
country_id: 2077456
description:
2026-01-10 03:25:04 dovecot_login authenticator failed for H=([120.157.27.237]) [120.157.27.237]:46396: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 89.116.31.97
country_id: 3017382
description:
Jan 10 03:24:32 host2 sshd[2251214]: Disconnected from invalid user admin1 89.116.31.97 port 47506 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.116.31.97
country_id: 3017382
description:
Jan 10 03:25:07 host2 sshd[2251806]: Disconnected from invalid user teamspeak 89.116.31.97 port 59370 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.96.62.29
country_id: 1269750
description:
2026-01-10 03:25:45 dovecot_login authenticator failed for H=([59.96.62.29]) [59.96.62.29]:56728: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.27
country_id: 2186224
description:
2026-01-10 03:30:12 dovecot_login authenticator failed for H=([121.73.163.27]) [121.73.163.27]:58740: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.63.52.54
country_id: 3469034
description:
2026-01-10 03:30:40 dovecot_login authenticator failed for H=(201-91-74-17.customer.tdatabrasil.net.br) [201.63.52.54]:41619: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.165.130.26
country_id: 1643084
description:
Jan 10 03:30:59 host2 sshd[2257466]: Disconnected from invalid user user 103.165.130.26 port 2763 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.74
country_id: 6252001
description:
Jan 10 03:34:01 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.74, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<D4Dts/tHg8vN0h9K>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2026-01-10 03:33:38 dovecot_plain authenticator failed for H=(puthitie) [24.105.248.218]:40692: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2026-01-10 03:34:50 dovecot_plain authenticator failed for H=c-73-168-136-150.hsd1.il.comcast.net (verodizo) [73.168.136.150]:33724: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.210.246.54
country_id: 289688
description:
2026-01-10 03:35:03 dovecot_login authenticator failed for H=([37.210.246.54]) [37.210.246.54]:19523: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.44.40
country_id: 1522867
description:
2026-01-10 03:40:35 dovecot_plain authenticator failed for H=(unwash) [5.76.44.40]:35415: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.82
country_id: 1269750
description:
2026-01-10 03:42:33 dovecot_login authenticator failed for H=([125.17.225.97]) [182.95.61.82]:43040: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.214.49.194
country_id: 6252001
description:
2026-01-10 03:42:47 dovecot_login authenticator failed for H=wsip-72-214-49-194.hr.hr.cox.net [72.214.49.194]:39478: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.83.130.80
country_id: 1269750
description:
2026-01-10 03:45:18 dovecot_login authenticator failed for H=(80.130.83.103.static.rapidnet.in) [103.83.130.80]:51626: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.30
country_id: 1269750
description:
2026-01-10 03:46:27 dovecot_login authenticator failed for H=([125.22.154.57]) [182.95.119.30]:46186: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.29.26
country_id: 3144096
description:
2026-01-10 03:47:36 dovecot_login authenticator failed for H=(cm-178.232.29.26.get.no) [178.232.29.26]:48009: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 192.155.90.118
country_id: 6252001
description:
Jan 10 03:47:40 host2 dovecot[1180436]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=192.155.90.118, lip=66.85.158.92, TLS, session=<ykPI5PtHUGrAm1p2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 128.203.200.235
country_id: 6251999
description:
Jan 10 03:49:08 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=128.203.200.235, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<VEv86ftHus6Ay8jr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.233.116.124
country_id: 1269750
description:
Jan 10 03:52:53 host2 sshd[2279089]: Disconnected from invalid user ubuntu 68.233.116.124 port 20542 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2026-01-10 03:54:41 dovecot_login authenticator failed for H=([83.136.176.12]) [83.136.176.12]:46818: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.233.116.124
country_id: 1269750
description:
Jan 10 03:55:04 host2 sshd[2281531]: Disconnected from invalid user server 68.233.116.124 port 49968 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.233.116.124
country_id: 1269750
description:
Jan 10 03:56:14 host2 sshd[2282737]: Disconnected from invalid user teamspeak 68.233.116.124 port 16486 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.202
country_id: 1149361
description:
2026-01-10 04:00:41 dovecot_login authenticator failed for H=([180.94.75.202]) [180.94.75.202]:48046: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.146
country_id: 1819730
description:
2026-01-10 04:00:53 dovecot_login authenticator failed for H=146.47.246.220.static.netvigator.com [220.246.47.146]:56542: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.207.252
country_id: 6252001
description:
Jan 10 04:02:51 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=45.79.207.252, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<rFsPG/xHW5otT8/8>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.154.234.9
country_id: 1522867
description:
Jan 10 04:03:21 host2 sshd[2289403]: Disconnected from invalid user ftpuser 212.154.234.9 port 32218 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-10 04:05:01 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (ephaurnic) [87.103.126.54]:53179: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.144.124.91
country_id: 6252001
description:
Jan 10 04:05:27 host2 sshd[2291868]: Disconnected from invalid user user1 24.144.124.91 port 49956 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 212.154.234.9
country_id: 1522867
description:
Jan 10 04:05:53 host2 sshd[2292340]: Disconnected from invalid user frappe 212.154.234.9 port 54541 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.144.124.91
country_id: 6252001
description:
Jan 10 04:08:40 host2 sshd[2295219]: Disconnected from invalid user ftpuser 24.144.124.91 port 43590 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 24.144.124.91
country_id: 6252001
description:
Jan 10 04:09:37 host2 sshd[2296326]: Disconnected from invalid user frappe 24.144.124.91 port 57574 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.106.155
country_id: 3469034
description:
2026-01-10 04:11:00 dovecot_login authenticator failed for H=(177-174-106-155.user.vivozap.com.br) [177.174.106.155]:34527: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.102.40.218
country_id: 6252001
description:
Jan 10 04:10:13 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=212.102.40.218, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<JQlhNfxHEC3UZija>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.22
country_id: 241170
description:
Jan 10 04:10:26 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.22, lip=66.85.158.91, session=<d2oENvxHfsjE+2YW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.41.122
country_id: 1269750
description:
2026-01-10 04:10:37 dovecot_login authenticator failed for H=([125.23.243.66]) [125.23.41.122]:47198: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.228.53.174
country_id: 6252001
description:
Jan 10 04:11:40 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.228.53.174, lip=66.85.158.92, TLS, session=<2NuZOvxHGjVC5DWu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.19.200.63
country_id: 660013
description:
2026-01-10 04:13:28 dovecot_login authenticator failed for H=([146.19.200.63]) [146.19.200.63]:34222: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.51
country_id: 3144096
description:
2026-01-10 04:14:07 dovecot_login authenticator failed for H=(51-170-97-62.cust.smartcall.no) [62.97.170.51]:39600: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 128.203.201.155
country_id: 6251999
description:
Jan 10 04:14:20 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=128.203.201.155, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<w+MfRPxHjoCAy8mb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 10 04:16:23 host2 sshd[2304314]: Disconnected from invalid user admin 2.57.121.112 port 12580 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.209.108.42
country_id: 6254930
description:
2026-01-10 04:17:54 dovecot_plain authenticator failed for H=(oyane) [185.209.108.42]:37406: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2026-01-10 04:17:49 dovecot_plain authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net (calerify) [71.62.34.216]:34950: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.242.73.39
country_id: 6252001
description:
[2026-01-10 04:18:12 +0530] info [webmaild] 91.242.73.39 - env_eng@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.179.59.99
country_id: 6252001
description:
[2026-01-10 04:18:13 +0530] info [webmaild] 186.179.59.99 - lezzarotech@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.221.130
country_id: 1269750
description:
2026-01-10 04:18:53 dovecot_login authenticator failed for H=(nsg-corporate-130.221.187.122.airtel.in) [122.187.221.130]:43202: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2026-01-10 04:19:11 dovecot_login authenticator failed for H=([103.251.31.154]) [103.251.31.154]:51032: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.227.254.155
country_id: 3703430
description:
Jan 10 04:19:11 host2 pure-ftpd[2307226]: (?@45.227.254.155) [INFO] New connection from 45.227.254.155


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.132.221.84
country_id: 1210997
description:
2026-01-10 04:19:25 dovecot_login authenticator failed for H=([103.132.220.252]) [103.132.221.84]:52208: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.146
country_id: 1819730
description:
2026-01-10 04:19:39 dovecot_login authenticator failed for H=146.47.246.220.static.netvigator.com [220.246.47.146]:52300: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.129
country_id: 6252001
description:
Jan 10 04:20:40 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 22 secs): user=<>, rip=66.132.153.129, lip=66.85.158.92, TLS handshaking: Connection closed, session=<nULHWvxHfulChJmB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-10 04:23:01 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (windo) [87.103.126.54]:7098: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.124
country_id: 6252001
description:
Jan 10 04:24:52 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.124, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<r6XGafxHbMzG6xh8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.207
country_id: 1733045
description:
2026-01-10 04:26:36 dovecot_login authenticator failed for H=([49.124.148.207]) [49.124.148.207]:56904: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.63.110
country_id: 3144096
description:
2026-01-10 04:26:45 dovecot_login authenticator failed for H=([84.214.63.110]) [84.214.63.110]:46066: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.190.155.43
country_id: 6252001
description:
2026-01-10 04:27:32 dovecot_plain authenticator failed for H=(agery) [76.190.155.43]:53833: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.83.98
country_id: 1269750
description:
2026-01-10 04:29:46 dovecot_login authenticator failed for H=([182.71.132.193]) [182.79.83.98]:55888: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2026-01-10 04:30:24 dovecot_login authenticator failed for H=(syn-065-191-211-033.res.spectrum.com) [65.191.211.33]:51828: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.110.189.45
country_id: 2750405
description:
2026-01-10 04:33:37 dovecot_login authenticator failed for H=([193.110.189.45]) [193.110.189.45]:45123: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.126
country_id: 1269750
description:
2026-01-10 04:34:16 dovecot_login authenticator failed for H=(nsg-corporate-190.152.185.122.airtel.in) [182.95.178.126]:56514: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2026-01-10 04:34:27 dovecot_plain authenticator failed for H=c-73-197-194-98.hsd1.nj.comcast.net (mitingly) [73.197.194.98]:58662: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2026-01-10 04:35:58 dovecot_login authenticator failed for H=([90.160.139.163]) [90.160.139.163]:51418: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2026-01-10 04:36:26 dovecot_login authenticator failed for H=([193.46.192.20]) [193.46.192.20]:52201: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.0.183.222
country_id: 3865483
description:
Jan 10 04:39:14 host2 sshd[2329859]: Disconnected from invalid user hari 200.0.183.222 port 51476 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.196.92
country_id: 1819730
description:
2026-01-10 04:42:20 dovecot_login authenticator failed for H=([223.197.196.92]) [223.197.196.92]:60698: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.201.62
country_id: 1269750
description:
2026-01-10 04:42:26 dovecot_login authenticator failed for H=(nsg-corporate-226.215.186.122.airtel.in) [122.186.201.62]:57466: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.253.154
country_id: 1269750
description:
2026-01-10 04:42:36 dovecot_login authenticator failed for H=([125.21.56.137]) [125.19.253.154]:53106: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.161.232.9
country_id: 6252001
description:
2026-01-10 04:43:11 dovecot_login authenticator failed for H=ip98-161-232-9.ph.ph.cox.net [98.161.232.9]:47706: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.0.183.222
country_id: 3865483
description:
Jan 10 04:44:47 host2 sshd[2334130]: Disconnected from invalid user sameer 200.0.183.222 port 50964 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.0.183.222
country_id: 3865483
description:
Jan 10 04:45:33 host2 sshd[2335025]: Disconnected from invalid user lavanya 200.0.183.222 port 36508 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.26.82.247
country_id: 298795
description:
2026-01-10 04:46:09 dovecot_plain authenticator failed for H=(enich) [5.26.82.247]:43192: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 5.181.87.33
country_id: 298795
description:
Jan 10 04:46:17 host2 sshd[2335507]: Disconnected from invalid user sameer 5.181.87.33 port 43310 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.0.183.222
country_id: 3865483
description:
Jan 10 04:46:26 host2 sshd[2335585]: Disconnected from invalid user krishan 200.0.183.222 port 45290 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.181.87.33
country_id: 298795
description:
Jan 10 04:47:22 host2 sshd[2336578]: Disconnected from invalid user a 5.181.87.33 port 38966 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2026-01-10 04:54:03 dovecot_plain authenticator failed for H=(undisker) [12.150.243.22]:28976: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.23
country_id: 241170
description:
Jan 10 04:54:02 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.23, lip=66.85.158.91, session=<WDX10fxHrJ7E+2YX>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 04:54:43 host2 sshd[2342456]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 13.89.125.227
country_id: 6252001
description:
Jan 10 04:56:43 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=13.89.125.227, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<rjG12/xHIskNWX3j>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.165.200
country_id: 6252001
description:
Jan 10 04:57:59 host2 dovecot[1180436]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=71.6.165.200, lip=66.85.158.91, TLS, session=<czc+4PxHhNlHBqXI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.165.200
country_id: 6252001
description:
Jan 10 04:57:59 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=71.6.165.200, lip=66.85.158.91, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<lGY/4PxHZtpHBqXI>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan 10 04:59:20 host2 pure-ftpd[2346062]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.33.186.151
country_id: 3686110
description:
Jan 10 05:03:51 host2 sshd[2348168]: Disconnected from invalid user claude 179.33.186.151 port 37014 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.93
country_id: 2750405
description:
Jan 10 05:04:36 host2 sshd[2348404]: Disconnected from invalid user jyotsna 20.123.146.93 port 48467 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 68.183.3.153
country_id: 2750405
description:
Jan 10 05:04:45 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=68.183.3.153, lip=66.85.158.91, TLS: Connection closed, session=<FaRz+PxHgoJEtwOZ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.33.186.151
country_id: 3686110
description:
Jan 10 05:05:43 host2 sshd[2349155]: Disconnected from invalid user test1 179.33.186.151 port 17433 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan 10 05:06:16 host2 pure-ftpd[2349369]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.33.186.151
country_id: 3686110
description:
Jan 10 05:06:26 host2 sshd[2349403]: Disconnected from invalid user deployerer 179.33.186.151 port 15650 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.33.186.151
country_id: 3686110
description:
Jan 10 05:07:40 host2 sshd[2349807]: Disconnected from invalid user claude 179.33.186.151 port 52263 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 05:08:47 host2 sshd[2350240]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.20
country_id: 6252001
description:
Jan 10 05:08:43 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.20, lip=66.85.158.92, session=<LV+XBv1HUenDuEwU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.22
country_id: 6252001
description:
Jan 10 05:08:53 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=195.184.76.22, lip=66.85.158.92, session=<ykcyB/1H85nDuEwW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.117
country_id: 6252001
description:
Jan 10 05:09:07 host2 dovecot[1180436]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=195.184.76.117, lip=66.85.158.92, session=<X7kGCP1H1czDuEx1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.114
country_id: 6252001
description:
Jan 10 05:09:10 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.114, lip=66.85.158.92, session=<l302CP1Hw8vDuExy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.200.181.42
country_id: 3686110
description:
Jan 10 05:09:30 host2 sshd[2350519]: Disconnected from invalid user test1 152.200.181.42 port 59338 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.238.104
country_id: 1643084
description:
Jan 10 05:09:39 host2 sshd[2350576]: Disconnected from invalid user test1 103.49.238.104 port 37670 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.200.181.42
country_id: 3686110
description:
Jan 10 05:10:32 host2 sshd[2351356]: Disconnected from invalid user user2 152.200.181.42 port 37572 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.190.22.247
country_id: 2750405
description:
Jan 10 05:11:35 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=146.190.22.247, lip=66.85.158.91, session=<WvfEEP1HyN2Svhb3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.200.181.42
country_id: 3686110
description:
Jan 10 05:11:46 host2 sshd[2351894]: Disconnected from invalid user ubuntu 152.200.181.42 port 44040 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.154
country_id: 3144096
description:
2026-01-10 05:11:52 dovecot_login authenticator failed for H=(cm-84.213.189.154.get.no) [84.213.189.154]:39334: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.49.238.104
country_id: 1643084
description:
Jan 10 05:11:54 host2 sshd[2351947]: Disconnected from invalid user testuser 103.49.238.104 port 51658 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.238.2.7
country_id: 3469034
description:
2026-01-10 05:12:14 dovecot_login authenticator failed for H=45-238-2-7.netmaisfibra.net.br [45.238.2.7]:55024: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.130
country_id: 6252001
description:
Jan 10 05:14:13 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.130, lip=66.85.158.92, TLS: Connection closed, session=<S5dOGv1HxmxChJmC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-10 05:15:29 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (fersishea) [87.103.126.54]:45048: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.150.115
country_id: 1819730
description:
2026-01-10 05:15:40 dovecot_login authenticator failed for H=115.150.48.116.static.netvigator.com [116.48.150.115]:57538: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.213.242
country_id: 3469034
description:
2026-01-10 05:16:25 dovecot_login authenticator failed for H=([200.149.213.242]) [200.149.213.242]:34708: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.207.210.23
country_id: 2960313
description:
2026-01-10 05:16:33 dovecot_plain authenticator failed for H=(scushes) [88.207.210.23]:64172: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.166.137.91
country_id: 6252001
description:
2026-01-10 05:16:54 dovecot_login authenticator failed for H=wsip-70-166-137-91.fv.ks.cox.net [70.166.137.91]:48372: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.110.150
country_id: 660013
description:
2026-01-10 05:17:02 dovecot_login authenticator failed for H=([45.82.110.150]) [45.82.110.150]:33664: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.238.122
country_id: 2542007
description:
2026-01-10 05:17:19 dovecot_login authenticator failed for H=([154.146.238.122]) [154.146.238.122]:56024: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.93
country_id: 2750405
description:
Jan 10 05:19:40 host2 sshd[2356068]: Disconnected from invalid user mary 20.123.146.93 port 50371 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2026-01-10 05:19:53 dovecot_login authenticator failed for H=([62.220.236.203]) [62.220.236.203]:48012: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.49.63.41
country_id: 3469034
description:
2026-01-10 05:20:22 dovecot_login authenticator failed for H=customer-187-49-63-41.f1net.com.br [187.49.63.41]:44264: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.94
country_id: 2750405
description:
Jan 10 05:21:27 host2 sshd[2357428]: Disconnected from invalid user radheshyam 20.123.146.94 port 36673 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.42.225.40
country_id: 2510769
description:
2026-01-10 05:24:23 dovecot_login authenticator failed for H=40.red-81-42-225.staticip.rima-tde.net [81.42.225.40]:35050: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.144.27.228
country_id: 6252001
description:
2026-01-10 05:25:04 dovecot_plain authenticator failed for H=c-73-144-27-228.hsd1.mi.comcast.net (repteed) [73.144.27.228]:39020: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.79.182.243
country_id: 2802361
description:
Jan 10 05:25:05 host2 pure-ftpd[2360564]: (?@34.79.182.243) [INFO] New connection from 34.79.182.243


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2026-01-10 05:25:11 dovecot_login authenticator failed for H=(138.219.244.10.static.softdados.net) [177.128.209.48]:58160: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.95
country_id: 2750405
description:
Jan 10 05:25:13 host2 sshd[2360592]: Disconnected from invalid user httpd 20.123.146.95 port 14888 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.76.134.123
country_id: 2802361
description:
Jan 10 05:25:56 host2 pure-ftpd[2361273]: (?@34.76.134.123) [INFO] New connection from 34.76.134.123


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.246.209.138
country_id: 798544
description:
Jan 10 05:26:23 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=91.246.209.138, lip=66.85.158.91, TLS, session=<WA3SRP1HC8tb9tGK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.117.16.118
country_id: 3865483
description:
Jan 10 05:26:43 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=138.117.16.118, lip=66.85.158.91, TLS, session=<Bk7qRf1HZsiKdRB2>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.92
country_id: 2750405
description:
Jan 10 05:26:59 host2 sshd[2362012]: Disconnected from invalid user krishan 20.123.146.92 port 24313 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 130.250.191.228
country_id: 1269750
description:
Jan 10 05:35:07 host2 sshd[2368467]: Disconnected from invalid user server 130.250.191.228 port 43926 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 130.250.191.228
country_id: 1269750
description:
Jan 10 05:35:47 host2 sshd[2369097]: Disconnected from invalid user test1 130.250.191.228 port 55448 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.195.66
country_id: 1269750
description:
2026-01-10 05:37:29 dovecot_login authenticator failed for H=([128.185.169.25]) [125.19.195.66]:50746: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.204.124.32
country_id: 1269750
description:
2026-01-10 05:37:40 dovecot_login authenticator failed for H=([49.204.124.32]) [49.204.124.32]:51630: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.57.141
country_id: 6252001
description:
Jan 10 05:37:49 host2 sshd[2370825]: Disconnected from invalid user frappe 198.98.57.141 port 54492 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2026-01-10 05:38:06 dovecot_login authenticator failed for H=(85-19-195-12.telia-isp.no) [85.19.195.12]:40892: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.98.57.141
country_id: 6252001
description:
Jan 10 05:37:08 host2 sshd[2370252]: Disconnected from invalid user test 198.98.57.141 port 43370 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.57.141
country_id: 6252001
description:
Jan 10 05:38:25 host2 sshd[2371288]: Disconnected from invalid user test1 198.98.57.141 port 37386 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2026-01-10 05:40:32 dovecot_login authenticator failed for H=([189.59.210.1]) [186.215.245.175]:38272: 535 Incorrect authentication data (set_id=postmaster@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.82
country_id: 2077456
description:
2026-01-10 05:40:55 dovecot_login authenticator failed for H=210.0.90.82.static.nexnet.net.au [210.0.90.82]:37506: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.209.108.42
country_id: 6254930
description:
2026-01-10 05:43:28 dovecot_plain authenticator failed for H=(selly) [185.209.108.42]:51208: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.122.91.196
country_id: 2921044
description:
Jan 10 05:44:01 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=134.122.91.196, lip=66.85.158.92, TLS, session=<HYrchP1H+GGGelvE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.122.91.196
country_id: 2921044
description:
Jan 10 05:44:11 host2 dovecot[1180436]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=134.122.91.196, lip=66.85.158.92, session=<c2Jthf1H/JKGelvE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.229.197.38
country_id: 3996063
description:
Jan 10 05:48:38 host2 sshd[2379831]: Disconnected from invalid user user1 177.229.197.38 port 35480 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.156.67.18
country_id: 6252001
description:
Jan 10 05:50:47 host2 sshd[2382050]: Disconnected from invalid user teamspeak 12.156.67.18 port 45176 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.229.197.38
country_id: 3996063
description:
Jan 10 05:52:29 host2 sshd[2383211]: Disconnected from invalid user user 177.229.197.38 port 49572 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.229.197.38
country_id: 3996063
description:
Jan 10 05:53:01 host2 sshd[2383694]: Disconnected from invalid user user 177.229.197.38 port 40188 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.6.193.137
country_id: 6252001
description:
Jan 10 05:53:45 host2 sshd[2384280]: Disconnected from invalid user claude 50.6.193.137 port 43364 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.229.197.38
country_id: 3996063
description:
Jan 10 05:54:07 host2 sshd[2384587]: Disconnected from invalid user server 177.229.197.38 port 33600 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.77.220.188
country_id: 203312
description:
Jan 10 05:56:00 host2 sshd[2387134]: Disconnected from invalid user server 41.77.220.188 port 52512 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.132.181.70
country_id: 1522867
description:
2026-01-10 05:56:09 dovecot_login authenticator failed for H=2.132.181.70.dynamic.telecom.kz [2.132.181.70]:53869: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.255.189.56
country_id: 298795
description:
2026-01-10 05:56:18 dovecot_login authenticator failed for H=(88.255.189.56.static.ttnet.com.tr) [88.255.189.56]:36363: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.202
country_id: 2186224
description:
2026-01-10 05:56:34 dovecot_login authenticator failed for H=([121.73.163.202]) [121.73.163.202]:33602: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 85.121.54.7
country_id: 2750405
description:
Jan 10 05:57:02 host2 sshd[2388065]: Disconnected from invalid user azureuser 85.121.54.7 port 38542 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.6.193.137
country_id: 6252001
description:
Jan 10 05:56:28 host2 sshd[2387594]: Disconnected from invalid user azureuser 50.6.193.137 port 39162 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.6.193.137
country_id: 6252001
description:
Jan 10 05:58:03 host2 sshd[2388912]: Disconnected from invalid user ubuntu 50.6.193.137 port 37192 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.227.237.176
country_id: 1861060
description:
Jan 10 05:58:25 host2 sshd[2389126]: Disconnected from invalid user user2 156.227.237.176 port 37808 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 15.235.140.46
country_id: 1880251
description:
Jan 10 05:58:43 host2 sshd[2389296]: Disconnected from invalid user teamspeak 15.235.140.46 port 61572 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.230.3
country_id: 1880251
description:
Jan 10 06:02:22 host2 sshd[2392614]: Disconnected from invalid user ubuntu 45.78.230.3 port 36690 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-10 06:01:44 dovecot_plain authenticator failed for H=(soncon) [64.72.74.162]:40273: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.3
country_id: 1880251
description:
Jan 10 06:03:35 host2 sshd[2393623]: Disconnected from invalid user vpn 45.78.230.3 port 53626 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.133.156.133
country_id: 294640
description:
2026-01-10 06:06:17 dovecot_login authenticator failed for H=([195.133.156.133]) [195.133.156.133]:51383: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.255.189.56
country_id: 298795
description:
2026-01-10 06:06:40 dovecot_login authenticator failed for H=([88.255.189.56]) [88.255.189.56]:50192: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.216.213.140
country_id: 2921044
description:
[2026-01-10 06:07:07 +0530] info [cpaneld] 185.216.213.140 - lezzarotech "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2026-01-10 06:07:36 dovecot_plain authenticator failed for H=c-73-197-194-98.hsd1.nj.comcast.net (quition) [73.197.194.98]:41066: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2026-01-10 06:08:47 dovecot_plain authenticator failed for H=(thempion) [176.113.155.132]:41358: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 06:10:01 host2 sshd[2399611]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.134.100
country_id: 690791
description:
Jan 10 06:10:27 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=37.221.134.100, lip=66.85.158.91, TLS, session=<NHFl4v1HJI4l3YZk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.63.133.72
country_id: 3175395
description:
Jan 10 06:10:45 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=185.63.133.72, lip=66.85.158.91, TLS, session=</1J64/1H84C5P4VI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.206.54
country_id: 1269750
description:
2026-01-10 06:11:21 dovecot_login authenticator failed for H=([182.95.3.57]) [125.19.206.54]:35092: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-01-10 06:11:40 dovecot_login authenticator failed for H=([197.219.228.242]) [197.219.228.242]:49394: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.119.2
country_id: 226074
description:
Jan 10 06:12:04 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=196.0.119.2, lip=66.85.158.91, TLS, session=<C0kJ6P1HKrbEAHcC>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 06:12:24 host2 sshd[2402304]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 154.72.27.202
country_id: 51537
description:
Jan 10 06:12:26 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=154.72.27.202, lip=66.85.158.91, TLS, session=<99hI6f1HupeaSBvK>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 06:13:38 host2 sshd[2403928]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-10 06:13:54 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (mospast) [87.103.126.54]:16760: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 06:15:08 host2 sshd[2404093]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 06:15:39 host2 sshd[2406176]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 06:16:34 host2 sshd[2407116]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-01-10 06:17:08 dovecot_login authenticator failed for H=([103.168.241.32]) [103.168.241.32]:49815: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.149.161.131
country_id: 6252001
description:
2026-01-10 06:17:20 dovecot_login authenticator failed for H=c-50-149-161-131.hsd1.tn.comcast.net [50.149.161.131]:61571: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 209.38.96.38
country_id: 2750405
description:
Jan 10 06:16:54 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=209.38.96.38, lip=66.85.158.92, TLS: Connection closed, session=<m2Z1+v1HwE7RJmAm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.126
country_id: 6252001
description:
Jan 10 06:16:56 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=66.132.153.126, lip=66.85.158.92, TLS: Connection closed, session=<ObOZ+v1HOK1ChJl+>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 06:17:25 host2 sshd[2407747]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.12.112.186
country_id: 3469034
description:
2026-01-10 06:18:00 dovecot_login authenticator failed for H=([187.12.112.186]) [187.12.112.186]:37335: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.147.85
country_id: 3144096
description:
2026-01-10 06:18:00 dovecot_login authenticator failed for H=([178.232.147.85]) [178.232.147.85]:53044: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.122
country_id: 1269750
description:
2026-01-10 06:18:14 dovecot_login authenticator failed for H=([59.145.116.161]) [182.95.230.122]:53492: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 06:18:57 host2 sshd[2408609]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 06:19:48 host2 sshd[2410824]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.201.62
country_id: 1269750
description:
2026-01-10 06:19:30 dovecot_login authenticator failed for H=(nsg-corporate-62.201.186.122.airtel.in) [122.186.201.62]:56396: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.18
country_id: 1269750
description:
2026-01-10 06:20:07 dovecot_login authenticator failed for H=([182.95.58.18]) [182.95.58.18]:59588: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.151.158
country_id: 3144096
description:
2026-01-10 06:20:16 dovecot_login authenticator failed for H=([84.210.151.158]) [84.210.151.158]:39081: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 06:20:32 host2 sshd[2411927]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.111
country_id: 6252001
description:
Jan 10 06:20:53 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.111, lip=66.85.158.91, TLS, session=<YW6xCP5HVOvG6xhv>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 06:21:32 host2 sshd[2412874]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.50
country_id: 1269750
description:
2026-01-10 06:23:32 dovecot_login authenticator failed for H=(aes-static-225.77.144.59.airtel.in) [182.95.123.50]:39156: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.73.187
country_id: 6252001
description:
2026-01-10 06:24:25 dovecot_login authenticator failed for H=([209.23.73.187]) [209.23.73.187]:35522: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 18.97.5.30
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 18.97.5.30: 250 connections per 30 seconds to 2078 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
country_id: 3469034
description:
2026-01-10 06:25:29 dovecot_login authenticator failed for H=([179.125.124.14]) [179.125.124.14]:33898: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.80.146.46
country_id: 3469034
description:
2026-01-10 06:29:28 dovecot_login authenticator failed for H=(18980204017.user.veloxzone.com.br) [189.80.146.46]:41504: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.22
country_id: 1269750
description:
2026-01-10 06:30:00 dovecot_login authenticator failed for H=(aes-static-105.28.22.125.airtel.in) [182.95.228.22]:35134: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.202.197.108
country_id: 6252001
description:
2026-01-10 06:35:32 dovecot_plain authenticator failed for H=(covent) [50.202.197.108]:37664: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.161
country_id: 2993457
description:
Jan 10 06:36:56 host2 pure-ftpd[2427720]: (?@194.165.16.161) [INFO] New connection from 194.165.16.161


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.111.220.249
country_id: 2963597
description:
[2026-01-10 06:36:44 +0530] info [webmaild] 172.111.220.249 - washeera@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.47.217
country_id: 6252001
description:
Jan 10 06:39:51 host2 sshd[2430012]: Disconnected from invalid user postgres 209.141.47.217 port 55584 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.194.164
country_id: 6252001
description:
Jan 10 06:42:07 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.65.194.164, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<nd6gVP5H0qsUQcKk>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.47.217
country_id: 6252001
description:
Jan 10 06:43:57 host2 sshd[2433136]: Disconnected from invalid user test 209.141.47.217 port 46290 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.254.244.211
country_id: 798544
description:
2026-01-10 06:44:12 dovecot_plain authenticator failed for H=(kiford) [94.254.244.211]:43980: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.133.157.163
country_id: 1643084
description:
Jan 10 06:43:50 host2 sshd[2433060]: Disconnected from invalid user estest 43.133.157.163 port 60008 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.133.157.163
country_id: 1643084
description:
Jan 10 06:44:29 host2 sshd[2433573]: Disconnected from invalid user vpsuser 43.133.157.163 port 33510 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.141.47.217
country_id: 6252001
description:
Jan 10 06:45:33 host2 sshd[2434515]: Disconnected from invalid user vpsuser 209.141.47.217 port 44252 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.250
country_id: 3865483
description:
Jan 10 06:46:57 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<hr>, method=PLAIN, rip=179.0.251.250, lip=66.85.158.91, TLS, session=<39l9ZP5H4+qzAPv6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.71.89.208
country_id: 3469034
description:
Jan 10 06:46:27 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=177.71.89.208, lip=66.85.158.91, TLS, session=<1g4BY/5HfrSxR1nQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.8.251.93
country_id: 3469034
description:
Jan 10 06:46:32 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=177.8.251.93, lip=66.85.158.91, TLS, session=<IrwLY/5HS+KxCPtd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.137.62
country_id: 99237
description:
Jan 10 06:46:51 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<hr>, method=PLAIN, rip=65.20.137.62, lip=66.85.158.91, TLS, session=<yJSEZP5HsoBBFIk+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.139.77
country_id: 3144096
description:
2026-01-10 06:49:55 dovecot_login authenticator failed for H=([188.124.139.77]) [188.124.139.77]:34500: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-10 06:49:25 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (disurden) [87.103.126.54]:55031: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2026-01-10 06:49:35 dovecot_login authenticator failed for H=([50.188.204.213]) [50.188.204.213]:34655: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 85.217.149.11
country_id: 798549
description:
Jan 10 06:52:49 host2 pure-ftpd[2440155]: (?@85.217.149.11) [INFO] New connection from 85.217.149.11


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 85.217.149.11
country_id: 798549
description:
Jan 10 06:52:56 host2 pure-ftpd[2440271]: (?@85.217.149.11) [INFO] New connection from 85.217.149.11


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.158
country_id: 1269750
description:
2026-01-10 06:54:34 dovecot_login authenticator failed for H=([125.19.175.68]) [152.52.236.158]:45382: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.215.202
country_id: 1269750
description:
2026-01-10 06:55:00 dovecot_login authenticator failed for H=([125.20.249.53]) [128.185.215.202]:37584: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.48.229.117
country_id: 3469034
description:
2026-01-10 07:00:50 dovecot_login authenticator failed for H=ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:50442: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 96.44.159.120
country_id: 6251999
description:
Jan 10 07:00:58 host2 sshd[2447318]: Disconnected from invalid user testuser 96.44.159.120 port 56208 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 96.44.159.120
country_id: 6251999
description:
Jan 10 07:01:31 host2 sshd[2447714]: Disconnected from invalid user deployerer 96.44.159.120 port 40310 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.149.88
country_id: 294640
description:
2026-01-10 07:01:33 dovecot_login authenticator failed for H=([82.102.149.88]) [82.102.149.88]:38271: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.10
country_id: 1814991
description:
Jan 10 07:02:17 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=94.231.206.10, lip=66.85.158.92, session=<WR27nP5HyZde584K>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.63.25.203
country_id: 1643084
description:
Jan 10 07:02:22 host2 sshd[2448387]: Disconnected from invalid user teamspeak 103.63.25.203 port 56752 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.6
country_id: 1814991
description:
Jan 10 07:02:42 host2 dovecot[1180436]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=94.231.206.6, lip=66.85.158.92, session=<vfg/nv5Hyexe584G>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.2
country_id: 1814991
description:
Jan 10 07:02:46 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=94.231.206.2, lip=66.85.158.92, session=<sIV7nv5H66Re584C>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.11
country_id: 1814991
description:
Jan 10 07:02:27 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=94.231.206.11, lip=66.85.158.92, session=<jl5anf5Hjble584L>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 07:04:17 host2 sshd[2449903]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.153.123.178
country_id: 6252001
description:
Jan 10 07:04:53 host2 sshd[2450260]: Disconnected from invalid user frappe 43.153.123.178 port 49678 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 83.168.69.214
country_id: 798544
description:
Jan 10 07:05:09 host2 sshd[2450808]: Disconnected from invalid user server 83.168.69.214 port 57438 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.153.123.178
country_id: 6252001
description:
Jan 10 07:05:24 host2 sshd[2451045]: Disconnected from invalid user testuser 43.153.123.178 port 53994 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.63.25.203
country_id: 1643084
description:
Jan 10 07:06:39 host2 sshd[2451888]: Disconnected from invalid user server 103.63.25.203 port 47980 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.63.25.203
country_id: 1643084
description:
Jan 10 07:07:24 host2 sshd[2452609]: Disconnected from invalid user testuser 103.63.25.203 port 47900 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.63.25.203
country_id: 1643084
description:
Jan 10 07:08:55 host2 sshd[2453667]: Disconnected from invalid user user1 103.63.25.203 port 33576 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.63.25.203
country_id: 1643084
description:
Jan 10 07:09:38 host2 sshd[2454141]: Disconnected from invalid user ubuntu 103.63.25.203 port 38860 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.195
country_id: 6252001
description:
Jan 10 07:10:52 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.195, lip=66.85.158.92, session=<e+92u/5H4vWTuYTD>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan 10 07:15:21 host2 pure-ftpd[2458885]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.5
country_id: 798549
description:
Jan 10 07:17:22 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.5, lip=66.85.158.91, TLS: Connection closed, session=<hWy20v5HnrhV2ZUF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.11.67
country_id: 2077456
description:
2026-01-10 07:17:26 dovecot_login authenticator failed for H=([101.168.11.67]) [101.168.11.67]:59044: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.5
country_id: 798549
description:
Jan 10 07:17:31 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=85.217.149.5, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<Ai830/5HXIRV2ZUF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.21.104
country_id: 1269750
description:
2026-01-10 07:17:47 dovecot_login authenticator failed for H=(abts-north-static-104.21.176.122.airtelbroadband.in) [122.176.21.104]:53953: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.224.171.101
country_id: 6252001
description:
2026-01-10 07:19:35 dovecot_plain authenticator failed for H=c-73-224-171-101.hsd1.fl.comcast.net (maidon) [73.224.171.101]:47428: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.18.99.38
country_id: 1269750
description:
2026-01-10 07:21:22 dovecot_login authenticator failed for H=([125.18.99.38]) [125.18.99.38]:59886: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.194.94
country_id: 1733045
description:
2026-01-10 07:21:47 dovecot_login authenticator failed for H=([51.162.194.94]) [51.162.194.94]:48669: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.49.11
country_id: 3144096
description:
2026-01-10 07:21:57 dovecot_login authenticator failed for H=(cm-84.214.49.11.get.no) [84.214.49.11]:44370: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan 10 07:22:35 host2 pure-ftpd[2464179]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.83
country_id: 6252001
description:
Jan 10 07:22:51 host2 pure-ftpd[2464335]: (?@198.235.24.83) [INFO] New connection from 198.235.24.83


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.255.247.143
country_id: 1819730
description:
2026-01-10 07:24:06 dovecot_login authenticator failed for H=(72-255-247-143.static.imsbiz.com) [72.255.247.143]:36516: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.183
country_id: 3144096
description:
2026-01-10 07:23:51 dovecot_login authenticator failed for H=(cm-84.213.189.183.get.no) [84.213.189.183]:33872: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.39
country_id: 1643084
description:
2026-01-10 07:24:35 dovecot_login authenticator failed for H=([157.15.40.39]) [157.15.40.39]:49870: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.142
country_id: 1269750
description:
2026-01-10 07:26:57 dovecot_login authenticator failed for H=([182.95.215.71]) [182.95.230.142]:50002: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.213.242
country_id: 3469034
description:
2026-01-10 07:27:28 dovecot_login authenticator failed for H=([200.149.213.242]) [200.149.213.242]:39559: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.27
country_id: 6252001
description:
Jan 10 07:33:13 host2 pure-ftpd[2472758]: (?@147.185.132.27) [INFO] New connection from 147.185.132.27


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 07:34:16 host2 sshd[2473459]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.218
country_id: 337996
description:
2026-01-10 07:43:26 dovecot_login authenticator failed for H=([196.189.124.218]) [196.189.124.218]:34894: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.89
country_id: 1733045
description:
2026-01-10 07:43:45 dovecot_login authenticator failed for H=([49.125.201.89]) [49.125.201.89]:48716: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.209.30
country_id: 1269750
description:
2026-01-10 07:44:49 dovecot_login authenticator failed for H=([125.18.43.161]) [128.185.209.30]:54056: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.144
country_id: 6252001
description:
Jan 10 07:45:54 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.144, lip=66.85.158.91, TLS handshaking: Connection closed, session=<HkXBOP9Hh45BMQGQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.142
country_id: 6252001
description:
Jan 10 07:46:13 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.142, lip=66.85.158.91, TLS handshaking: Connection closed, session=<p9HZOf9HsDpBMQGO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.142
country_id: 6252001
description:
Jan 10 07:46:28 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.142, lip=66.85.158.91, TLS: Connection closed, session=<WrvFOv9HuO9BMQGO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 168.0.224.119
country_id: 3469034
description:
Jan 10 07:49:50 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=168.0.224.119, lip=66.85.158.91, TLS, session=<eCWtRf9HFu2oAOB3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.227.39.222
country_id: 798544
description:
Jan 10 07:50:07 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=46.227.39.222, lip=66.85.158.91, TLS, session=<I9fXRv9H3J0u4yfe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.86
country_id: 1269750
description:
2026-01-10 07:51:41 dovecot_login authenticator failed for H=([122.184.127.86]) [122.184.127.86]:36380: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.212
country_id: 6252001
description:
Jan 10 07:51:43 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.212, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<inWRTf9H1szG6xjU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.145.54
country_id: 1269750
description:
2026-01-10 07:51:56 dovecot_login authenticator failed for H=(nsg-corporate-54.145.185.122.airtel.in) [122.185.145.54]:52996: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.125
country_id: 1036973
description:
2026-01-10 07:59:33 dovecot_login authenticator failed for H=([196.28.226.125]) [196.28.226.125]:52034: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.224.215.23
country_id: 1269750
description:
2026-01-10 07:59:56 dovecot_login authenticator failed for H=([135.13.8.246]) [74.224.215.23]:10250: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.253.56.73
country_id: 6252001
description:
Jan 10 08:01:54 host2 sshd[2495377]: Disconnected from invalid user kaushalya 47.253.56.73 port 51262 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.253.56.73
country_id: 6252001
description:
Jan 10 08:05:06 host2 sshd[2497761]: Disconnected from invalid user kanchan 47.253.56.73 port 44204 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 47.253.56.73
country_id: 6252001
description:
Jan 10 08:05:38 host2 sshd[2498325]: Disconnected from invalid user amita 47.253.56.73 port 46302 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.253.56.73
country_id: 6252001
description:
Jan 10 08:06:43 host2 sshd[2499139]: Disconnected from invalid user lakhan 47.253.56.73 port 53826 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 24.165.211.107
country_id: 6252001
description:
Jan 10 08:07:38 host2 dovecot[1180436]: imap-login: Disconnected: Aborted login by logging out (auth failed, 1 attempts in 3 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=24.165.211.107, lip=66.85.158.91, TLS, session=</J9Dhv9H7rAYpdNr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.202
country_id: 6252001
description:
Jan 10 08:14:03 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=147.185.133.202, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<LJNonf9HqO6TuYXK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.202
country_id: 6252001
description:
Jan 10 08:14:14 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=147.185.133.202, lip=66.85.158.91, TLS: read(size=429) failed: Connection reset by peer, session=<iHURnv9HeumTuYXK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.23.199.107
country_id: 2921044
description:
Jan 10 08:15:03 host2 sshd[2505761]: Disconnected from invalid user postgres 193.23.199.107 port 39280 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.177.93.21
country_id: 1269750
description:
Jan 10 08:16:41 host2 sshd[2507348]: Disconnected from invalid user server 122.177.93.21 port 58234 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.23.199.107
country_id: 2921044
description:
Jan 10 08:17:11 host2 sshd[2507787]: Disconnected from invalid user postgres 193.23.199.107 port 53684 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 193.23.199.107
country_id: 2921044
description:
Jan 10 08:17:41 host2 sshd[2508131]: Disconnected from invalid user postgres 193.23.199.107 port 39284 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan 10 08:18:57 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<j0rPrv9HeMEz0msW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.36.82
country_id: 1210997
description:
2026-01-10 08:20:13 dovecot_login authenticator failed for H=([49.0.36.82]) [49.0.36.82]:59752: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.177.93.21
country_id: 1269750
description:
Jan 10 08:19:36 host2 sshd[2509425]: Disconnected from invalid user frappe 122.177.93.21 port 58160 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.114
country_id: 1269750
description:
2026-01-10 08:19:57 dovecot_login authenticator failed for H=([152.52.238.86]) [182.95.184.114]:45960: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.237.119.118
country_id: 6252001
description:
2026-01-10 08:19:58 dovecot_login authenticator failed for H=118-119-237-24.gci.net [24.237.119.118]:38423: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.138.74
country_id: 1269750
description:
2026-01-10 08:20:17 dovecot_login authenticator failed for H=([128.185.241.213]) [125.19.138.74]:50368: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 68.178.207.8
country_id: 6252001
description:
Jan 10 08:20:33 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=68.178.207.8, lip=66.85.158.91, session=<WrmGtP9HPKdEss8I>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.202
country_id: 6252001
description:
Jan 10 08:20:38 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.202, lip=66.85.158.91, TLS, session=<CMH1tP9HWvyTuYXK>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.177.93.21
country_id: 1269750
description:
Jan 10 08:20:50 host2 sshd[2510504]: Disconnected from invalid user test1 122.177.93.21 port 36560 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan 10 08:21:00 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@dataesite.lk>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<wNwetv9Hooui8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.68.110.207
country_id: 2921044
description:
Jan 10 08:21:14 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<noreply@anandaobauae.org>, method=PLAIN, rip=138.68.110.207, lip=66.85.158.91, session=<XIvktv9HpLOKRG7P>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.177.191.168
country_id: 357994
description:
2026-01-10 08:21:50 dovecot_plain authenticator failed for H=(bagoly) [154.177.191.168]:57894: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan 10 08:22:02 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<savIuf9H2tiOq2dI>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.207.55.167
country_id: 2921044
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 104.207.55.167 - topviewuser "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user topviewuser (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.3.34.35
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 45.3.34.35 - topview "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user topview (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.50.187.174
country_id: 6251999
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 209.50.187.174 - admin_venee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin_venee (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.3.36.190
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 45.3.36.190 - topviewl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2026-01-10 08:23:26 dovecot_login authenticator failed for H=([128.185.247.14]) [122.184.124.46]:56488: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.83.98
country_id: 1269750
description:
2026-01-10 08:24:20 dovecot_login authenticator failed for H=([182.79.83.98]) [182.79.83.98]:60986: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 130.185.85.106
country_id: 2264397
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 130.185.85.106 - env_eng@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan 10 08:24:28 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<5JmNwv9Ha5cz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.236.237.105
country_id: 3469034
description:
Jan 10 08:24:58 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@seyawin.com>, method=PLAIN, rip=186.236.237.105, lip=66.85.158.91, session=<erNRxP9H3sm67O1p>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.68.110.207
country_id: 2921044
description:
Jan 10 08:27:11 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@seyawin.com>, method=PLAIN, rip=138.68.110.207, lip=66.85.158.91, session=<4sNIzP9HDL2KRG7P>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.161.96.107
country_id: 6252001
description:
2026-01-10 08:26:20 dovecot_plain authenticator failed for H=c-73-161-96-107.hsd1.mi.comcast.net (crones) [73.161.96.107]:54496: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 10 08:27:29 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Ylduzf9H5qEDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan 10 08:27:41 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@venee.lk>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<IXUKzv9HgrQFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 105.174.17.50
country_id: 3351879
description:
Jan 10 08:28:55 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=105.174.17.50, lip=66.85.158.91, session=<HRJx0v9H4m1prhEy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan 10 08:29:18 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<CcPX0/9H37gz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan 10 08:29:20 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<HY/v0/9HtJYvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 97.74.84.186
country_id: 1880251
description:
Jan 10 08:29:39 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=97.74.84.186, lip=66.85.158.91, session=<CLAb1f9HFrxhSlS6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.27.203.227
country_id: 3439705
description:
Jan 10 08:31:11 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=179.27.203.227, lip=66.85.158.91, session=<pEGU2v9HfJezG8vj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 10 08:31:13 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<9FrU2v9HqIQDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan 10 08:32:19 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@rehanseo.online>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<1KuQ3v9HUthnmud6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.43
country_id: 6252001
description:
Jan 10 08:32:35 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.43, lip=66.85.158.92, TLS, session=<Pb+v3/9HxPTN0h8r>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 10 08:33:25 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<Qcep4v9HdIQDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.75.93
country_id: 1880251
description:
2026-01-10 08:35:04 dovecot_login authenticator failed for H=(93.75.245.49.unknown.m1.com.sg) [49.245.75.93]:36877: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2026-01-10 08:34:42 dovecot_login authenticator failed for H=([189.59.210.1]) [186.215.245.175]:49844: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Jan 10 08:35:49 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<L4kn6/9HdmCnYwhf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 10 08:36:10 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<i1+B7P9HiLsDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Jan 10 08:36:18 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@nsteeleng.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<rsja7P9HRKWPbtX3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.90.12.192
country_id: 6252001
description:
Jan 10 08:36:33 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.90.12.192, lip=66.85.158.92, TLS, session=<s83e7f9HiM0DWgzA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 10 08:36:47 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<slSy7v9HYsEDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 10 08:37:40 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: Connection closed, session=<9rfc8f9Hao0DhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 10 08:38:44 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<2jK49f9H2q0DhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.27.203.227
country_id: 3439705
description:
Jan 10 08:39:12 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 13 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=179.27.203.227, lip=66.85.158.91, session=<VYCW9v9HwJizG8vj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Jan 10 08:39:44 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@venee.lk>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<iY8i+f9HDMGLO0qU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 10 08:41:00 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<S//H/f9HIOwDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan 10 08:41:11 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<mzND/v9HXtcFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan 10 08:40:33 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<oUkV/P9HEJovWfaQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.33.69.253
country_id: 6252001
description:
Jan 10 08:41:45 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.33.69.253, lip=66.85.158.92, TLS handshaking: Connection closed, session=<wVJ8AABIcpstIUX9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 10 08:41:58 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: Connection closed, session=<1vE9AQBI7tkDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 10 08:43:03 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<lQseBQBIrssDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.57.236.167
country_id: 1819730
description:
Jan 10 08:43:16 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@sivagnanamfoundation.com>, method=PLAIN, rip=47.57.236.167, lip=66.85.158.91, session=<jmDIBQBIqI4vOeyn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 10 08:43:43 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<D2qIBwBIZrADhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.68.110.207
country_id: 2921044
description:
Jan 10 08:45:03 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@rehanseo.online>, method=PLAIN, rip=138.68.110.207, lip=66.85.158.91, session=<eTAlDABI4IeKRG7P>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.93
country_id: 99237
description:
2026-01-10 08:44:47 dovecot_login authenticator failed for H=([65.20.250.93]) [65.20.250.93]:33049: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.12
country_id: 1269750
description:
2026-01-10 08:45:05 dovecot_login authenticator failed for H=([122.187.226.12]) [122.187.226.12]:48075: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 10 08:45:21 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<bz9bDQBItJoDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan 10 08:45:25 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<tiJ6DQBIeLyygBt7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.54
country_id: 3144096
description:
2026-01-10 08:45:27 dovecot_login authenticator failed for H=([62.97.170.54]) [62.97.170.54]:47310: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.226.154
country_id: 294640
description:
2026-01-10 08:45:31 dovecot_login authenticator failed for H=([147.235.226.154]) [147.235.226.154]:41000: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan 10 08:45:52 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@kiriaswanu.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<QpMSDwBIhs+i8KbF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.49
country_id: 290557
description:
Jan 10 08:45:56 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=185.93.89.49, lip=66.85.158.91, session=<e4hKDwBIgIG5XVkx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.154
country_id: 1269750
description:
2026-01-10 08:45:17 dovecot_login authenticator failed for H=([128.185.223.87]) [182.95.178.154]:59044: 535 Incorrect authentication data (set_id=v-deploy.com@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.51
country_id: 3144096
description:
2026-01-10 08:45:40 dovecot_login authenticator failed for H=(51-170-97-62.cust.smartcall.no) [62.97.170.51]:34366: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Jan 10 08:45:52 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@sivagnanamfoundation.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<QnURDwBI9um8putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan 10 08:46:14 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<K0pQEABIgs1nmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.50.167.81
country_id: 1269750
description:
2026-01-10 08:46:41 dovecot_login authenticator failed for H=([36.50.167.81]) [36.50.167.81]:34732: 535 Incorrect authentication data (set_id=v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Jan 10 08:48:21 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@dataesite.lk>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<BNLoFwBIYp8vT1jH>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 08:49:42 host2 sshd[2532974]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan 10 08:49:29 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<Je/6GwBICOhnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan 10 08:51:02 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<IXqNIQBIlBcvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan 10 08:51:32 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<2GxVIwBILtKygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Jan 10 08:52:11 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<iSGyJQBIVosI3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.247.20.83
country_id: 1643084
description:
Jan 10 08:53:45 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<noreply@lankaherbalsolutions.com>, method=PLAIN, rip=103.247.20.83, lip=66.85.158.91, session=<9iEyKwBIBONn9xRT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.142
country_id: 1269750
description:
2026-01-10 08:56:05 dovecot_login authenticator failed for H=([128.185.227.142]) [128.185.227.142]:33780: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2026-01-10 08:56:11 dovecot_login authenticator failed for H=([59.145.84.25]) [103.251.31.154]:58492: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.127.90.34
country_id: 2440476
description:
2026-01-10 08:55:34 dovecot_login authenticator failed for H=([154.127.90.34]) [154.127.90.34]:41372: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.85.43.162
country_id: 3686110
description:
2026-01-10 08:55:46 dovecot_login authenticator failed for H=([190.85.43.162]) [190.85.43.162]:44676: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.175.75
country_id: 99237
description:
2026-01-10 08:56:27 dovecot_login authenticator failed for H=([65.20.175.75]) [65.20.175.75]:45849: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.163.16.165
country_id: 6252001
description:
Jan 10 08:56:40 host2 dovecot[1180436]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=20.163.16.165, lip=66.85.158.92, session=<4MTYNQBImosUoxCl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.101.146
country_id: 1269750
description:
2026-01-10 08:56:49 dovecot_login authenticator failed for H=(aes-static-217.70.22.125.airtel.in) [27.123.101.146]:39230: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Jan 10 08:57:18 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<oJ3+NwBIbpEI3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.236.237.105
country_id: 3469034
description:
Jan 10 08:57:24 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=186.236.237.105, lip=66.85.158.91, session=<P1lYOABIeOO67O1p>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.28
country_id: 290557
description:
Jan 10 08:57:59 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=185.93.89.28, lip=66.85.158.91, session=<afhtOgBIKp25XVkc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Jan 10 09:01:10 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<pqnMRQBIQo2PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan 10 09:00:18 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<RJ2vQgBIiLEvWfaQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.163.37.98
country_id: 6252001
description:
Jan 10 09:01:59 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.163.37.98, lip=66.85.158.91, session=<2gDWSABIWIIUoyVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan 10 09:02:14 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<ZFmcSQBIBo0yBvlc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-10 09:03:46 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (bousids) [87.103.126.54]:4339: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.110
country_id: 3017382
description:
Jan 10 09:03:15 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=91.196.152.110, lip=66.85.158.91, session=<zoReTQBIc+RbxJhu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.232.170.229
country_id: 6252001
description:
Jan 10 09:03:16 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low (no auth attempts in 6 secs): user=<>, rip=172.232.170.229, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<dUJnTQBIvPCs6Krl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.18
country_id: 3017382
description:
Jan 10 09:03:41 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.18, lip=66.85.158.91, session=<ZX3lTgBI38hbxJgS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.232.170.229
country_id: 6252001
description:
Jan 10 09:04:32 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090FC:SSL routines:tls_early_post_process_client_hello:unknown protocol (no auth attempts in 0 secs): user=<>, rip=172.232.170.229, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090FC:SSL routines:tls_early_post_process_client_hello:unknown protocol, session=<gSj2UQBINmas6Krl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan 10 09:04:51 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@kiriaswanu.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=</bvxUgBIoiRniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan 10 09:04:54 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<XBYqUwBIqLAUOAHJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.232.170.229
country_id: 6252001
description:
Jan 10 09:05:13 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (tried to use unsupported auth mechanism): user=<>, method=NTLM, rip=172.232.170.229, lip=66.85.158.91, TLS, session=<r1VmVABIrnKs6Krl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.236.237.105
country_id: 3469034
description:
Jan 10 09:07:09 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@rehanseo.online>, method=PLAIN, rip=186.236.237.105, lip=66.85.158.91, session=<V7cyWwBIAJy67O1p>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan 10 09:07:22 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@venee.lk>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<oS3zWwBINJaygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan 10 09:10:20 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<C6yOZgBIeLWOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan 10 09:11:20 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<6gkqagBIuKVCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Jan 10 09:12:20 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<vM2+bQBI8pWLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan 10 09:12:27 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<ytogbgBIHMkFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.59.132.141
country_id: 1269750
description:
Jan 10 09:15:39 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=103.59.132.141, lip=66.85.158.91, TLS, session=<tXKmeABI39BnO4SN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.34.170
country_id: 953987
description:
Jan 10 09:16:01 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=102.64.34.170, lip=66.85.158.91, TLS, session=<GCXWeQBIQOxmQCKq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Jan 10 09:16:58 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@essenceceylontea.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<l5NMfgBIvpGLO0qU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.164.137
country_id: 99237
description:
2026-01-10 09:17:30 dovecot_plain authenticator failed for H=(nomaly) [65.20.164.137]:45503: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Jan 10 09:17:35 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@kiriaswanu.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<0ZN8gABIGn8vWbHj>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 09:19:47 host2 sshd[2559865]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan 10 09:19:17 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@venee.lk>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<DCWLhgBIf7Qz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.68.110.207
country_id: 2921044
description:
Jan 10 09:20:17 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=138.68.110.207, lip=66.85.158.91, session=<ARIsigBI8ouKRG7P>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 68.178.207.8
country_id: 6252001
description:
Jan 10 09:21:17 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@dataesite.lk>, method=PLAIN, rip=68.178.207.8, lip=66.85.158.91, session=<SPS8jQBIoMFEss8I>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2026-01-10 09:22:23 dovecot_plain authenticator failed for H=c-98-227-25-115.hsd1.il.comcast.net (oventic) [98.227.25.115]:48508: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.225.99.151
country_id: 2921044
description:
Jan 10 09:23:25 host2 sshd[2562784]: Disconnected from invalid user test1 64.225.99.151 port 53522 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.157.219.158
country_id: 6252001
description:
2026-01-10 09:23:27 dovecot_plain authenticator failed for H=c-76-157-219-158.hsd1.il.comcast.net (prokma) [76.157.219.158]:39890: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan 10 09:24:01 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<re2FlwBIRN6i8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan 10 09:24:16 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<MchmmABIDLCOq2dI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.225.99.151
country_id: 2921044
description:
Jan 10 09:24:21 host2 sshd[2563658]: Disconnected from invalid user frappe 64.225.99.151 port 60184 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan 10 09:24:59 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<wc38mgBIqosz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.49
country_id: 290557
description:
Jan 10 09:25:51 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=185.93.89.49, lip=66.85.158.91, session=<t6wXngBItoW5XVkx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 77.65.142.78
country_id: 798544
description:
Jan 10 09:27:11 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@jrdc.lk>, method=PLAIN, rip=77.65.142.78, lip=66.85.158.91, TLS, session=<qmQBogBI5AtNQY5O>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.68.110.207
country_id: 2921044
description:
Jan 10 09:26:39 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@seyawin.com>, method=PLAIN, rip=138.68.110.207, lip=66.85.158.91, session=<cmPioABI0r2KRG7P>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.254
country_id: 3865483
description:
Jan 10 09:27:15 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@jrdc.lk>, method=PLAIN, rip=179.0.252.254, lip=66.85.158.91, TLS, session=<Nj4WogBI2c+zAPz+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.103
country_id: 3865483
description:
Jan 10 09:27:22 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info@jrdc.lk>, method=PLAIN, rip=179.0.252.103, lip=66.85.158.91, TLS, session=<tT8+ogBIBruzAPxn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.226.115.168
country_id: 3057568
description:
Jan 10 09:27:29 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=91.226.115.168, lip=66.85.158.91, TLS, session=<dK8HowBIbp9b4nOo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.248.32
country_id: 798544
description:
Jan 10 09:27:34 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=109.125.248.32, lip=66.85.158.91, TLS, session=<PzVUowBIxpJtffgg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.227.32.167
country_id: 3865483
description:
Jan 10 09:27:54 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 29 secs): user=<info>, method=PLAIN, rip=45.227.32.167, lip=66.85.158.91, TLS, session=<HwrIowBI1akt4yCn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.183
country_id: 3865483
description:
Jan 10 09:27:16 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@jrdc.lk>, method=PLAIN, rip=179.0.251.183, lip=66.85.158.91, TLS, session=<FKQVogBIs5mzAPu3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.55.16
country_id: 3144096
description:
2026-01-10 09:27:16 dovecot_login authenticator failed for H=([178.232.55.16]) [178.232.55.16]:57248: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.209
country_id: 3865483
description:
Jan 10 09:27:16 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@jrdc.lk>, method=PLAIN, rip=179.0.252.209, lip=66.85.158.91, TLS, session=<Ez4XogBIy6OzAPzR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 154.127.34.4
country_id: 2395170
description:
Jan 10 09:27:41 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=154.127.34.4, lip=66.85.158.91, TLS, session=<5Fe2owBIK7uafyIE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.133.57
country_id: 690791
description:
Jan 10 09:27:43 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=37.221.133.57, lip=66.85.158.91, TLS, session=<MF7kowBItrsl3YU5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.47.37.18
country_id: 6252001
description:
2026-01-10 09:29:34 dovecot_login authenticator failed for H=([50.47.37.18]) [50.47.37.18]:55255: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.249
country_id: 1168579
description:
2026-01-10 09:29:49 dovecot_login authenticator failed for H=(249.92.zcomnetworks.com.pk) [103.148.92.249]:40979: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan 10 09:30:02 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<6bQOrQBIba4z0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.236.237.105
country_id: 3469034
description:
Jan 10 09:30:45 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=186.236.237.105, lip=66.85.158.91, session=<EnWRrwBI1tC67O1p>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan 10 09:32:17 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<noreply@venee.lk>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<yd8MtQBIEoYFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan 10 09:32:24 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<VHZ9tQBIcsEvWfaQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.97.155.25
country_id: 6252001
description:
2026-01-10 09:32:48 dovecot_plain authenticator failed for H=c-76-97-155-25.hsd1.ga.comcast.net (supethasip) [76.97.155.25]:40824: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2026-01-10 09:33:58 dovecot_login authenticator failed for H=([193.46.192.20]) [193.46.192.20]:43074: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.126.208.241
country_id: 1512440
description:
Jan 10 09:33:29 host2 sshd[2571579]: Disconnected from invalid user test 89.126.208.241 port 44910 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 105.174.17.50
country_id: 3351879
description:
Jan 10 09:33:41 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=105.174.17.50, lip=66.85.158.91, session=<NWkQugBIwflprhEy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.248.8.33
country_id: 192950
description:
Jan 10 09:34:23 host2 sshd[2572383]: Disconnected from invalid user steam 197.248.8.33 port 38424 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.45
country_id: 290557
description:
Jan 10 09:34:36 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=185.93.89.45, lip=66.85.158.91, session=<TP9jvQBInIa5XVkt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan 10 09:35:04 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@rehanseo.online>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<l9wCvwBIYppnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 97.74.84.186
country_id: 1880251
description:
Jan 10 09:35:53 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=97.74.84.186, lip=66.85.158.91, session=<9cLrwQBIKLhhSlS6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 89.126.208.241
country_id: 1512440
description:
Jan 10 09:35:55 host2 sshd[2573527]: Disconnected from invalid user steam 89.126.208.241 port 56452 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.126.208.241
country_id: 1512440
description:
Jan 10 09:35:19 host2 sshd[2573182]: Disconnected from invalid user frappe 89.126.208.241 port 43208 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.93.89.49
country_id: 290557
description:
Jan 10 09:35:28 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=185.93.89.49, lip=66.85.158.91, session=<v2t9wABIdty5XVkx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.27.203.227
country_id: 3439705
description:
Jan 10 09:35:45 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@nsteeleng.com>, method=PLAIN, rip=179.27.203.227, lip=66.85.158.91, session=<v6+AwQBI8JOzG8vj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Jan 10 09:37:00 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<Nyb0xQBIrHunYwhf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 10 09:37:04 host2 dovecot[1180436]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<Ss9RxgBIfKgDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Jan 10 09:37:05 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<5D5CxgBIvpOPbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.126.208.241
country_id: 1512440
description:
Jan 10 09:36:28 host2 sshd[2573880]: Disconnected from invalid user testuser 89.126.208.241 port 41464 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.248.8.33
country_id: 192950
description:
Jan 10 09:36:33 host2 sshd[2573914]: Disconnected from invalid user steam 197.248.8.33 port 44600 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan 10 09:37:35 host2 pure-ftpd[2574712]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.248.8.33
country_id: 192950
description:
Jan 10 09:37:51 host2 sshd[2574923]: Disconnected from invalid user user2 197.248.8.33 port 43110 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 10 09:39:05 host2 dovecot[1180436]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<9JiLzQBInNQDjyE/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.226.118
country_id: 1880251
description:
Jan 10 09:39:29 host2 sshd[2576320]: Disconnected from invalid user steam 45.78.226.118 port 56416 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 10 09:40:02 host2 dovecot[1180436]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<ehTq0ABIdpgDjyE/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.226.118
country_id: 1880251
description:
Jan 10 09:40:19 host2 sshd[2577166]: Disconnected from invalid user testuser 45.78.226.118 port 58780 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.226.118
country_id: 1880251
description:
Jan 10 09:41:09 host2 sshd[2577943]: Disconnected from invalid user server 45.78.226.118 port 58978 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 10 09:42:05 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<Z01A2ABI0K4DjyE/>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 10 09:42:15 host2 dovecot[1180436]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<urLR2ABIkt0DjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.202
country_id: 1269750
description:
2026-01-10 09:43:03 dovecot_login authenticator failed for H=([128.185.247.100]) [182.95.222.202]:33640: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 10 09:43:10 host2 dovecot[1180436]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<lCgY3ABI1LADjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Jan 10 09:43:28 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@venee.lk>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<uMoO3QBIBMeLO0qU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.94.39.65
country_id: 1269750
description:
2026-01-10 09:43:34 dovecot_login authenticator failed for H=([59.94.39.65]) [59.94.39.65]:45522: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.27.203.227
country_id: 3439705
description:
Jan 10 09:43:41 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@ceylondigest.com>, method=PLAIN, rip=179.27.203.227, lip=66.85.158.91, session=<Kz7S3QBIcoqzG8vj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan 10 09:43:45 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@rehanseo.online>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<IxMX3gBIjsYvWfaQ>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan 10 09:44:59 host2 pure-ftpd[2581235]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.68.110.207
country_id: 2921044
description:
Jan 10 09:45:18 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=138.68.110.207, lip=66.85.158.91, session=<mK6h4wBIyrOKRG7P>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.103.245.7
country_id: 1819730
description:
Jan 10 09:45:38 host2 sshd[2581866]: Disconnected from invalid user test 103.103.245.7 port 56530 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan 10 09:46:12 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@essenceceylontea.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<BSnW5gBI3MAFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan 10 09:48:02 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<+jls7QBIWrmi8KbF>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.103.245.7
country_id: 1819730
description:
Jan 10 09:48:14 host2 sshd[2584038]: Disconnected from invalid user admin 103.103.245.7 port 56354 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 96.92.63.243
country_id: 6252001
description:
Jan 10 09:48:16 host2 sshd[2584277]: Disconnected from invalid user pratap 96.92.63.243 port 48698 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.57.236.167
country_id: 1819730
description:
Jan 10 09:48:59 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@sivagnanamfoundation.com>, method=PLAIN, rip=47.57.236.167, lip=66.85.158.91, session=<exfI8ABI0pcvOeyn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan 10 09:49:13 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<hsGh8QBIJodnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.118.142.216
country_id: 3686110
description:
Jan 10 09:49:27 host2 sshd[2585291]: Disconnected from invalid user user2 186.118.142.216 port 47982 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan 10 09:49:51 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<aK/g8wBI1IKygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Jan 10 09:50:36 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<Puac9gBIFN+8putr>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.118.142.216
country_id: 3686110
description:
Jan 10 09:50:51 host2 sshd[2586916]: Disconnected from invalid user teamspeak 186.118.142.216 port 33328 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.118.142.216
country_id: 3686110
description:
Jan 10 09:51:30 host2 sshd[2587591]: Disconnected from invalid user test 186.118.142.216 port 55622 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan 10 09:52:32 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<4ld5/QBIoMRnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.213.52
country_id: 1819730
description:
Jan 10 09:52:53 host2 sshd[2588750]: Disconnected from invalid user deployerer 123.58.213.52 port 60344 [preauth]


