# incident

plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.231
country_id: 6252001
description:
Jan  1 01:37:46 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.231, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<V8mZB0VHbNjN0h/n>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.14
country_id: 6252001
description:
Jan  1 01:38:08 host2 dovecot[1911092]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=207.90.244.14, lip=66.85.158.92, session=<pWHyCEVHls7PWvQO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 01:42:09 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<VLMuF0VHLOQjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  1 01:43:55 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<fDmGHUVHBoxnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  1 01:44:32 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<Pbe1H0VHlqmeRdGr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2026-01-01 01:44:18 dovecot_plain authenticator failed for H=c-73-213-237-28.hsd1.va.comcast.net (proman) [73.213.237.28]:48388: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  1 01:44:23 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<7Q4xH0VHPsh100Db>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.162
country_id: 6252001
description:
Jan  1 01:45:31 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.162, lip=66.85.158.91, TLS handshaking: Connection closed, session=<J8pVI0VHABVBMQGi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.63
country_id: 6252001
description:
Jan  1 01:47:57 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.63, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<+DAMLEVHqd+TuYQ/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.48.221.214
country_id: 1269750
description:
2026-01-01 01:49:03 dovecot_plain authenticator failed for H=(CHXEI8NX18) [157.48.221.214]:55657: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.48.221.214
country_id: 1269750
description:
2026-01-01 01:49:10 dovecot_login authenticator failed for H=(CHXEI8NX18) [157.48.221.214]:55657: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  1 01:49:38 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<gCPyMUVHiHui8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.11.179.18
country_id: 953987
description:
2026-01-01 01:53:27 dovecot_plain authenticator failed for H=(5D07V5) [196.11.179.18]:60613: 535 Incorrect authentication data (set_id=lasithar@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 01:53:27 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<p5mUP0VHkpQv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  1 02:01:01 host2 sshd[2016588]: Disconnected from invalid user admin 2.57.121.112 port 48065 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.49.209.255
country_id: 1269750
description:
2026-01-01 02:02:04 dovecot_plain authenticator failed for H=(E7G74M1Q) [157.49.209.255]:50397: 535 Incorrect authentication data (set_id=lasithar@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.49.209.255
country_id: 1269750
description:
2026-01-01 02:02:10 dovecot_login authenticator failed for H=(E7G74M1Q) [157.49.209.255]:50397: 535 Incorrect authentication data (set_id=lasithar@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  1 02:04:10 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<pLPnZUVHeqovWBNS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.133.156.119
country_id: 294640
description:
2026-01-01 02:05:46 dovecot_plain authenticator failed for H=(comation) [195.133.156.119]:58509: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 02:05:11 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<C5eUaUVHhMozTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  1 02:07:19 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<P/IncUVHuM1CdMzo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.126
country_id: 6252001
description:
Jan  1 02:07:34 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.126, lip=66.85.158.92, TLS: Connection closed, session=<qu83ckVHpAZChJl+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.41
country_id: 6252001
description:
Jan  1 02:08:24 host2 pure-ftpd[2025984]: (?@205.210.31.41) [INFO] New connection from 205.210.31.41


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 02:10:14 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<mteWe0VHcLszTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 02:11:59 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<s8jigUVH8oKeRdY+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.195
country_id: 6252001
description:
Jan  1 02:12:17 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.195, lip=66.85.158.91, TLS, session=<gFoUg0VHLuPN0h/D>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  1 02:14:16 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<QT8EikVHXNoFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 02:17:47 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<iC6elkVHiLwv/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.67.22
country_id: 1269750
description:
2026-01-01 02:20:20 dovecot_login authenticator failed for H=(nsg-corporate-246.50.185.122.airtel.in) [182.78.67.22]:40072: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  1 02:20:23 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<dvjvn0VHWtBn9M4G>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.245.107.216
country_id: 6252001
description:
Jan  1 02:20:33 host2 pure-ftpd[2041401]: (?@104.245.107.216) [INFO] New connection from 104.245.107.216


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.223.240.239
country_id: 49518
description:
2026-01-01 02:21:00 dovecot_login authenticator failed for H=([196.223.240.239]) [196.223.240.239]:60264: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  1 02:21:22 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<nPhxo0VHXrCi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.47.85
country_id: 953987
description:
Jan  1 02:22:13 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=102.64.47.85, lip=66.85.158.91, TLS, session=<Cw1lpUVHM8lmQC9V>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.196.75
country_id: 3469034
description:
Jan  1 02:22:33 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=179.189.196.75, lip=66.85.158.91, TLS, session=<OD20pkVHEN2zvcRL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  1 02:25:03 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<oJeXsEVHuxlniu0S>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  1 02:24:32 host2 pure-ftpd[2046551]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 102.204.223.75
country_id: 2328926
description:
Jan  1 02:26:29 host2 pure-ftpd[2049407]: (?@102.204.223.75) [INFO] New connection from 102.204.223.75


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 02:26:38 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<E489tkVHEJIjupN+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 102.204.223.49
country_id: 2328926
description:
Jan  1 02:27:45 host2 pure-ftpd[2050871]: (?@102.204.223.49) [INFO] New connection from 102.204.223.49


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Jan  1 02:28:04 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<Ar1qu0VHAOCYNcU1>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  1 02:29:23 host2 sshd[2052804]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 02:30:13 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<ylMbw0VHuqWeRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.78.253.49
country_id: 1210997
description:
2026-01-01 02:32:25 dovecot_plain authenticator failed for H=(BLQ8UWWR76TP98) [103.78.253.49]:8760: 535 Incorrect authentication data (set_id=sanjanap@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.47.28
country_id: 6252001
description:
Jan  1 02:36:35 host2 sshd[2061353]: Disconnected from invalid user userm 128.1.47.28 port 51550 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 128.1.47.28
country_id: 6252001
description:
Jan  1 02:37:37 host2 sshd[2062489]: Disconnected from invalid user demo 128.1.47.28 port 46364 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.47.28
country_id: 6252001
description:
Jan  1 02:38:34 host2 sshd[2063715]: Disconnected from invalid user icp 128.1.47.28 port 41158 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  1 02:38:44 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<GeOF4UVHD1F100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.97.155.25
country_id: 6252001
description:
2026-01-01 02:40:46 dovecot_plain authenticator failed for H=c-76-97-155-25.hsd1.ga.comcast.net (ingin) [76.97.155.25]:40260: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.189.155.89
country_id: 337996
description:
Jan  1 02:40:53 host2 sshd[2066470]: Disconnected from invalid user alex 196.189.155.89 port 38860 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.139.192.90
country_id: 1643084
description:
Jan  1 02:41:15 host2 sshd[2067060]: Disconnected from invalid user git 103.139.192.90 port 43492 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.178.224.92
country_id: 1880251
description:
Jan  1 02:41:30 host2 pure-ftpd[2067311]: (?@158.178.224.92) [INFO] New connection from 158.178.224.92


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 158.178.224.92
country_id: 1880251
description:
Jan  1 02:41:35 host2 pure-ftpd[2067422]: (?@158.178.224.92) [INFO] New connection from 158.178.224.92


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 02:42:23 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<8oSS7kVHDIEjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  1 02:42:53 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<ZvpS8EVHuN1nmud6>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.178.224.92
country_id: 1880251
description:
Jan  1 02:42:08 host2 pure-ftpd[2068172]: (?@158.178.224.92) [INFO] New connection from 158.178.224.92


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 158.178.224.92
country_id: 1880251
description:
Jan  1 02:42:12 host2 pure-ftpd[2068259]: (?@158.178.224.92) [INFO] New connection from 158.178.224.92


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.238.122
country_id: 2542007
description:
2026-01-01 02:43:56 dovecot_plain authenticator failed for H=(phylly) [154.146.238.122]:36418: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.3
country_id: 798549
description:
Jan  1 02:44:00 host2 dovecot[1911092]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=85.217.140.3, lip=66.85.158.92, TLS, session=<JamE9EVHIuBV2YwD>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.123.53.88
country_id: 1269750
description:
Jan  1 02:43:12 host2 sshd[2069543]: Disconnected from invalid user ubuntu 103.123.53.88 port 35476 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.189.155.89
country_id: 337996
description:
Jan  1 02:43:17 host2 sshd[2069647]: Disconnected from invalid user yangfan 196.189.155.89 port 58572 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.155.253.241
country_id: 953987
description:
Jan  1 02:43:49 host2 sshd[2070253]: Disconnected from invalid user pivpn 156.155.253.241 port 59514 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.3
country_id: 798549
description:
Jan  1 02:44:08 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=85.217.140.3, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<Qpr39EVHnOBV2YwD>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.139.192.90
country_id: 1643084
description:
Jan  1 02:44:50 host2 sshd[2071664]: Disconnected from invalid user icp 103.139.192.90 port 41410 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.189.155.89
country_id: 337996
description:
Jan  1 02:45:33 host2 sshd[2072716]: Disconnected from invalid user morteza 196.189.155.89 port 48982 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.123.53.88
country_id: 1269750
description:
Jan  1 02:46:08 host2 sshd[2073437]: Disconnected from invalid user android 103.123.53.88 port 59740 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.155.253.241
country_id: 953987
description:
Jan  1 02:46:26 host2 sshd[2073860]: Disconnected from invalid user maintain 156.155.253.241 port 56580 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.155.253.241
country_id: 953987
description:
Jan  1 02:47:09 host2 sshd[2074611]: Disconnected from invalid user username 156.155.253.241 port 35816 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.123.53.88
country_id: 1269750
description:
Jan  1 02:47:15 host2 sshd[2074735]: Disconnected from invalid user gateway 103.123.53.88 port 52248 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  1 02:48:03 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<jk3eAkZHJOai8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  1 02:48:39 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<9WL7BEZHsBho7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  1 02:49:09 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<4J7LBkZHYooyBsPO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.139.192.90
country_id: 1643084
description:
Jan  1 02:48:17 host2 sshd[2076416]: Disconnected from invalid user userm 103.139.192.90 port 41864 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2026-01-01 02:51:11 dovecot_plain authenticator failed for H=c-73-195-211-98.hsd1.nj.comcast.net (coldelitty) [73.195.211.98]:44460: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 23.95.198.243
country_id: 6252001
description:
Jan  1 02:52:15 host2 sshd[2081015]: Disconnected from invalid user icp 23.95.198.243 port 40940 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.230.228.16
country_id: 6252001
description:
2026-01-01 02:55:03 dovecot_plain authenticator failed for H=c-71-230-228-16.hsd1.de.comcast.net (duase) [71.230.228.16]:49124: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.65.140.218
country_id: 3017382
description:
Jan  1 02:55:22 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<marketing@lezzarotech.com>, method=PLAIN, rip=82.65.140.218, lip=66.85.158.91, TLS, session=<6cIVHEZHuoVSQYza>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.154.202.101
country_id: 6252001
description:
Jan  1 02:56:05 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<marketing>, method=PLAIN, rip=165.154.202.101, lip=66.85.158.91, TLS, session=<Efy+HkZH3rGlmspl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.95.198.243
country_id: 6252001
description:
Jan  1 02:56:44 host2 sshd[2087092]: Disconnected from invalid user gateway 23.95.198.243 port 41154 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.95.198.243
country_id: 6252001
description:
Jan  1 02:59:36 host2 sshd[2090409]: Disconnected from invalid user username 23.95.198.243 port 41300 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  1 03:02:17 host2 sshd[2094526]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 03:06:04 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<7llPQ0ZHXJYv/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.230.228.16
country_id: 6252001
description:
2026-01-01 03:07:20 dovecot_plain authenticator failed for H=c-71-230-228-16.hsd1.de.comcast.net (bonave) [71.230.228.16]:53950: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 158.69.214.62
country_id: 6251999
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[158.69.214.62] [Remote Port]=[59658] [Authentication Database]=[mail] [Username]=[info@melanifinefood.com] (12/10 failures) (blocked until [Thu Jan  1 21:40:15 2026 UTC/Fri Jan  2 03:10:15 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 03:10:17 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<rbNaUkZHCumeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  1 03:12:57 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<KjfhW0ZHgLyeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  1 03:16:12 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<nQOKZ0ZHQrpCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  1 03:16:29 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<cIyPaEZHYsui8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  1 03:16:37 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<d6IBaUZHBIVn9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.137.235
country_id: 6252001
description:
Jan  1 03:17:26 host2 sshd[2113882]: Disconnected from invalid user composeruser 107.174.137.235 port 57428 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.225.122
country_id: 2921044
description:
[2026-01-01 03:17:28 +0530] info [cpaneld] 104.28.225.122 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  1 03:17:55 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<gXWmbUZHWEdniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.43.146
country_id: 6252001
description:
Jan  1 03:18:04 host2 sshd[2114780]: Disconnected from invalid user administrator 209.141.43.146 port 33164 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 03:18:34 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<xa8BcEZHVqczTcpt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.137.235
country_id: 6252001
description:
Jan  1 03:19:04 host2 sshd[2116011]: Disconnected from invalid user work 107.174.137.235 port 35508 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.174.137.235
country_id: 6252001
description:
Jan  1 03:20:06 host2 sshd[2117442]: Disconnected from invalid user publicftp 107.174.137.235 port 47862 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.43.146
country_id: 6252001
description:
Jan  1 03:19:51 host2 sshd[2116934]: Disconnected from invalid user ftpuser 209.141.43.146 port 56970 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.137.235
country_id: 6252001
description:
Jan  1 03:21:10 host2 sshd[2118645]: Disconnected from invalid user odoo13 107.174.137.235 port 38264 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.43.146
country_id: 6252001
description:
Jan  1 03:23:12 host2 sshd[2120978]: Disconnected from invalid user git 209.141.43.146 port 48108 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 03:23:37 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<VvoQgkZHHIwzTcpt>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  1 03:27:03 host2 pure-ftpd[2125732]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  1 03:26:12 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<UmtKi0ZHurUvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 03:26:51 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<dl+ijUZHusQjupN+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.141.43.146
country_id: 6252001
description:
Jan  1 03:27:21 host2 sshd[2126044]: Disconnected from invalid user oracle 209.141.43.146 port 51094 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 03:28:18 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<HLjPkkZHULeeRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.250
country_id: 1168579
description:
2026-01-01 03:28:42 dovecot_login authenticator failed for H=(250.92.zcomnetworks.com.pk) [103.148.92.250]:57766: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.254.91
country_id: 3865483
description:
2026-01-01 03:29:10 dovecot_login authenticator failed for H=(static.90.254.104.190.cps.com.ar) [190.104.254.91]:48701: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.178.27
country_id: 298795
description:
2026-01-01 03:29:28 dovecot_login authenticator failed for H=([188.59.178.27]) [188.59.178.27]:55355: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.223.116.246
country_id: 895949
description:
2026-01-01 03:30:07 dovecot_plain authenticator failed for H=(96H3V7R8Q2) [41.223.116.246]:24144: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 03:30:19 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<Qf8FmkZHrscv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  1 03:30:47 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<orejm0ZH9MWeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  1 03:32:48 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<QKHdokZHXZ5100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.202.197.108
country_id: 6252001
description:
2026-01-01 03:32:54 dovecot_plain authenticator failed for H=(unwriline) [50.202.197.108]:51565: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.223.116.246
country_id: 895949
description:
2026-01-01 03:32:56 dovecot_login authenticator failed for H=(96H3V7R8Q2) [41.223.116.246]:24144: 535 Incorrect authentication data


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  1 03:36:15 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<postfix@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<+Jcnr0ZHUu0FhXlo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-01 03:38:51 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:54748: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.83.71.110
country_id: 3017382
description:
Jan  1 03:39:49 host2 sshd[2140998]: Disconnected from invalid user donna 51.83.71.110 port 39250 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.23.189.160
country_id: 6252001
description:
Jan  1 03:40:37 host2 sshd[2142228]: Disconnected from invalid user sammy 64.23.189.160 port 39488 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  1 03:41:47 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<5Bb2wkZHmLJnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 03:42:18 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<NqzixEZH/uwjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.121.0.2
country_id: 1220409
description:
Jan  1 03:44:56 host2 sshd[2147979]: Disconnected from invalid user miladmim 185.121.0.2 port 36232 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.23.189.160
country_id: 6252001
description:
Jan  1 03:44:34 host2 sshd[2147323]: Disconnected from invalid user ansible 64.23.189.160 port 36320 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.183
country_id: 6252001
description:
Jan  1 03:46:00 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.183, lip=66.85.158.91, TLS, session=<YhYy0kZHqvPG6xi3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.83.71.110
country_id: 3017382
description:
Jan  1 03:45:15 host2 sshd[2148529]: Disconnected from invalid user admin 51.83.71.110 port 59040 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.23.189.160
country_id: 6252001
description:
Jan  1 03:46:16 host2 sshd[2150170]: Disconnected from invalid user yuri 64.23.189.160 port 55830 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  1 03:46:13 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<laLk0kZHWqai8Jp9>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.121.0.2
country_id: 1220409
description:
Jan  1 03:46:12 host2 sshd[2150004]: Disconnected from invalid user radarr 185.121.0.2 port 34014 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.78.149.220
country_id: 1605651
description:
Jan  1 03:47:32 host2 sshd[2152123]: Disconnected from invalid user bernardo 110.78.149.220 port 58380 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.121.0.2
country_id: 1220409
description:
Jan  1 03:47:59 host2 sshd[2152720]: Disconnected from invalid user cts 185.121.0.2 port 56464 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.121.0.2
country_id: 1220409
description:
Jan  1 03:48:32 host2 sshd[2153423]: Disconnected from invalid user luca 185.121.0.2 port 33936 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 110.78.149.220
country_id: 1605651
description:
Jan  1 03:48:13 host2 sshd[2153049]: Disconnected from invalid user smp 110.78.149.220 port 40710 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2026-01-01 03:55:41 dovecot_login authenticator failed for H=([65.191.211.33]) [65.191.211.33]:52568: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.56.228.149
country_id: 6252001
description:
2026-01-01 03:56:09 dovecot_login authenticator failed for H=ool-6038e495.static.optonline.net [96.56.228.149]:39682: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  1 03:59:03 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<MhDJAEdHRDFo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.85
country_id: 1210997
description:
2026-01-01 03:59:55 dovecot_login authenticator failed for H=([103.115.252.60]) [103.115.252.85]:51432: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.11.195.72
country_id: 3865483
description:
Jan  1 04:00:17 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=190.11.195.72, lip=66.85.158.91, TLS, session=<qBARBEdH8ai+C8NI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.132.223.71
country_id: 1210997
description:
2026-01-01 04:00:32 dovecot_login authenticator failed for H=([103.132.220.252]) [103.132.223.71]:45310: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.13.69.218
country_id: 3175395
description:
Jan  1 04:00:49 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<env_eng>, method=PLAIN, rip=45.13.69.218, lip=66.85.158.91, TLS, session=<nDMTBkdHGastDUXa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Jan  1 04:03:29 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<PiedEEdHDuCYNcU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.241.155.248
country_id: 6252001
description:
Jan  1 04:06:22 host2 sshd[2175374]: Disconnected from invalid user test 192.241.155.248 port 35410 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 96.8.126.57
country_id: 6252001
description:
Jan  1 04:06:51 host2 sshd[2176070]: Disconnected from invalid user test4 96.8.126.57 port 43794 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 04:07:31 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<92oKH0dHMrmeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  1 04:09:13 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<hscgJUdHCt8yBsPO>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 96.8.126.57
country_id: 6252001
description:
Jan  1 04:09:54 host2 sshd[2179993]: Disconnected from invalid user lorenzo 96.8.126.57 port 55340 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  1 04:10:54 host2 sshd[2181151]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  1 04:10:53 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<wTwUK0dHKCZniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 96.8.126.57
country_id: 6252001
description:
Jan  1 04:11:10 host2 sshd[2181776]: Disconnected from invalid user celia 96.8.126.57 port 40948 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  1 04:11:18 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<OUSXLEdHSKCi8GQy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.241.155.248
country_id: 6252001
description:
Jan  1 04:11:32 host2 sshd[2182161]: Disconnected from invalid user test 192.241.155.248 port 47118 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  1 04:15:11 host2 sshd[2186814]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 04:18:39 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<3ajURkdHWIkv/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2026-01-01 04:23:48 dovecot_plain authenticator failed for H=(permantly) [75.97.190.237]:54616: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.226.44.73
country_id: 294640
description:
2026-01-01 04:23:52 dovecot_plain authenticator failed for H=(exogeone) [109.226.44.73]:45843: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  1 04:25:00 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<78qYXUdHirdCdMzo>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.19
country_id: 2635167
description:
Jan  1 04:24:41 host2 dovecot[1911092]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.19, lip=66.85.158.92, TLS, session=<UzKVXEdH0+e594kT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.57
country_id: 6252001
description:
Jan  1 04:25:23 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.57, lip=66.85.158.92, TLS, session=<hH0UX0dHROXG6xg5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 04:25:31 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<sutrX0dHVr2eRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 04:25:51 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<HiSiYEdH9qkjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.69.9.148
country_id: 1269750
description:
Jan  1 04:25:55 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=103.69.9.148, lip=66.85.158.91, TLS, session=<BEPlX0dHlOlnRQmU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  1 04:26:40 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<AZ+NY0dH54B100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.214.138.56
country_id: 2510769
description:
Jan  1 04:26:14 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<charanaw>, method=PLAIN, rip=185.214.138.56, lip=66.85.158.91, TLS, session=<G2gWYUdHwZ651oo4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.4.145.50
country_id: 1210997
description:
Jan  1 04:26:22 host2 sshd[2202783]: Disconnected from invalid user hari 103.4.145.50 port 59906 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.4.145.50
country_id: 1210997
description:
Jan  1 04:27:59 host2 sshd[2205382]: Disconnected from invalid user nate 103.4.145.50 port 52942 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 180.23.7.134
country_id: 1861060
description:
Jan  1 04:28:20 host2 sshd[2206020]: Disconnected from invalid user ftpadmin 180.23.7.134 port 54327 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.4.145.50
country_id: 1210997
description:
Jan  1 04:28:36 host2 sshd[2206428]: Disconnected from invalid user erwin 103.4.145.50 port 36478 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.241.90
country_id: 3469034
description:
2026-01-01 04:28:52 dovecot_login authenticator failed for H=(ccabv.org.cta.gvt.net.br) [187.58.241.90]:40768: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.4.145.50
country_id: 1210997
description:
Jan  1 04:29:11 host2 sshd[2207339]: Disconnected from invalid user pokemon 103.4.145.50 port 48246 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.98.168
country_id: 3144096
description:
2026-01-01 04:29:23 dovecot_login authenticator failed for H=([84.214.98.168]) [84.214.98.168]:55252: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  1 04:29:35 host2 pure-ftpd[2207981]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 180.23.7.134
country_id: 1861060
description:
Jan  1 04:30:31 host2 sshd[2209556]: Disconnected from invalid user ansible 180.23.7.134 port 56730 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.143.71
country_id: 2328926
description:
Jan  1 04:31:16 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=152.32.143.71, lip=66.85.158.91, session=<Hf0bdEdHpuiYII9H>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 152.32.143.71
country_id: 2328926
description:
Jan  1 04:31:17 host2 dovecot[1911092]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=152.32.143.71, lip=66.85.158.91, TLS, session=<PNAwdEdHZuqYII9H>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 04:31:54 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<Ir5CdkdHYNIzTcpt>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 180.23.7.134
country_id: 1861060
description:
Jan  1 04:32:58 host2 sshd[2213061]: Disconnected from invalid user css 180.23.7.134 port 36708 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.192.212.88
country_id: 1733045
description:
2026-01-01 04:32:11 dovecot_plain authenticator failed for H=(T8FWR3M6R) [14.192.212.88]:18691: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 180.23.7.134
country_id: 1861060
description:
Jan  1 04:34:06 host2 sshd[2215027]: Disconnected from invalid user stan 180.23.7.134 port 54224 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 04:37:00 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<yyJ4iEdHGrozTcpt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.190.105
country_id: 1643084
description:
Jan  1 04:37:13 host2 sshd[2219939]: Disconnected from invalid user ubuntu 103.153.190.105 port 53435 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.198.3.69
country_id: 357994
description:
2026-01-01 04:38:52 dovecot_plain authenticator failed for H=(Q3OS5) [156.198.3.69]:22459: 535 Incorrect authentication data (set_id=lasithar@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.124.75
country_id: 1269750
description:
2026-01-01 04:39:24 dovecot_login authenticator failed for H=(abts-kk-static-182.209.166.122.airtelbroadband.in) [125.17.124.75]:38142: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.157.98.80
country_id: 453733
description:
2026-01-01 04:39:42 dovecot_login authenticator failed for H=80-98-157-37.dyn.estpak.ee [37.157.98.80]:56163: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  1 04:40:45 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<dz7jlUdHFppnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 04:41:23 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<BFcxmEdHMnQjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2026-01-01 04:41:33 dovecot_plain authenticator failed for H=c-98-204-134-124.hsd1.md.comcast.net (nicking) [98.204.134.124]:47622: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 04:42:57 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<zzDBnUdHJIsv/AU1>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.193.122
country_id: 2921044
description:
[2026-01-01 04:43:00 +0530] info [cpaneld] 104.28.193.122 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.153.190.105
country_id: 1643084
description:
Jan  1 04:44:06 host2 sshd[2230459]: Disconnected from invalid user ubuntu 103.153.190.105 port 56319 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  1 04:43:48 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<PGnRoEdH+h6i8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.142.157
country_id: 3017382
description:
2026-01-01 04:44:03 dovecot_login authenticator failed for H=157.ip-51-75-142.eu [51.75.142.157]:49354: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.51.34.229
country_id: 2510769
description:
2026-01-01 04:44:22 dovecot_login authenticator failed for H=([212.51.34.229]) [212.51.34.229]:37673: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.145.10.140
country_id: 6252001
description:
2026-01-01 04:45:04 dovecot_plain authenticator failed for H=c-76-145-10-140.hsd1.ga.comcast.net (trocatoly) [76.145.10.140]:54700: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  1 04:48:07 host2 sshd[2238234]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  1 04:48:54 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<DCAIs0dHLMIvWBNS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2026-01-01 04:48:40 dovecot_plain authenticator failed for H=c-73-195-211-98.hsd1.nj.comcast.net (synsutle) [73.195.211.98]:53910: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.81.23.49
country_id: 2750405
description:
Jan  1 04:52:39 host2 sshd[2243490]: Disconnected from invalid user odoo 45.81.23.49 port 49098 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.81.23.49
country_id: 2750405
description:
Jan  1 04:55:41 host2 sshd[2247880]: Disconnected from invalid user app 45.81.23.49 port 40770 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.81.23.49
country_id: 2750405
description:
Jan  1 04:56:51 host2 sshd[2249252]: Disconnected from invalid user ubuntu 45.81.23.49 port 48118 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  1 04:57:48 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<p5Lj0kdHzIMFhXlo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.81.23.49
country_id: 2750405
description:
Jan  1 04:57:22 host2 sshd[2250033]: Disconnected from invalid user radarr 45.81.23.49 port 33478 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.190.105
country_id: 1643084
description:
Jan  1 05:00:40 host2 sshd[2254416]: Disconnected from invalid user ali 103.153.190.105 port 45016 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  1 05:00:49 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<9ZOp3UdHOK+eRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  1 05:03:07 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<46Hd5UdHjgZniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.60.113
country_id: 953987
description:
Jan  1 05:03:32 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=102.129.60.113, lip=66.85.158.91, TLS, session=<StlQ5kdHoOpmgTxx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.139
country_id: 3469034
description:
Jan  1 05:04:03 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=187.120.72.139, lip=66.85.158.91, TLS, session=<iCs/6EdHe6W7eEiL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.109.234.38
country_id: 3625428
description:
Jan  1 05:04:17 host2 sshd[2259468]: Disconnected from invalid user anna 200.109.234.38 port 50828 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 05:05:13 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<I+pj7UdHmKWeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  1 05:06:11 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<X4ne8EdHoJmi8GQy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.108.134
country_id: 1819730
description:
Jan  1 05:05:45 host2 sshd[2261692]: Disconnected from invalid user redmine 101.36.108.134 port 40166 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.109.234.38
country_id: 3625428
description:
Jan  1 05:06:55 host2 sshd[2263190]: Disconnected from invalid user devuser 200.109.234.38 port 51898 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.5.189.133
country_id: 241170
description:
Jan  1 05:07:13 host2 sshd[2263703]: Disconnected from invalid user lisi 69.5.189.133 port 54794 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.26.153.102
country_id: 1819730
description:
2026-01-01 05:08:19 dovecot_login authenticator failed for H=([118.26.153.102]) [118.26.153.102]:39542: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.29.18.217
country_id: 1880251
description:
Jan  1 05:07:23 host2 sshd[2263880]: Disconnected from invalid user user 175.29.18.217 port 50364 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  1 05:07:42 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<PGBG9kdHLJBn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.15.93
country_id: 1269750
description:
2026-01-01 05:07:52 dovecot_login authenticator failed for H=(static.ill.117.211.15.106.bsnl.co.in) [117.211.15.93]:39748: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.232
country_id: 6252001
description:
Jan  1 05:08:56 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.232, lip=66.85.158.92, session=<bYzP+kdHLO3N0h/o>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.29.18.217
country_id: 1880251
description:
Jan  1 05:09:10 host2 sshd[2266103]: Disconnected from invalid user runner 175.29.18.217 port 46406 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.109.234.38
country_id: 3625428
description:
Jan  1 05:09:31 host2 sshd[2266488]: Disconnected from invalid user incoming 200.109.234.38 port 50772 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.29.18.217
country_id: 1880251
description:
Jan  1 05:09:44 host2 sshd[2266694]: Disconnected from invalid user john 175.29.18.217 port 55172 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  1 05:09:49 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<snDf/UdHBAdo7MS0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.109.234.38
country_id: 3625428
description:
Jan  1 05:10:48 host2 sshd[2268119]: Disconnected from invalid user ubuntu 200.109.234.38 port 37296 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.108.134
country_id: 1819730
description:
Jan  1 05:10:51 host2 sshd[2268178]: Disconnected from invalid user vikas 101.36.108.134 port 41528 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.241.24.186
country_id: 798544
description:
Jan  1 05:11:34 host2 sshd[2269058]: Disconnected from invalid user vlad 109.241.24.186 port 47424 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 175.29.18.217
country_id: 1880251
description:
Jan  1 05:11:53 host2 sshd[2269434]: Disconnected from invalid user sistema 175.29.18.217 port 51862 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.108.134
country_id: 1819730
description:
Jan  1 05:13:12 host2 sshd[2271302]: Disconnected from invalid user user 101.36.108.134 port 45448 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.5.189.133
country_id: 241170
description:
Jan  1 05:12:29 host2 sshd[2270330]: Disconnected from invalid user dev 69.5.189.133 port 36208 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.76
country_id: 6252001
description:
Jan  1 05:14:01 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.76, lip=66.85.158.92, TLS, session=<JScBDUhHuvvN0h9M>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.108.134
country_id: 1819730
description:
Jan  1 05:13:47 host2 sshd[2271963]: Disconnected from invalid user ubuntu 101.36.108.134 port 45756 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.194.250.47
country_id: 1605651
description:
Jan  1 05:13:57 host2 sshd[2272188]: Disconnected from invalid user redmine 118.194.250.47 port 55270 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.54
country_id: 1269750
description:
2026-01-01 05:16:07 dovecot_login authenticator failed for H=(nsg-corporate-54.202.186.122.airtel.in) [122.186.202.54]:39966: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.191.33
country_id: 6252001
description:
2026-01-01 05:15:46 dovecot_plain authenticator failed for H=c-73-0-191-33.hsd1.fl.comcast.net (iniciesty) [73.0.191.33]:43680: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.77.137.236
country_id: 1605651
description:
2026-01-01 05:15:48 dovecot_login authenticator failed for H=([110.77.137.236]) [110.77.137.236]:52482: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.53.254.168
country_id: 6252001
description:
2026-01-01 05:15:51 dovecot_plain authenticator failed for H=c-73-53-254-168.hsd1.fl.comcast.net (noniasslae) [73.53.254.168]:56712: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.179.128
country_id: 3996063
description:
2026-01-01 05:16:55 dovecot_login authenticator failed for H=([140.84.179.128]) [140.84.179.128]:51892: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.241.24.186
country_id: 798544
description:
Jan  1 05:17:09 host2 sshd[2276522]: Disconnected from invalid user koha 109.241.24.186 port 35314 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.138
country_id: 1269750
description:
2026-01-01 05:16:23 dovecot_login authenticator failed for H=([128.185.201.138]) [128.185.201.138]:53020: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.109.234.38
country_id: 3625428
description:
Jan  1 05:16:51 host2 sshd[2276040]: Disconnected from invalid user bot 200.109.234.38 port 60156 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  1 05:19:19 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<m2zJH0hH3tSeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  1 05:21:28 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<N7uAJ0hH/fd100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 05:23:21 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<4RdFLkhHgO2eRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 05:25:34 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<WK0oNkhH7mkjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  1 05:30:17 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<hzEKR0hHErgyBsPO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.201.208.112
country_id: 1831722
description:
2026-01-01 05:30:48 dovecot_plain authenticator failed for H=(LE7AQH53ZALJ4) [45.201.208.112]:51845: 535 Incorrect authentication data (set_id=sanjanap@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 05:31:20 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<jSTRSkhHUt4v/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  1 05:31:28 host2 sshd[2293287]: Disconnected from invalid user user 2.57.121.25 port 28224 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  1 05:31:43 host2 pure-ftpd[2293511]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  1 05:34:13 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<VgoZVUhHoqNCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Jan  1 05:39:42 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<Qga0aEhHNpWYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  1 05:40:05 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<ufMWakhHOq1nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 05:41:13 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<RRwgbkhHdt0jupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.170.26.169
country_id: 2077456
description:
2026-01-01 05:41:07 dovecot_login authenticator failed for H=(124-170-26-169.tpgi.com.au) [124.170.26.169]:33644: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  1 05:41:45 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<9kEPcEhHKtOi8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.122.247
country_id: 3144096
description:
2026-01-01 05:41:27 dovecot_login authenticator failed for H=(cm-178.232.122.247.get.no) [178.232.122.247]:43979: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 05:45:31 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<eNqKfUhHdLczTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2026-01-01 05:50:11 dovecot_plain authenticator failed for H=(sheae) [24.105.248.218]:57102: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 05:50:35 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<xWyfj0hHbMMzTcpt>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.178.224.92
country_id: 1880251
description:
Jan  1 05:53:06 host2 pure-ftpd[2314761]: (?@158.178.224.92) [INFO] New connection from 158.178.224.92


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 158.178.224.92
country_id: 1880251
description:
Jan  1 05:53:11 host2 pure-ftpd[2314831]: (?@158.178.224.92) [INFO] New connection from 158.178.224.92


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 05:54:34 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<Bk7knUhHfNIv/AU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  1 05:55:44 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<IEsLokhHlAtniu0S>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.15.108
country_id: 290557
description:
2026-01-01 05:58:47 dovecot_plain authenticator failed for H=(candrate) [5.31.15.108]:59773: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  1 06:01:04 host2 sshd[2323123]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.162
country_id: 6252001
description:
Jan  1 06:00:27 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=147.185.132.162, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<l50Os0hHMtGTuYSi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  1 06:01:19 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<74z4tUhHHsSi8GQy>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.111.228.241
country_id: 3374084
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 172.111.228.241 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 06:02:27 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<wQYRukhHWp2eRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  1 06:03:34 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<4K8RvkhHPOxn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.8.103
country_id: 3175395
description:
Jan  1 06:06:51 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=185.197.8.103, lip=66.85.158.91, TLS, session=<Ehj2yEhHhKq5xQhn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.17.125.36
country_id: 690791
description:
Jan  1 06:07:14 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<charanaw>, method=PLAIN, rip=185.17.125.36, lip=66.85.158.91, TLS, session=<vX8KykhHZLO5EX0k>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  1 06:11:37 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<r3Xh2khHvs8vWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  1 06:16:15 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<2mhq60hH0tl100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.44.77.29
country_id: 690791
description:
Jan  1 06:20:32 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=194.44.77.29, lip=66.85.158.91, TLS, session=<SYTn+UhHFKbCLE0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 06:20:40 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<TF01+0hHrr+eRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.84
country_id: 3175395
description:
Jan  1 06:21:00 host2 dovecot[1911092]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=217.26.179.84, lip=66.85.158.91, TLS, session=<R9GS+0hHldjZGrNU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  1 06:21:57 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<ocTU/0hHYnRo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 06:25:22 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<5zcIDElHnJ4jupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  1 06:27:41 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<Jk5ZFElHSr4FhXlo>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  1 06:34:21 host2 pure-ftpd[2356721]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.209
country_id: 6252001
description:
Jan  1 06:35:11 host2 dovecot[1911092]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.209, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<RDRIL0lHI9XN0h/R>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  1 06:40:11 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<15IIQUlH3JZnmud6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.70.65.25
country_id: 2328926
description:
Jan  1 06:39:40 host2 dovecot[2361401]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=146.70.65.25, lip=66.85.158.91, session=<H+lGP0lHvsaSRkEZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  1 06:39:40 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<NMAvP0lHePai8Jp9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 181.214.218.164
country_id: 2802361
description:
Jan  1 06:39:50 host2 dovecot[2361401]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=181.214.218.164, lip=66.85.158.91, TLS, session=<IobpP0lHkMi11tqk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.244.33.12
country_id: 1282988
description:
Jan  1 06:39:50 host2 dovecot[2361401]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=173.244.33.12, lip=66.85.158.91, TLS handshaking: Connection closed, session=<r9rqP0lHhsit9CEM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.133.193.28
country_id: 2629691
description:
Jan  1 06:39:39 host2 dovecot[2361401]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=45.133.193.28, lip=66.85.158.91, session=<KetDP0lHzMYthcEc>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.90.126.142
country_id: 3703430
description:
Jan  1 06:39:47 host2 pure-ftpd[2362343]: (?@91.90.126.142) [INFO] New connection from 91.90.126.142


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 98.159.40.18
country_id: 1227603
description:
Jan  1 06:39:47 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=98.159.40.18, lip=66.85.158.91, TLS handshaking: Connection closed, session=<KXGyP0lHSuVinygS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 06:41:00 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=</tLtQ0lHKOIjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 06:42:28 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<BKU0SUlHVuIv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  1 06:43:59 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<3WilTklHgopCdMzo>


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 98.191.229.175
country_id: 6252001
description:
Jan  1 06:46:09 host2 sshd[2369429]: Disconnecting authenticating user root 98.191.229.175 port 35148: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 98.191.229.175
country_id: 6252001
description:
Jan  1 06:46:09 host2 sshd[2369429]: error: maximum authentication attempts exceeded for root from 98.191.229.175 port 35148 ssh2 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 98.191.229.175
country_id: 6252001
description:
Jan  1 06:46:14 host2 sshd[2369541]: Disconnecting invalid user admin 98.191.229.175 port 36878: Too many authentication failures [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  1 06:48:30 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<zizFXklH3jdniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  1 06:50:56 host2 sshd[2373703]: Disconnected from invalid user admin 2.57.121.112 port 23638 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  1 06:52:01 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<VcBca0lHfICeRdGr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.184.108
country_id: 2921044
description:
Jan  1 06:52:53 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=46.101.184.108, lip=66.85.158.91, session=<4MiKbklHg6wuZbhs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.178.229
country_id: 2921044
description:
Jan  1 06:52:54 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=46.101.178.229, lip=66.85.158.91, session=<qoqZbklHPkQuZbLl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-01 06:54:13 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:54144: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  1 06:54:29 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<4bwrdElHjMgyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  1 06:56:43 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<iA4mfElHCq+i8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.23.68
country_id: 3144096
description:
2026-01-01 06:57:38 dovecot_login authenticator failed for H=([178.232.23.68]) [178.232.23.68]:59423: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.232.73.130
country_id: 1269750
description:
2026-01-01 06:57:58 dovecot_login authenticator failed for H=(nsg-corporate-90.179.185.122.airtel.in) [136.232.73.130]:54502: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 06:59:28 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<Rsz3hUlH8NczTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  1 07:00:28 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<OIeJiUlH/sVn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 07:00:32 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<ZuHPiUlHvpOeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 07:03:54 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<eJXelUlHyuUv/AU1>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 13.51.85.114
country_id: 2661886
description:
[2026-01-01 07:03:57 +0530] info [cpaneld] 13.51.85.114 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  1 07:03:25 host2 sshd[2386092]: Disconnected from invalid user user 2.57.121.25 port 27962 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2026-01-01 07:03:53 dovecot_plain authenticator failed for H=c-68-60-77-128.hsd1.mi.comcast.net (berdifts) [68.60.77.128]:57248: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 07:04:35 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<YwpNmElH5o8zTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  1 07:11:00 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<26c0r0lH1oSeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  1 07:11:55 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<GDiFsklHYep100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.190.155.43
country_id: 6252001
description:
2026-01-01 07:13:49 dovecot_plain authenticator failed for H=(pecebroyn) [76.190.155.43]:57848: 535 Incorrect authentication data (set_id=chris@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.190.155.43
country_id: 6252001
description:
2026-01-01 07:15:10 dovecot_plain authenticator failed for H=(procommant) [76.190.155.43]:34906: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.118.114.22
country_id: 1269750
description:
Jan  1 07:15:45 host2 sshd[2397773]: Disconnected from invalid user sysadmin 103.118.114.22 port 37426 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.62.87.27
country_id: 3469034
description:
Jan  1 07:16:36 host2 sshd[2398462]: Disconnected from invalid user ubuntu 187.62.87.27 port 42456 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Jan  1 07:17:21 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<K3/4xUlHIuWYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 07:18:40 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<6PKuyklHaIyeRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.51.34.229
country_id: 2510769
description:
2026-01-01 07:19:08 dovecot_login authenticator failed for H=(229.34.51.212.dynamic.reverse-mundo-r.com) [212.51.34.229]:60309: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.62.87.27
country_id: 3469034
description:
Jan  1 07:19:26 host2 sshd[2401207]: Disconnected from invalid user sysadmin 187.62.87.27 port 52718 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.152.90
country_id: 1605651
description:
Jan  1 07:19:37 host2 sshd[2401476]: Disconnected from invalid user scaner 27.254.152.90 port 43434 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.62.87.27
country_id: 3469034
description:
Jan  1 07:20:06 host2 sshd[2402177]: Disconnected from invalid user sftptest 187.62.87.27 port 39684 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.147.214
country_id: 1643084
description:
Jan  1 07:21:09 host2 sshd[2403141]: Disconnected from invalid user sftptest 103.187.147.214 port 55848 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.118.114.22
country_id: 1269750
description:
Jan  1 07:20:29 host2 sshd[2402566]: Disconnected from invalid user sftptest 103.118.114.22 port 54760 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.62.87.27
country_id: 3469034
description:
Jan  1 07:22:02 host2 sshd[2403838]: Disconnected from invalid user user 187.62.87.27 port 51572 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.152.90
country_id: 1605651
description:
Jan  1 07:21:28 host2 sshd[2403364]: Disconnected from invalid user zeppelin 27.254.152.90 port 40484 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.118.114.22
country_id: 1269750
description:
Jan  1 07:22:26 host2 sshd[2404169]: Disconnected from invalid user deployer 103.118.114.22 port 33832 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.62.87.27
country_id: 3469034
description:
Jan  1 07:24:02 host2 sshd[2405555]: Disconnected from invalid user test 187.62.87.27 port 42524 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 07:25:07 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<TBK24UlHYjsjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.147.92
country_id: 1643084
description:
Jan  1 07:24:52 host2 sshd[2406314]: Disconnected from invalid user webserver 103.187.147.92 port 33130 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.147.92
country_id: 1643084
description:
Jan  1 07:25:30 host2 sshd[2407195]: Disconnected from invalid user chris 103.187.147.92 port 46806 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.227.8.186
country_id: 934292
description:
Jan  1 07:25:38 host2 sshd[2407320]: Disconnected from invalid user minecraft 197.227.8.186 port 54852 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.49.129.67
country_id: 3175395
description:
Jan  1 07:25:40 host2 sshd[2407364]: Disconnected from invalid user user 151.49.129.67 port 40804 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.147.214
country_id: 1643084
description:
Jan  1 07:25:55 host2 sshd[2407566]: Disconnected from invalid user vyos 103.187.147.214 port 32936 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.187.147.92
country_id: 1643084
description:
Jan  1 07:26:06 host2 sshd[2407812]: Disconnected from invalid user user 103.187.147.92 port 33956 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.147.214
country_id: 1643084
description:
Jan  1 07:26:31 host2 sshd[2408181]: Disconnected from invalid user rabbit 103.187.147.214 port 48718 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.221.174.253
country_id: 1269750
description:
Jan  1 07:27:26 host2 sshd[2409032]: Disconnected from invalid user devuser 117.221.174.253 port 51915 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.227.8.186
country_id: 934292
description:
Jan  1 07:27:39 host2 sshd[2409228]: Disconnected from invalid user admin 197.227.8.186 port 17425 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.206.241.199
country_id: 453733
description:
Jan  1 07:27:46 host2 sshd[2409333]: Disconnected from invalid user socksuser 109.206.241.199 port 46028 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.49.129.67
country_id: 3175395
description:
Jan  1 07:29:08 host2 sshd[2410670]: Disconnected from invalid user hik 151.49.129.67 port 48974 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 98.142.247.37
country_id: 6252001
description:
Jan  1 07:29:57 host2 sshd[2411351]: Disconnected from invalid user minecraft 98.142.247.37 port 37488 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 109.206.241.199
country_id: 453733
description:
Jan  1 07:29:33 host2 sshd[2411030]: Disconnected from invalid user ubuntu 109.206.241.199 port 42000 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.49.129.67
country_id: 3175395
description:
Jan  1 07:29:44 host2 sshd[2411170]: Disconnected from invalid user otsmanager 151.49.129.67 port 40538 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 98.142.247.37
country_id: 6252001
description:
Jan  1 07:30:58 host2 sshd[2412466]: Disconnected from invalid user consultor 98.142.247.37 port 52264 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.206.241.199
country_id: 453733
description:
Jan  1 07:31:15 host2 sshd[2412686]: Disconnected from invalid user devuser 109.206.241.199 port 47906 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.53.161
country_id: 953987
description:
Jan  1 07:31:34 host2 dovecot[2361401]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=102.129.53.161, lip=66.85.158.91, TLS, session=<YGDH90lH69dmgTWh>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.49.129.67
country_id: 3175395
description:
Jan  1 07:31:56 host2 sshd[2413196]: Disconnected from invalid user toor 151.49.129.67 port 47696 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.221.174.253
country_id: 1269750
description:
Jan  1 07:31:58 host2 sshd[2413242]: Disconnected from invalid user ubuntu 117.221.174.253 port 38016 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 98.142.247.37
country_id: 6252001
description:
Jan  1 07:31:59 host2 sshd[2413266]: Received disconnect from 98.142.247.37 port 52454:11: Bye Bye [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.249.248
country_id: 3865483
description:
Jan  1 07:32:00 host2 dovecot[2361401]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info>, method=PLAIN, rip=179.0.249.248, lip=66.85.158.91, TLS, session=<Y/kV+UlHC46zAPn4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.206.241.199
country_id: 453733
description:
Jan  1 07:32:20 host2 sshd[2413553]: Disconnected from invalid user minecraft 109.206.241.199 port 42854 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 98.142.247.37
country_id: 6252001
description:
Jan  1 07:32:30 host2 sshd[2413690]: Disconnected from invalid user elasticsearch 98.142.247.37 port 34742 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 98.142.247.37
country_id: 6252001
description:
Jan  1 07:33:31 host2 sshd[2414610]: Disconnected from invalid user socksuser 98.142.247.37 port 58406 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.221.174.253
country_id: 1269750
description:
Jan  1 07:33:34 host2 sshd[2414649]: Disconnected from invalid user malik 117.221.174.253 port 52565 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.62
country_id: 1149361
description:
2026-01-01 07:33:57 dovecot_login authenticator failed for H=([149.54.62.62]) [149.54.62.62]:54002: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.127.128
country_id: 3144096
description:
2026-01-01 07:34:11 dovecot_login authenticator failed for H=(cm-46.212.127.128.get.no) [46.212.127.128]:57052: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  1 07:34:37 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<IJW5A0pHEqdo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.254.244.211
country_id: 798544
description:
2026-01-01 07:35:53 dovecot_plain authenticator failed for H=(lidgy) [94.254.244.211]:40913: 535 Incorrect authentication data (set_id=admin@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  1 07:36:10 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<lrdACUpHiOAvWBNS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.112.222.136
country_id: 3624060
description:
Jan  1 07:35:35 host2 sshd[2416582]: Disconnected from invalid user frappe 190.112.222.136 port 56486 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 117.221.174.253
country_id: 1269750
description:
Jan  1 07:36:51 host2 sshd[2417721]: Disconnected from invalid user deployment 117.221.174.253 port 53727 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  1 07:37:01 host2 pure-ftpd[2417907]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  1 07:37:41 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<MmOwDkpH8Hii8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  1 07:40:20 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<nhUcGEpHHMJnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  1 07:41:22 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<pPzTG0pHyRhniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 07:40:42 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<PRp4GUpHzlUjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.85.163.94
country_id: 6252001
description:
Jan  1 07:40:53 host2 sshd[2421563]: Disconnected from invalid user student01 34.85.163.94 port 50654 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.112.222.136
country_id: 3624060
description:
Jan  1 07:41:00 host2 sshd[2421676]: Disconnected from invalid user user 190.112.222.136 port 54712 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.85.163.94
country_id: 6252001
description:
Jan  1 07:42:10 host2 sshd[2422789]: Disconnected from invalid user user 34.85.163.94 port 51762 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 14.142.136.102
country_id: 1269750
description:
Jan  1 07:42:20 host2 sshd[2422922]: Disconnected from invalid user git 14.142.136.102 port 60984 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.92.81.41
country_id: 1819730
description:
Jan  1 07:41:43 host2 sshd[2422413]: Disconnected from invalid user ian 34.92.81.41 port 44370 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.169.138
country_id: 1819730
description:
Jan  1 07:42:33 host2 sshd[2423126]: Disconnected from invalid user nodeuser 150.5.169.138 port 59752 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.241.45.120
country_id: 1269750
description:
Jan  1 07:42:35 host2 sshd[2423141]: Disconnected from invalid user bitrix 103.241.45.120 port 56736 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.21.38.198
country_id: 1269750
description:
Jan  1 07:43:00 host2 sshd[2423494]: Disconnected from invalid user git 202.21.38.198 port 44856 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.169.138
country_id: 1819730
description:
Jan  1 07:43:54 host2 sshd[2424509]: Disconnected from invalid user bitrix 150.5.169.138 port 53296 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.254.166.113
country_id: 1269750
description:
Jan  1 07:44:20 host2 sshd[2424902]: Disconnected from invalid user user 205.254.166.113 port 54278 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.21.38.198
country_id: 1269750
description:
Jan  1 07:43:41 host2 sshd[2424349]: Disconnected from invalid user radio 202.21.38.198 port 38208 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 14.142.136.102
country_id: 1269750
description:
Jan  1 07:43:36 host2 sshd[2424283]: Disconnected from invalid user user2 14.142.136.102 port 56260 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.93.89.195
country_id: 2328926
description:
Jan  1 07:43:39 host2 sshd[2424323]: Disconnected from invalid user radio 155.93.89.195 port 52754 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.92.81.41
country_id: 1819730
description:
Jan  1 07:44:22 host2 sshd[2425002]: Disconnected from invalid user username 34.92.81.41 port 43426 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.85.163.94
country_id: 6252001
description:
Jan  1 07:44:38 host2 sshd[2425555]: Disconnected from invalid user oracle 34.85.163.94 port 42248 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.241.45.120
country_id: 1269750
description:
Jan  1 07:45:14 host2 sshd[2426379]: Disconnected from invalid user ubuntu 103.241.45.120 port 37380 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.226.118
country_id: 1880251
description:
Jan  1 07:45:44 host2 sshd[2426757]: Disconnected from invalid user dennis 45.78.226.118 port 49544 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 07:45:52 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<0jDuK0pH2usv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.85.163.94
country_id: 6252001
description:
Jan  1 07:45:52 host2 sshd[2426854]: Disconnected from invalid user test 34.85.163.94 port 60444 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.241.45.120
country_id: 1269750
description:
Jan  1 07:45:54 host2 sshd[2426880]: Disconnected from invalid user ftpuser 103.241.45.120 port 51646 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.216.211.19
country_id: 1269750
description:
Jan  1 07:45:57 host2 sshd[2426932]: Disconnected from invalid user milan 117.216.211.19 port 33154 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.169.138
country_id: 1819730
description:
Jan  1 07:46:28 host2 sshd[2427409]: Disconnected from invalid user ubuntu 150.5.169.138 port 42092 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.249.166.171
country_id: 3625428
description:
Jan  1 07:47:36 host2 sshd[2428473]: Disconnected from invalid user denise 201.249.166.171 port 41310 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.202.90
country_id: 1880251
description:
Jan  1 07:47:37 host2 sshd[2428481]: Disconnected from invalid user admin3 45.78.202.90 port 41256 [preauth]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 104.238.147.104
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 104.238.147.104: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 117.216.211.19
country_id: 1269750
description:
Jan  1 07:50:10 host2 sshd[2430858]: Disconnected from invalid user testing 117.216.211.19 port 57608 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.156.88
country_id: 1269750
description:
2026-01-01 07:51:49 dovecot_plain authenticator failed for H=(PMAJ2FF461FCD) [49.37.156.88]:59870: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.249.166.171
country_id: 3625428
description:
Jan  1 07:52:12 host2 sshd[2432710]: Disconnected from invalid user db2admin 201.249.166.171 port 36712 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.15
country_id: 1733045
description:
2026-01-01 07:52:21 dovecot_login authenticator failed for H=([49.124.151.15]) [49.124.151.15]:37138: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.226.118
country_id: 1880251
description:
Jan  1 07:51:35 host2 sshd[2432181]: Disconnected from invalid user mike 45.78.226.118 port 54208 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  1 07:51:58 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=</27CQUpHMoyi8GQy>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.189.237.92
country_id: 337996
description:
Jan  1 07:52:53 host2 sshd[2433381]: Disconnected from invalid user cloud 196.189.237.92 port 59774 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.249.166.171
country_id: 3625428
description:
Jan  1 07:52:57 host2 sshd[2433458]: Disconnected from invalid user pro 201.249.166.171 port 36718 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.202.90
country_id: 1880251
description:
Jan  1 07:53:17 host2 sshd[2433763]: Disconnected from invalid user production 45.78.202.90 port 45870 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.226.118
country_id: 1880251
description:
Jan  1 07:53:23 host2 sshd[2433898]: Disconnected from invalid user rustserver 45.78.226.118 port 56556 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-01 07:52:43 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (unhal) [87.103.126.54]:19504: 535 Incorrect authentication data (set_id=admin@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.189.237.92
country_id: 337996
description:
Jan  1 07:53:31 host2 sshd[2434065]: Disconnected from invalid user demo 196.189.237.92 port 39864 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.249.166.171
country_id: 3625428
description:
Jan  1 07:53:45 host2 sshd[2434311]: Disconnected from invalid user backups 201.249.166.171 port 36796 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.52.86
country_id: 6252001
description:
Jan  1 07:53:57 host2 sshd[2434520]: Disconnected from invalid user prova 107.174.52.86 port 34450 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  1 07:54:00 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<61cGSUpHELZCdMzo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.226.118
country_id: 1880251
description:
Jan  1 07:54:10 host2 sshd[2434998]: Disconnected from invalid user edward 45.78.226.118 port 44362 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.249.166.171
country_id: 3625428
description:
Jan  1 07:54:31 host2 sshd[2435423]: Disconnected from invalid user mysftp 201.249.166.171 port 34280 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.52.86
country_id: 6252001
description:
Jan  1 07:54:46 host2 sshd[2435603]: Disconnected from invalid user programacion 107.174.52.86 port 38856 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.226.118
country_id: 1880251
description:
Jan  1 07:55:00 host2 sshd[2435767]: Disconnected from invalid user sinusbot1 45.78.226.118 port 55052 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  1 07:55:28 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<OqI9TkpHfJkFhXlo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.52.86
country_id: 6252001
description:
Jan  1 07:55:40 host2 sshd[2436585]: Disconnected from invalid user mongod 107.174.52.86 port 34482 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.202.90
country_id: 1880251
description:
Jan  1 07:55:46 host2 sshd[2436638]: Disconnected from invalid user cloud 45.78.202.90 port 49378 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.174.52.86
country_id: 6252001
description:
Jan  1 07:56:19 host2 sshd[2437159]: Disconnected from invalid user logview 107.174.52.86 port 46154 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  1 07:56:31 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<kgL/UUpHysBn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.198.3.69
country_id: 357994
description:
2026-01-01 07:57:14 dovecot_plain authenticator failed for H=(648A5DR0V5VM) [156.198.3.69]:20437: 535 Incorrect authentication data (set_id=lasithar@ksoft.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  1 07:58:56 host2 sshd[2439851]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 07:58:33 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<DwpIWUpHFO6eRdY+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.202.90
country_id: 1880251
description:
Jan  1 07:59:26 host2 sshd[2440398]: Disconnected from invalid user webftp 45.78.202.90 port 36114 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  1 08:02:04 host2 sshd[2443591]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.81.134.125
country_id: 6252001
description:
Jan  1 08:04:31 host2 pure-ftpd[2446427]: (?@172.81.134.125) [INFO] New connection from 172.81.134.125


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  1 08:07:14 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<GgZZeEpHV9B100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  1 08:07:24 host2 sshd[2450255]: Disconnected from invalid user admin 2.57.121.112 port 39668 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 08:06:52 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<4IcNd0pHlKwv/AU1>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.219.237.116
country_id: 6252001
description:
Jan  1 08:11:35 host2 pure-ftpd[2455547]: (?@104.219.237.116) [INFO] New connection from 104.219.237.116


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2026-01-01 08:11:42 dovecot_login authenticator failed for H=([125.20.249.154]) [103.251.31.154]:39594: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.228.146
country_id: 1269750
description:
2026-01-01 08:12:13 dovecot_login authenticator failed for H=([125.20.228.146]) [125.20.228.146]:35798: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 08:13:45 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<n4yoj0pHYMgzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.34.195
country_id: 953987
description:
Jan  1 08:16:43 host2 dovecot[2361401]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=102.64.34.195, lip=66.85.158.91, TLS, session=<yKw0mUpHA8hmQCLD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 08:16:44 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<U0xWmkpHcr2eRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.89.14
country_id: 226074
description:
Jan  1 08:17:05 host2 dovecot[2361401]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<charanaw>, method=PLAIN, rip=196.0.89.14, lip=66.85.158.91, TLS, session=<gomWmkpH47fEAFkO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  1 08:17:12 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<J9H3m0pHeJwyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 08:18:52 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<deXsoUpH3KszTcpt>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.143
country_id: 6252001
description:
Jan  1 08:19:56 host2 pure-ftpd[2466524]: (?@66.132.153.143) [INFO] New connection from 66.132.153.143


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.46
country_id: 3865483
description:
2026-01-01 08:24:45 dovecot_login authenticator failed for H=([131.161.184.46]) [131.161.184.46]:38396: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 08:24:59 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<X/rMt0pHHOwjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.149.142.17
country_id: 630336
description:
2026-01-01 08:25:10 dovecot_login authenticator failed for H=([77.74.34.30]) [91.149.142.17]:40575: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.159
country_id: 6252001
description:
Jan  1 08:26:16 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 10 secs): user=<>, rip=162.216.150.159, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<s8eHvEpHr8Oi2Jaf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.159
country_id: 6252001
description:
Jan  1 08:27:15 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=162.216.150.159, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<elgIwEpHIvSi2Jaf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.159
country_id: 6252001
description:
Jan  1 08:33:00 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=162.216.150.159, lip=66.85.158.92, TLS, session=<3YiX1EpHZvei2Jaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  1 08:34:10 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<feyn2EpHv0Jniu0S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.159
country_id: 6252001
description:
Jan  1 08:34:31 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.159, lip=66.85.158.92, TLS, session=<lccK2kpHyu2i2Jaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  1 08:36:03 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<EjJr30pHgg6i8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.12.244
country_id: 3144096
description:
2026-01-01 08:38:21 dovecot_login authenticator failed for H=([84.211.12.244]) [84.211.12.244]:40932: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.136
country_id: 6252001
description:
Jan  1 08:38:29 host2 dovecot[2361401]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.136, lip=66.85.158.91, TLS: Connection closed, session=<0rM76EpH2FJChJmI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.194.94
country_id: 1733045
description:
2026-01-01 08:38:55 dovecot_login authenticator failed for H=([51.162.194.94]) [51.162.194.94]:54617: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  1 08:39:48 host2 pure-ftpd[2486705]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  1 08:40:39 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<+gTT70pHGJ1nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 08:40:43 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<+DYb8EpH3mIjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.124.202
country_id: 1269750
description:
2026-01-01 08:41:23 dovecot_login authenticator failed for H=([182.95.124.202]) [182.95.124.202]:40530: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.18.99.126
country_id: 1269750
description:
2026-01-01 08:41:35 dovecot_login authenticator failed for H=([125.18.99.126]) [125.18.99.126]:39920: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.182.134.75
country_id: 130758
description:
Jan  1 08:45:18 host2 sshd[2495019]: Disconnected from invalid user deploy 94.182.134.75 port 46488 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  1 08:45:43 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<4Bn3AUtHeMaeRdGr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 105.27.148.94
country_id: 192950
description:
Jan  1 08:45:52 host2 sshd[2496199]: Disconnected from invalid user furukawa 105.27.148.94 port 37966 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2026-01-01 08:46:03 dovecot_login authenticator failed for H=([24.105.248.218]) [24.105.248.218]:42084: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.247.47.169
country_id: 3175395
description:
2026-01-01 08:46:15 dovecot_login authenticator failed for H=host-95-247-47-169.retail.telecomitalia.it [95.247.47.169]:57476: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.161.190.230
country_id: 290291
description:
2026-01-01 08:46:20 dovecot_plain authenticator failed for H=109-161-190-230.rev.bb.zain.com (R27PCKV70FQ2DWX) [109.161.190.230]:35573: 535 Incorrect authentication data (set_id=sanjanap@ksoft.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 105.27.148.94
country_id: 192950
description:
Jan  1 08:46:33 host2 sshd[2497790]: Disconnected from invalid user ubuntu 105.27.148.94 port 52002 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.182.132.154
country_id: 1269750
description:
Jan  1 08:46:58 host2 sshd[2498487]: Disconnected from invalid user ubuntu 103.182.132.154 port 44236 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.182.132.154
country_id: 1269750
description:
Jan  1 08:48:11 host2 sshd[2500298]: Disconnected from invalid user ubuntu 103.182.132.154 port 54160 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  1 08:47:15 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<YwxuB0tHeuho7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  1 08:47:24 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<rrQBCEtHOu6i8GQy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  1 08:47:45 host2 sshd[2499749]: Disconnected from invalid user admin 2.57.121.112 port 36391 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 105.27.148.94
country_id: 192950
description:
Jan  1 08:48:31 host2 sshd[2500624]: Disconnected from invalid user ismail 105.27.148.94 port 37672 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 08:49:13 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<Kdh9DktHPtsv/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2026-01-01 08:49:53 dovecot_plain authenticator failed for H=c-71-235-225-181.hsd1.ct.comcast.net (phyng) [71.235.225.181]:52002: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.182.132.154
country_id: 1269750
description:
Jan  1 08:51:05 host2 sshd[2503249]: Disconnected from invalid user mine 103.182.132.154 port 43918 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.182.134.75
country_id: 130758
description:
Jan  1 08:51:26 host2 sshd[2503526]: Disconnected from invalid user bitrix 94.182.134.75 port 59460 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  1 08:52:30 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<y4VCGktH3rVn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Jan  1 08:55:56 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<IZ15JktHdIyYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 08:57:12 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<GJIPK0tHDtGeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  1 09:00:59 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<gXKUOEtH8IMvWBNS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.237.173.220
country_id: 6252001
description:
Jan  1 09:01:11 host2 dovecot[2361401]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.237.173.220, lip=66.85.158.92, TLS, session=<arNqOUtHMNgD7a3c>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  1 09:03:22 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<wmoSQUtH5Zt100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  1 09:05:19 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<zTQKSEtH+KxCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  1 09:05:24 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<wzhbSEtHJr2eRdGr>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.219.237.102
country_id: 6252001
description:
Jan  1 09:08:35 host2 pure-ftpd[2520765]: (?@104.219.237.102) [INFO] New connection from 104.219.237.102


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.182.187
country_id: 6252001
description:
Jan  1 09:09:46 host2 dovecot[2361401]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=165.154.182.187, lip=66.85.158.92, TLS, session=<MuYXWEtHKOelmra7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2026-01-01 09:09:13 dovecot_plain authenticator failed for H=c-174-161-27-82.hsd1.tn.comcast.net (bedroess) [174.161.27.82]:40293: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.182.187
country_id: 6252001
description:
Jan  1 09:10:14 host2 dovecot[2361401]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=165.154.182.187, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<zWbFWUtHiKqlmra7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 09:10:26 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<8aBeWktH1Osv/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.142.126.37
country_id: 6252001
description:
2026-01-01 09:10:57 dovecot_plain authenticator failed for H=c-69-142-126-37.hsd1.nj.comcast.net (dermok) [69.142.126.37]:57938: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.248.8.33
country_id: 192950
description:
Jan  1 09:11:32 host2 sshd[2523749]: Disconnected from invalid user ubuntu 197.248.8.33 port 39298 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.248.8.33
country_id: 192950
description:
Jan  1 09:13:07 host2 sshd[2525514]: Disconnected from invalid user user1 197.248.8.33 port 39124 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.171.230.200
country_id: 6252001
description:
2026-01-01 09:12:20 dovecot_plain authenticator failed for H=c-73-171-230-200.hsd1.fl.comcast.net (merfia) [73.171.230.200]:55011: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  1 09:15:44 host2 sshd[2528335]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.46.148.180
country_id: 6252001
description:
2026-01-01 09:16:03 dovecot_plain authenticator failed for H=c-68-46-148-180.hsd1.mi.comcast.net (parad) [68.46.148.180]:41712: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.194
country_id: 99237
description:
2026-01-01 09:15:28 dovecot_plain authenticator failed for H=(bebrandor) [65.20.148.194]:44938: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2026-01-01 09:15:31 dovecot_plain authenticator failed for H=c-24-1-200-187.hsd1.il.comcast.net (faldentig) [24.1.200.187]:43702: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 09:15:32 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<s6mbbEtHANWeRdY+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.248.8.33
country_id: 192950
description:
Jan  1 09:16:39 host2 sshd[2529247]: Disconnected from invalid user ubuntu 197.248.8.33 port 52778 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Jan  1 09:17:28 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.91, TLS: Connection closed, session=<RMShc0tHytWLonHU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  1 09:20:00 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<GWuNfEtHzMMFhXlo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.248.8.33
country_id: 192950
description:
Jan  1 09:20:11 host2 sshd[2533015]: Disconnected from invalid user sammy 197.248.8.33 port 38194 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  1 09:21:36 host2 sshd[2533962]: Disconnected from invalid user admin 2.57.121.112 port 28865 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.68.64.63
country_id: 2921044
description:
Jan  1 09:22:25 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=138.68.64.63, lip=66.85.158.91, session=<3sxWhUtHRyGKREA/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.248.36
country_id: 2921044
description:
Jan  1 09:22:25 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=46.101.248.36, lip=66.85.158.91, session=<avBbhUtHQnQuZfgk>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.205.128
country_id: 1880251
description:
Jan  1 09:24:25 host2 sshd[2537064]: Disconnected from invalid user ubuntu 165.154.205.128 port 43796 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 09:25:43 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<t/QKkUtHgtEjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.168.194.41
country_id: 1269750
description:
Jan  1 09:25:49 host2 sshd[2538506]: Disconnected from invalid user minecraft1 122.168.194.41 port 46038 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.168.194.41
country_id: 1269750
description:
Jan  1 09:26:30 host2 sshd[2539101]: Disconnected from invalid user engineering 122.168.194.41 port 46876 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  1 09:27:01 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<HzWrlUtH6yFniu0S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.9
country_id: 798549
description:
Jan  1 09:27:09 host2 dovecot[2361401]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=85.217.140.9, lip=66.85.158.92, TLS: Connection closed, session=<rstBlktHotlV2YwJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.9
country_id: 798549
description:
Jan  1 09:27:12 host2 dovecot[2361401]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=85.217.140.9, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<6iR3lktH7s5V2YwJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.248.8.33
country_id: 192950
description:
Jan  1 09:28:15 host2 sshd[2541010]: Disconnected from invalid user admin 197.248.8.33 port 51300 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 09:28:16 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<1nwrmktH7qQzTcpt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.205.128
country_id: 1880251
description:
Jan  1 09:28:56 host2 sshd[2541705]: Disconnected from invalid user admin 165.154.205.128 port 48422 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.25.210
country_id: 3923057
description:
Jan  1 09:31:14 host2 sshd[2544098]: Disconnected from invalid user user123 190.181.25.210 port 44859 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2026-01-01 09:31:42 dovecot_plain authenticator failed for H=c-73-213-237-28.hsd1.va.comcast.net (sorace) [73.213.237.28]:38742: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.7
country_id: 798549
description:
Jan  1 09:32:03 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=85.217.140.7, lip=66.85.158.92, session=<4U7Fp0tHTI5V2YwH>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.205.128
country_id: 1880251
description:
Jan  1 09:32:14 host2 sshd[2545125]: Disconnected from invalid user user1 165.154.205.128 port 55612 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 85.217.140.11
country_id: 798549
description:
Jan  1 09:33:19 host2 pure-ftpd[2546269]: (?@85.217.140.11) [INFO] New connection from 85.217.140.11


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 85.217.140.11
country_id: 798549
description:
Jan  1 09:33:25 host2 pure-ftpd[2546350]: (?@85.217.140.11) [INFO] New connection from 85.217.140.11


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 09:33:26 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<mbOkrEtHTLgzTcpt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.117
country_id: 6252001
description:
Jan  1 09:33:36 host2 dovecot[2361401]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=66.132.153.117, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<wZVdrUtH2hlChJl1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  1 09:35:28 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<1x/ks0tH8Cyi8Jp9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.25.210
country_id: 3923057
description:
Jan  1 09:37:31 host2 sshd[2550001]: Disconnected from invalid user ftpuser 190.181.25.210 port 43048 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.171.152.102
country_id: 783754
description:
Jan  1 09:38:55 host2 dovecot[2361401]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=31.171.152.102, lip=66.85.158.91, session=<Ie5cwEtHROAfq5hm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.133.46.26
country_id: 130758
description:
Jan  1 09:38:56 host2 dovecot[2361401]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=62.133.46.26, lip=66.85.158.91, TLS, session=<BA5kwEtHwOU+hS4a>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.25.210
country_id: 3923057
description:
Jan  1 09:39:12 host2 sshd[2551781]: Disconnected from invalid user elasticsearch 190.181.25.210 port 56715 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 217.182.64.115
country_id: 3017382
description:
Jan  1 09:38:49 host2 sshd[2551329]: Disconnected from invalid user auditor 217.182.64.115 port 56038 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.133.193.28
country_id: 2629691
description:
Jan  1 09:38:55 host2 dovecot[2361401]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=45.133.193.28, lip=66.85.158.91, session=<Hm9ZwEtHWuAthcEc>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.253.160.137
country_id: 174982
description:
Jan  1 09:38:51 host2 pure-ftpd[2551356]: (?@185.253.160.137) [INFO] New connection from 185.253.160.137


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 154.47.23.3
country_id: 1861060
description:
Jan  1 09:38:54 host2 dovecot[2361401]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=154.47.23.3, lip=66.85.158.91, session=<sZ1DwEtHTOCaLxcD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.239.194.65
country_id: 2077456
description:
Jan  1 09:38:56 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=173.239.194.65, lip=66.85.158.91, TLS, session=<FQNmwEtHlOqt78JB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.241.80.134
country_id: 1814991
description:
Jan  1 09:38:56 host2 dovecot[2361401]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=188.241.80.134, lip=66.85.158.91, TLS handshaking: Connection closed, session=<znpjwEtHvuW88VCG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 181.214.218.191
country_id: 2802361
description:
Jan  1 09:38:54 host2 dovecot[2361401]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=181.214.218.191, lip=66.85.158.91, session=<SWJHwEtHQOC11tq/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.234.138
country_id: 289688
description:
Jan  1 09:38:56 host2 dovecot[2361401]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=95.181.234.138, lip=66.85.158.91, TLS handshaking: Connection closed, session=<FMJlwEtHjOpfteqK>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 173.244.33.12
country_id: 1282988
description:
Jan  1 09:39:07 host2 pure-ftpd[2551728]: (?@173.244.33.12) [INFO] New connection from 173.244.33.12


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  1 09:40:12 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<rEzKxEtHNNEyBsPO>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.181.25.210
country_id: 3923057
description:
Jan  1 09:40:49 host2 sshd[2553632]: Disconnected from invalid user guest 190.181.25.210 port 42146 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 09:41:42 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<UqUvyktHlMwjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  1 09:41:45 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<QeNgyktHQK9nmud6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.131.195
country_id: 1819730
description:
Jan  1 09:42:56 host2 sshd[2555508]: Disconnected from invalid user airflow 152.32.131.195 port 55718 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.131.195
country_id: 1819730
description:
Jan  1 09:42:16 host2 sshd[2554979]: Disconnected from invalid user it 152.32.131.195 port 41986 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  1 09:42:42 host2 pure-ftpd[2555322]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.102.116.25
country_id: 6252001
description:
Jan  1 09:42:46 host2 sshd[2555379]: Disconnected from invalid user developer 20.102.116.25 port 38158 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.102.116.25
country_id: 6252001
description:
Jan  1 09:43:44 host2 sshd[2556294]: Disconnected from invalid user ftp_user 20.102.116.25 port 38090 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  1 09:44:00 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<k7xo0ktHFLyi8GQy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.131.195
country_id: 1819730
description:
Jan  1 09:44:15 host2 sshd[2556739]: Disconnected from invalid user django 152.32.131.195 port 54950 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.6.19.231
country_id: 3625428
description:
Jan  1 09:45:03 host2 sshd[2557926]: Disconnected from invalid user airflow 190.6.19.231 port 13696 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 217.182.64.115
country_id: 3017382
description:
Jan  1 09:45:31 host2 sshd[2558867]: Disconnected from invalid user ftp_user 217.182.64.115 port 38456 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 217.182.64.115
country_id: 3017382
description:
Jan  1 09:46:55 host2 sshd[2560293]: Disconnected from invalid user odoo17 217.182.64.115 port 45392 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.102.116.25
country_id: 6252001
description:
Jan  1 09:47:17 host2 sshd[2560643]: Disconnected from invalid user alex 20.102.116.25 port 35714 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 217.182.64.115
country_id: 3017382
description:
Jan  1 09:47:54 host2 sshd[2561203]: Received disconnect from 217.182.64.115 port 57942:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 217.182.64.115
country_id: 3017382
description:
Jan  1 09:48:23 host2 sshd[2561916]: Disconnected from invalid user west 217.182.64.115 port 47770 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  1 09:50:03 host2 sshd[2563671]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  1 09:49:14 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<2Sch5UtH3stn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 09:52:30 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<3mfL8EtHFqcv/AU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.115
country_id: 2635167
description:
Jan  1 09:52:54 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 45 secs): user=<>, rip=35.203.211.115, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<qh5i8ktHDsYjy9Nz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.115
country_id: 2635167
description:
Jan  1 09:53:24 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=35.203.211.115, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<xFQk9EtHQPYjy9Nz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 14.195.83.210
country_id: 1269750
description:
Jan  1 09:55:17 host2 sshd[2568789]: Disconnected from invalid user ftpuser 14.195.83.210 port 3770 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.151.151.79
country_id: 130758
description:
Jan  1 09:55:38 host2 sshd[2569093]: Disconnected from invalid user jacob 193.151.151.79 port 53382 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 09:56:03 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<xw+C/UtHluCeRdY+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 193.151.151.79
country_id: 130758
description:
Jan  1 09:56:34 host2 sshd[2569918]: Disconnected from invalid user proxyuser 193.151.151.79 port 59746 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.151.151.79
country_id: 130758
description:
Jan  1 09:57:25 host2 sshd[2570774]: Disconnected from invalid user dong 193.151.151.79 port 50282 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.80.35.45
country_id: 192950
description:
Jan  1 09:58:23 host2 sshd[2571814]: Disconnected from invalid user ftpuser 41.80.35.45 port 46800 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  1 09:59:57 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<B8ZtC0xHOc5100Db>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.80.35.45
country_id: 192950
description:
Jan  1 10:00:04 host2 sshd[2573610]: Disconnected from invalid user dmdba 41.80.35.45 port 42396 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 14.195.83.210
country_id: 1269750
description:
Jan  1 09:59:25 host2 sshd[2572846]: Disconnected from invalid user practicas 14.195.83.210 port 55270 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.115
country_id: 2635167
description:
Jan  1 10:00:20 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.115, lip=66.85.158.91, TLS, session=<CwT0DExHiPMjy9Nz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  1 10:00:53 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<aE7PDkxHagxo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-01 10:09:52 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:53527: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 10:13:43 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<vj+0PExHwKwv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 10:14:38 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<I3P4P0xHlMieRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  1 10:17:53 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<ZzyVS0xHVNRCdMzo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.190.155.43
country_id: 6252001
description:
2026-01-01 10:19:04 dovecot_plain authenticator failed for H=(reption) [76.190.155.43]:41402: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  1 10:20:41 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<lwWTVUxHsE1niu0S>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.159.14.187
country_id: 3469034
description:
2026-01-01 10:24:13 dovecot_login authenticator failed for H=(200-168-190-81.jandaia.com) [200.159.14.187]:53489: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.162.191
country_id: 3144096
description:
2026-01-01 10:24:43 dovecot_login authenticator failed for H=(cm-178.232.162.191.get.no) [178.232.162.191]:55206: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  1 10:26:58 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<blgQbExHjJcvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 10:27:18 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<+zA9bUxHsDcjupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.244
country_id: 6252001
description:
Jan  1 10:32:51 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 3 secs): user=<>, rip=205.210.31.244, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<e6Y5gUxHDs/N0h/0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.32.138
country_id: 953987
description:
Jan  1 10:34:33 host2 dovecot[2551472]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=102.64.32.138, lip=66.85.158.91, TLS, session=<zMHyhUxHjOlmQCCK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.212.245
country_id: 99237
description:
Jan  1 10:34:51 host2 dovecot[2551472]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=65.20.212.245, lip=66.85.158.91, TLS, session=<HqJmh0xHYI9BFNT1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  1 10:35:25 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<gQJNikxHInai8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Jan  1 10:37:21 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<7l86kUxHbIKYNcU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  1 10:40:01 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<MdXXmkxHTOYDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  1 10:41:17 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<Qjcsn0xHpOKi8GQy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  1 10:41:42 host2 dovecot[2551472]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<GPPnoExHRJoDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  1 10:42:20 host2 dovecot[2551472]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<h74lo0xH1qADjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  1 10:42:36 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<7vvzo0xHjLGeRdGr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  1 10:43:33 host2 dovecot[2551472]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<3Nl+p0xH5JEDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 10:43:36 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<ZBOLp0xHOOAjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  1 10:43:27 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<Rcz4pkxHvoxnmud6>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.178.224.92
country_id: 1880251
description:
Jan  1 10:44:22 host2 pure-ftpd[2620895]: (?@158.178.224.92) [INFO] New connection from 158.178.224.92


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 10:44:22 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<VpBLqkxHzMczTcpt>


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 158.178.224.92
country_id: 1880251
description:
Jan  1 10:44:28 host2 pure-ftpd[2620976]: (?@158.178.224.92) [INFO] New connection from 158.178.224.92


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  1 10:45:02 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<JxjLrExHMK4DjyE/>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  1 10:45:08 host2 dovecot[2551472]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<l+EsrUxHUsQDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.80.146.46
country_id: 3469034
description:
2026-01-01 10:45:44 dovecot_login authenticator failed for H=(18980204017.user.veloxzone.com.br) [189.80.146.46]:59260: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  1 10:45:44 host2 pure-ftpd[2622539]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.178.224.92
country_id: 1880251
description:
Jan  1 10:45:15 host2 pure-ftpd[2621998]: (?@158.178.224.92) [INFO] New connection from 158.178.224.92


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 158.178.224.92
country_id: 1880251
description:
Jan  1 10:45:18 host2 pure-ftpd[2622112]: (?@158.178.224.92) [INFO] New connection from 158.178.224.92


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  1 10:45:48 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<KBZZr0xHmpEFhXlo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.159.180
country_id: 1269750
description:
Jan  1 10:46:07 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=152.32.159.180, lip=66.85.158.92, TLS, session=<7VWmsExHMJWYIJ+0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.152.225.154
country_id: 6251999
description:
2026-01-01 10:46:08 dovecot_login authenticator failed for H=s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:53797: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  1 10:47:09 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<6i47tExHxORn9M4G>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  1 10:47:13 host2 dovecot[2551472]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<LGeXtExHKOkDjyE/>


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 158.178.224.92
country_id: 1880251
description:
Jan  1 10:46:12 host2 pure-ftpd[2623050]: (?@158.178.224.92) [INFO] New connection from 158.178.224.92


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.178.224.92
country_id: 1880251
description:
Jan  1 10:46:13 host2 pure-ftpd[2623067]: (?@158.178.224.92) [INFO] New connection from 158.178.224.92


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.159.180
country_id: 1269750
description:
Jan  1 10:46:17 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=152.32.159.180, lip=66.85.158.92, TLS handshaking: Connection closed, session=<7PVKsUxHRJWYIJ+0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  1 10:46:42 host2 dovecot[2551472]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<0JnKskxHkrcDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.159.180
country_id: 1269750
description:
Jan  1 10:48:04 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=152.32.159.180, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<hLert0xHDo6YIJ+0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.159.180
country_id: 1269750
description:
Jan  1 10:48:15 host2 dovecot[2551472]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=152.32.159.180, lip=66.85.158.91, TLS, session=<UCFUuExHjsGYIJ+0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  1 10:48:24 host2 dovecot[2551472]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<T9/UuExHVuYDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 10:49:45 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<JACIvUxHrJMzTcpt>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 93.174.95.106
country_id: 2750405
description:
Jan  1 10:54:09 host2 dovecot[2551472]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 3 secs): user=<>, rip=93.174.95.106, lip=66.85.158.91, session=<4dtizUxHzr1drl9q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 93.174.95.106
country_id: 2750405
description:
Jan  1 10:54:18 host2 dovecot[2551472]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=93.174.95.106, lip=66.85.158.91, session=<A83xzUxHvORdrl9q>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.6.19.231
country_id: 3625428
description:
Jan  1 10:55:08 host2 sshd[2632496]: Disconnected from invalid user test1 190.6.19.231 port 35385 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 10:56:25 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<tqRl1UxHGoKeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 10:56:25 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<2Oxk1UxHPtUv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  1 10:57:55 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<SJu/2kxH8dl100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  1 11:02:41 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<l8y960xH0tWeRdGr>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  1 11:04:06 host2 sshd[2641354]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  1 11:05:04 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<hwFP9ExHCNMyBsPO>


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 158.178.229.240
country_id: 1880251
description:
Jan  1 11:05:20 host2 pure-ftpd[2642592]: (?@158.178.229.240) [INFO] New connection from 158.178.229.240


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.178.229.240
country_id: 1880251
description:
Jan  1 11:05:15 host2 pure-ftpd[2642485]: (?@158.178.229.240) [INFO] New connection from 158.178.229.240


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.178.229.240
country_id: 1880251
description:
Jan  1 11:06:13 host2 pure-ftpd[2643455]: (?@158.178.229.240) [INFO] New connection from 158.178.229.240


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 158.178.229.240
country_id: 1880251
description:
Jan  1 11:06:12 host2 pure-ftpd[2643441]: (?@158.178.229.240) [INFO] New connection from 158.178.229.240


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 161.118.206.181
country_id: 1880251
description:
Jan  1 11:08:42 host2 pure-ftpd[2645675]: (?@161.118.206.181) [INFO] New connection from 161.118.206.181


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 161.118.206.181
country_id: 1880251
description:
Jan  1 11:08:47 host2 pure-ftpd[2645779]: (?@161.118.206.181) [INFO] New connection from 161.118.206.181


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 161.118.206.181
country_id: 1880251
description:
Jan  1 11:09:14 host2 pure-ftpd[2646220]: (?@161.118.206.181) [INFO] New connection from 161.118.206.181


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 161.118.206.181
country_id: 1880251
description:
Jan  1 11:09:17 host2 pure-ftpd[2646310]: (?@161.118.206.181) [INFO] New connection from 161.118.206.181


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  1 11:15:06 host2 sshd[2652495]: Disconnected from invalid user user 2.57.121.25 port 40212 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 11:15:31 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<AYu0GU1H9qeeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  1 11:16:00 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<GxRmG01HMw1niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  1 11:16:13 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<qRYyHE1Hlj9o7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 11:17:53 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<FtosIk1H4NMv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 11:30:17 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<a4VqTk1HvLMjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  1 11:32:40 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<u9UEV01HptRCdMzo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.247.80.227
country_id: 1269750
description:
2026-01-01 11:33:53 dovecot_login authenticator failed for H=([47.247.80.227]) [47.247.80.227]:45292: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.118.12
country_id: 3865483
description:
2026-01-01 11:34:32 dovecot_login authenticator failed for H=([167.250.118.12]) [167.250.118.12]:39123: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  1 11:36:17 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<HLT6Y01H+n+i8Jp9>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  1 11:38:25 host2 sshd[2676428]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  1 11:40:11 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<7EfocU1HGsSi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.170.1
country_id: 3175395
description:
Jan  1 11:45:13 host2 dovecot[2551472]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=185.15.170.1, lip=66.85.158.91, TLS, session=<OfALg01HKq65D6oB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.255.0.22
country_id: 3469034
description:
Jan  1 11:45:35 host2 dovecot[2551472]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<charanaw>, method=PLAIN, rip=143.255.0.22, lip=66.85.158.91, TLS, session=<uQwrhE1HoNSP/wAW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  1 11:46:01 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<zHLLhk1HPLFn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  1 11:46:26 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<BTBEiE1HEtVnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 11:46:58 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<72sxik1H3DIjupN+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  1 11:48:55 host2 pure-ftpd[2688445]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.197.145.10
country_id: 1819730
description:
Jan  1 11:48:58 host2 sshd[2688484]: Disconnected from invalid user logger 45.197.145.10 port 45496 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.0.247.94
country_id: 3686110
description:
Jan  1 11:48:53 host2 sshd[2688421]: Disconnected from invalid user theo 190.0.247.94 port 42680 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.172.76.147
country_id: 6252001
description:
Jan  1 11:49:31 host2 dovecot[2551472]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=54.172.76.147, lip=66.85.158.91, session=<1N9sk01H6pY2rEyT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.72.147.99
country_id: 1880251
description:
Jan  1 11:50:22 host2 sshd[2690120]: Disconnected from invalid user server 103.72.147.99 port 33628 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.1.120
country_id: 1643084
description:
Jan  1 11:50:27 host2 sshd[2690123]: Disconnected from invalid user alpha 103.186.1.120 port 58310 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.0.247.94
country_id: 3686110
description:
Jan  1 11:50:31 host2 sshd[2690292]: Disconnected from invalid user banco 190.0.247.94 port 50850 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.197.145.10
country_id: 1819730
description:
Jan  1 11:51:07 host2 sshd[2690913]: Disconnected from invalid user vpn 45.197.145.10 port 44612 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.0.247.94
country_id: 3686110
description:
Jan  1 11:51:10 host2 sshd[2690941]: Disconnected from invalid user oracle 190.0.247.94 port 59796 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.197.145.10
country_id: 1819730
description:
Jan  1 11:53:04 host2 sshd[2692794]: Disconnected from invalid user csczserver 45.197.145.10 port 51554 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.0.247.94
country_id: 3686110
description:
Jan  1 11:52:20 host2 sshd[2692067]: Disconnected from invalid user patrick 190.0.247.94 port 35246 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.197.145.10
country_id: 1819730
description:
Jan  1 11:52:28 host2 sshd[2692181]: Disconnected from invalid user mythtv 45.197.145.10 port 39832 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.14.78.26
country_id: 6252001
description:
Jan  1 11:53:50 host2 dovecot[2551472]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.14.78.26, lip=66.85.158.91, session=<Trfgok1H5LQUDk4a>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.72.147.99
country_id: 1880251
description:
Jan  1 11:54:22 host2 sshd[2695021]: Disconnected from invalid user uploader 103.72.147.99 port 40842 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.72.147.99
country_id: 1880251
description:
Jan  1 11:54:57 host2 sshd[2695780]: Disconnected from invalid user shiny 103.72.147.99 port 59946 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2026-01-01 11:54:59 dovecot_plain authenticator failed for H=(clous) [65.20.133.208]:44835: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  1 11:55:59 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<7iZlqk1HzK4vWBNS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.94.37.113
country_id: 6252001
description:
Jan  1 11:56:40 host2 sshd[2698265]: Disconnected from invalid user squid 23.94.37.113 port 59468 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.186.1.120
country_id: 1643084
description:
Jan  1 11:56:54 host2 sshd[2698468]: Disconnected from invalid user db2das1 103.186.1.120 port 57634 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  1 11:57:03 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<+Zg7rk1HN+h100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 11:57:44 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<vXirsE1HboeeRdY+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.94.37.113
country_id: 6252001
description:
Jan  1 12:00:39 host2 sshd[2703354]: Disconnected from invalid user monica 23.94.37.113 port 47366 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 12:01:09 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<4R7ivE1HbpIv/AU1>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 23.94.37.113
country_id: 6252001
description:
Jan  1 12:01:45 host2 sshd[2704379]: Disconnected from invalid user ramon 23.94.37.113 port 42764 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 12:01:16 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<fmtNvU1H2MQzTcpt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.94.37.113
country_id: 6252001
description:
Jan  1 12:02:16 host2 sshd[2704886]: Disconnected from invalid user mmk 23.94.37.113 port 54582 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 12:06:37 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<mOl40E1HlL0zTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.23.140
country_id: 3144096
description:
2026-01-01 12:08:01 dovecot_login authenticator failed for H=(cm-178.232.23.140.get.no) [178.232.23.140]:53514: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.115.237.19
country_id: 3923057
description:
2026-01-01 12:09:41 dovecot_login authenticator failed for H=([181.115.237.19]) [181.115.237.19]:55322: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.166
country_id: 1269750
description:
2026-01-01 12:10:00 dovecot_login authenticator failed for H=([125.19.173.189]) [182.95.181.166]:58020: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.27.101.99
country_id: 2635167
description:
Jan  1 12:11:09 host2 sshd[2715325]: Disconnected from invalid user fernando 92.27.101.99 port 55778 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  1 12:11:36 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<rJdC4k1H+Ddniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.27.101.99
country_id: 2635167
description:
Jan  1 12:13:39 host2 sshd[2718597]: Disconnected from invalid user kim 92.27.101.99 port 49432 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  1 12:14:46 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<1Q6P7U1HYo4FhXlo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2026-01-01 12:15:48 dovecot_plain authenticator failed for H=c-24-1-200-187.hsd1.il.comcast.net (verate) [24.1.200.187]:42122: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 12:17:11 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<Pzwv9k1HauOeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 12:23:04 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<y11FC05HVKAv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Jan  1 12:24:46 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<Dr5WEU5HlMOYNcU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.237.173.220
country_id: 6252001
description:
Jan  1 12:28:30 host2 dovecot[2551472]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.237.173.220, lip=66.85.158.92, session=<IVjUHk5HCp8D7a3c>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.223.57.188
country_id: 1880251
description:
[2026-01-01 12:29:04 +0530] info [cpaneld] 159.223.57.188 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  1 12:32:47 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<LS4KLk5HgL4yBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  1 12:33:34 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<N6nIME5HcsVo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 12:34:41 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<d7nQNE5HXsQjupN+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.153.249.99
country_id: 3895114
description:
Jan  1 12:38:09 host2 sshd[2744589]: Disconnected from invalid user bitrix 190.153.249.99 port 36419 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  1 12:38:25 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<EkQhQk5H7CWi8Jp9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.153.249.99
country_id: 3895114
description:
Jan  1 12:38:44 host2 sshd[2745145]: Disconnected from invalid user barbara 190.153.249.99 port 42173 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.23.122.235
country_id: 895949
description:
Jan  1 12:39:39 host2 sshd[2746073]: Disconnected from invalid user es 102.23.122.235 port 6778 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  1 12:40:29 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<LweQSU5H8Jei8GQy>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 173.239.205.11
country_id: 3595528
description:
Jan  1 12:40:56 host2 pure-ftpd[2747378]: (?@173.239.205.11) [INFO] New connection from 173.239.205.11


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.133.193.25
country_id: 2629691
description:
Jan  1 12:40:59 host2 dovecot[2551472]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=45.133.193.25, lip=66.85.158.91, session=<wSd6S05HKLsthcEZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.239.220.30
country_id: 3658394
description:
Jan  1 12:40:59 host2 dovecot[2551472]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=173.239.220.30, lip=66.85.158.91, session=<qDp3S05HNrut79we>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.133.193.29
country_id: 2629691
description:
Jan  1 12:41:02 host2 dovecot[2551472]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=45.133.193.29, lip=66.85.158.91, session=<QfitS05HWNgthcEd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 203.188.183.59
country_id: 3017382
description:
Jan  1 12:41:04 host2 dovecot[2551472]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=203.188.183.59, lip=66.85.158.91, TLS handshaking: Connection closed, session=<6IXFS05Hwu3LvLc7>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.23.122.235
country_id: 895949
description:
Jan  1 12:41:13 host2 sshd[2747682]: Disconnected from invalid user barbara 102.23.122.235 port 6780 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.240
country_id: 6252001
description:
Jan  1 12:43:03 host2 dovecot[2747808]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.240, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<r8ngUk5HrtnG6xjw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.248.111.238
country_id: 6252001
description:
2026-01-01 12:43:08 dovecot_plain authenticator failed for H=(vientiss) [38.248.111.238]:34624: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  1 12:44:04 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<zd9fVk5HyqKeRdGr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.104.235
country_id: 6252001
description:
Jan  1 12:44:46 host2 dovecot[2747808]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.64.104.235, lip=66.85.158.92, session=<kxcGWU5HYMgUQGjr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  1 12:46:11 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<oiXwXU5HkI5n9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  1 12:47:41 host2 sshd[2754587]: Disconnected from invalid user user 2.57.121.25 port 45721 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.159
country_id: 3144096
description:
2026-01-01 12:49:03 dovecot_login authenticator failed for H=(159-161-97-62.cust.smartcall.no) [62.97.161.159]:36701: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.63.103
country_id: 3144096
description:
2026-01-01 12:48:29 dovecot_login authenticator failed for H=(cm-84.215.63.103.get.no) [84.215.63.103]:51010: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  1 12:48:48 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<F3tKZ05HHqhCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  1 12:50:11 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<kuY+bE5HXq1nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 12:51:39 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<cVKFcU5HQjgjupN+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  1 12:51:56 host2 pure-ftpd[2758805]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  1 12:52:23 host2 sshd[2759201]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.119.50
country_id: 1819730
description:
Jan  1 12:55:13 host2 sshd[2762320]: Disconnected from invalid user jeff 101.36.119.50 port 45872 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.255.158.241
country_id: 1643084
description:
2026-01-01 12:55:45 dovecot_login authenticator failed for H=([101.255.158.242]) [101.255.158.241]:59576: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.143.205
country_id: 1880251
description:
Jan  1 12:55:51 host2 sshd[2763021]: Disconnected from invalid user jeff 101.47.143.205 port 32844 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.226.163
country_id: 3144096
description:
2026-01-01 12:56:00 dovecot_login authenticator failed for H=(cm-178.232.226.163.get.no) [178.232.226.163]:50220: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.88.55.220
country_id: 6252001
description:
Jan  1 12:55:45 host2 sshd[2762923]: Disconnected from invalid user andrey 20.88.55.220 port 52364 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 44.220.185.166
country_id: 6252001
description:
Jan  1 12:56:24 host2 pure-ftpd[2763588]: (?@44.220.185.166) [INFO] New connection from 44.220.185.166


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  1 12:57:39 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<q533hk5HpeF100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.88.55.220
country_id: 6252001
description:
Jan  1 12:58:10 host2 sshd[2765443]: Disconnected from invalid user openproject 20.88.55.220 port 52830 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.209.224
country_id: 1819730
description:
Jan  1 12:58:33 host2 sshd[2765814]: Disconnected from invalid user xerox 123.58.209.224 port 59106 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.88.55.220
country_id: 6252001
description:
Jan  1 12:58:44 host2 sshd[2766042]: Disconnected from invalid user financeiro 20.88.55.220 port 52884 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.119.50
country_id: 1819730
description:
Jan  1 13:00:16 host2 sshd[2767867]: Disconnected from invalid user webadm 101.36.119.50 port 48068 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.88.55.220
country_id: 6252001
description:
Jan  1 12:59:18 host2 sshd[2766795]: Disconnected from invalid user yckim 20.88.55.220 port 52934 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.119.50
country_id: 1819730
description:
Jan  1 12:59:36 host2 sshd[2767043]: Disconnected from invalid user gmodserver1 101.36.119.50 port 57266 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 13:00:00 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<7Ddbj05HkNyeRdY+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.209.224
country_id: 1819730
description:
Jan  1 13:00:38 host2 sshd[2768259]: Disconnected from invalid user bamboo 123.58.209.224 port 57074 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2026-01-01 13:04:04 dovecot_plain authenticator failed for H=(prelous) [154.146.240.123]:46634: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.143.205
country_id: 1880251
description:
Jan  1 13:04:32 host2 sshd[2772087]: Disconnected from invalid user yckim 101.47.143.205 port 43984 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  1 13:04:52 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<0wW/oE5HZLWeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 13:06:47 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<8WGhp05H0Lcv/AU1>


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 158.178.229.240
country_id: 1880251
description:
Jan  1 13:07:37 host2 pure-ftpd[2775344]: (?@158.178.229.240) [INFO] New connection from 158.178.229.240


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.178.229.240
country_id: 1880251
description:
Jan  1 13:07:32 host2 pure-ftpd[2775264]: (?@158.178.229.240) [INFO] New connection from 158.178.229.240


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.178.229.240
country_id: 1880251
description:
Jan  1 13:08:18 host2 pure-ftpd[2776043]: (?@158.178.229.240) [INFO] New connection from 158.178.229.240


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 158.178.229.240
country_id: 1880251
description:
Jan  1 13:08:20 host2 pure-ftpd[2776065]: (?@158.178.229.240) [INFO] New connection from 158.178.229.240


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  1 13:08:25 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<atVvrU5HKxlniu0S>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.142.85.109
country_id: 2542007
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 41.142.85.109 - info@cloudtourssrilanka.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 41.142.85.109
country_id: 2542007
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 41.142.85.109 - travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user travel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.142.85.109
country_id: 2542007
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 41.142.85.109 - cloudtourssrilan "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  1 13:17:06 host2 dovecot[2747808]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<MoWlzE5HAOoDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 13:19:03 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<J/J9005HUKmeRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.139.126.55
country_id: 1643084
description:
2026-01-01 13:18:19 dovecot_plain authenticator failed for H=(6S73LVD8) [110.139.126.55]:54685: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  1 13:18:45 host2 dovecot[2747808]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<rI+P0k5HGIkDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 13:19:24 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<x8O21E5H2sYzTcpt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  1 13:20:19 host2 dovecot[2747808]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<zhMr2E5HFpMDjyE/>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 52.25.163.93
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 52.25.163.93 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  1 13:22:33 host2 dovecot[2747808]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<Z00l4E5HptIDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-01 13:24:08 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:52893: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  1 13:23:18 host2 dovecot[2747808]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<RR/K4k5HgIQDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  1 13:24:36 host2 dovecot[2747808]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<2/Vv505H4LEDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 13:24:45 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<X2Lc505Hlq4zTcpt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  1 13:25:52 host2 dovecot[2747808]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<VJb5605HxNYDjyE/>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  1 13:26:42 host2 sshd[2794711]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  1 13:26:17 host2 dovecot[2747808]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<+9t+7U5HRLkDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  1 13:27:04 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<ukwb8E5H5MsvWBNS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  1 13:27:19 host2 dovecot[2747808]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<7wQt8U5HnqYDjyE/>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  1 13:27:40 host2 dovecot[2747808]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<Uitv8k5HnIYDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 13:28:36 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<JSip9U5H9uUv/AU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  1 13:29:30 host2 dovecot[2747808]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<FfX++E5H8rIDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.196.48.232
country_id: 6252001
description:
Jan  1 13:31:09 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=54.196.48.232, lip=66.85.158.91, TLS, session=<DCPj/k5Hrq42xDDo>


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 176.235.182.73
country_id: 298795
description:
Jan  1 13:37:23 host2 sshd[2804990]: Disconnecting authenticating user root 176.235.182.73 port 36171: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 176.235.182.73
country_id: 298795
description:
Jan  1 13:37:23 host2 sshd[2804990]: error: maximum authentication attempts exceeded for root from 176.235.182.73 port 36171 ssh2 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 176.235.182.73
country_id: 298795
description:
Jan  1 13:37:32 host2 sshd[2805155]: error: maximum authentication attempts exceeded for invalid user admin from 176.235.182.73 port 37649 ssh2 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 176.235.182.73
country_id: 298795
description:
Jan  1 13:37:35 host2 sshd[2805210]: Disconnecting invalid user admin 176.235.182.73 port 38059: Too many authentication failures [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  1 13:38:23 host2 sshd[2806018]: Disconnected from invalid user admin 2.57.121.112 port 61611 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 13:38:35 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<HsBSGU9H7M8jupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.182.92
country_id: 6252001
description:
Jan  1 13:38:34 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=165.154.182.92, lip=66.85.158.91, session=<xq1nGU9HLIylmrZc>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 165.154.182.92
country_id: 6252001
description:
Jan  1 13:38:35 host2 dovecot[2747808]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=165.154.182.92, lip=66.85.158.91, session=<zqN7GU9Hko2lmrZc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  1 13:40:41 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<PvjVIE9H5sai8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  1 13:40:49 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<qYJFIU9HFOGi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  1 13:41:32 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<SwXjI09HmukFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  1 13:46:33 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<h17bNU9HKr9n9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.140.97.134
country_id: 2328926
description:
Jan  1 13:51:47 host2 sshd[2819756]: Disconnected from invalid user ivan 102.140.97.134 port 50598 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  1 13:51:55 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<GFYJSU9HnI9o7MS0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.81.244.142
country_id: 1269750
description:
Jan  1 13:53:36 host2 sshd[2821661]: Disconnected from invalid user test 40.81.244.142 port 44832 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.226.138.59
country_id: 1643084
description:
Jan  1 13:53:40 host2 sshd[2821680]: Disconnected from invalid user ftpadmin 103.226.138.59 port 36364 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2026-01-01 13:54:23 dovecot_plain authenticator failed for H=c-24-23-125-83.hsd1.pa.comcast.net (barcifitia) [24.23.125.83]:45486: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  1 13:54:29 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<sEE1Uk9HdKdnmud6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 5.253.59.68
country_id: 2750405
description:
Jan  1 13:55:52 host2 sshd[2824611]: Disconnected from invalid user pippo 5.253.59.68 port 50792 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 13:55:21 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<doNHVU9HZrcjupN+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  1 13:55:23 host2 pure-ftpd[2824117]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.226.138.59
country_id: 1643084
description:
Jan  1 13:55:31 host2 sshd[2824243]: Disconnected from invalid user k8s 103.226.138.59 port 35078 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.81.244.142
country_id: 1269750
description:
Jan  1 13:56:39 host2 sshd[2825346]: Disconnected from invalid user devops 40.81.244.142 port 44308 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.140.97.134
country_id: 2328926
description:
Jan  1 13:57:21 host2 sshd[2826010]: Disconnected from invalid user user01 102.140.97.134 port 57296 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.253.59.68
country_id: 2750405
description:
Jan  1 13:57:24 host2 sshd[2826101]: Disconnected from invalid user lucas 5.253.59.68 port 49762 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.226.138.59
country_id: 1643084
description:
Jan  1 13:58:01 host2 sshd[2826638]: Disconnected from invalid user cyber 103.226.138.59 port 41302 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.226.138.59
country_id: 1643084
description:
Jan  1 13:58:47 host2 sshd[2827306]: Disconnected from invalid user fred 103.226.138.59 port 52794 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  1 13:58:18 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<YczeX09HKpx100Db>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.140.97.134
country_id: 2328926
description:
Jan  1 13:58:29 host2 sshd[2827011]: Disconnected from invalid user devops 102.140.97.134 port 44776 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.8.62
country_id: 2658434
description:
Jan  1 13:59:53 host2 sshd[2828413]: Disconnected from invalid user master 185.196.8.62 port 54278 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  1 14:00:57 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<V4tLaU9HfIUyBsPO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.140.97.134
country_id: 2328926
description:
Jan  1 14:00:40 host2 sshd[2829519]: Disconnected from invalid user vncuser 102.140.97.134 port 60466 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 14:01:18 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<o9GQak9H0IieRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  1 14:05:06 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<IPkseE9HeUZniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  1 14:05:23 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<CccpeU9H7uBCdMzo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.8.62
country_id: 2658434
description:
Jan  1 14:07:22 host2 sshd[2836566]: Disconnected from invalid user omni 185.196.8.62 port 36602 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  1 14:07:54 host2 sshd[2837040]: Disconnected from invalid user user 2.57.121.25 port 38028 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 14:11:51 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<IldSkE9H+uwv/AU1>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.196.8.62
country_id: 2658434
description:
Jan  1 14:12:52 host2 sshd[2842261]: Disconnected from invalid user mark 185.196.8.62 port 60468 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2026-01-01 14:15:40 dovecot_plain authenticator failed for H=c-73-208-81-125.hsd1.in.comcast.net (nospose) [73.208.81.125]:39574: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Jan  1 14:16:35 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<ppYpoU9HFI+YNcU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.8.62
country_id: 2658434
description:
Jan  1 14:18:22 host2 sshd[2848062]: Disconnected from invalid user test 185.196.8.62 port 50668 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 14:20:01 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<iFmKrU9H/KeeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.170
country_id: 3469034
description:
Jan  1 14:21:02 host2 dovecot[2747808]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=190.89.136.170, lip=66.85.158.91, TLS, session=<2wovsE9H6M2+WYiq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.106.133
country_id: 3469034
description:
Jan  1 14:21:24 host2 dovecot[2747808]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=187.120.106.133, lip=66.85.158.91, TLS, session=<qtJ9sU9HVZa7eGqF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.22.123.142
country_id: 2635167
description:
Jan  1 14:26:37 host2 dovecot[2747808]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=165.22.123.142, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=</fVDxU9HaOqlFnuO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 14:32:31 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<hkk42k9HAukv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 14:35:19 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<SGI25E9H9pUzTcpt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.169.105.90
country_id: 6252001
description:
Jan  1 14:39:26 host2 dovecot[2747808]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=20.169.105.90, lip=66.85.158.91, TLS, session=<kwIT809H9IQUqWla>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  1 14:40:57 host2 sshd[2869895]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 14:40:19 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<9fwk9k9HNtczTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  1 14:40:18 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 9 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<7CSm9U9HypKi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 14:41:30 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<7CxS+k9H/OEjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  1 14:43:41 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<IawmAlBHyJ+i8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  1 14:47:11 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<Y4mwDlBHLq1n9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.207.66.154
country_id: 6251999
description:
2026-01-01 14:49:06 dovecot_login authenticator failed for H=host-24-207-66-154.public.eastlink.ca [24.207.66.154]:41624: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.122.247
country_id: 3144096
description:
2026-01-01 14:48:43 dovecot_login authenticator failed for H=(cm-178.232.122.247.get.no) [178.232.122.247]:55744: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  1 14:50:07 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<b1wjGVBHRtWeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.30.133
country_id: 798544
description:
Jan  1 14:50:45 host2 dovecot[2747808]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=178.216.30.133, lip=66.85.158.91, TLS, session=<gUxPGlBHlKCy2B6F>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.183.92.232
country_id: 3469034
description:
Jan  1 14:51:10 host2 dovecot[2747808]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<env_eng>, method=PLAIN, rip=45.183.92.232, lip=66.85.158.91, TLS, session=<PbvCG1BH7JEtt1zo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.115.237.19
country_id: 3923057
description:
2026-01-01 14:53:07 dovecot_login authenticator failed for H=([181.115.237.19]) [181.115.237.19]:57769: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.68
country_id: 2635167
description:
Jan  1 14:52:16 host2 dovecot[2747808]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.68, lip=66.85.158.92, TLS, session=<ehT8IFBH/4pX7LBE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.187.2
country_id: 1269750
description:
2026-01-01 14:53:22 dovecot_login authenticator failed for H=(nsg-corporate-2.187.185.122.airtel.in) [122.185.187.2]:53650: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.61.215
country_id: 953987
description:
Jan  1 14:56:04 host2 dovecot[2747808]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<charanaw>, method=PLAIN, rip=102.129.61.215, lip=66.85.158.91, TLS, session=<WWhgLVBHu7FmgT3X>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.28.190.249
country_id: 2510769
description:
Jan  1 14:55:31 host2 dovecot[2747808]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=139.28.190.249, lip=66.85.158.91, TLS, session=<kx2AK1BHdOyLHL75>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  1 14:55:59 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<vV0lLlBHQNQFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  1 14:57:11 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<cq9zMlBHHOYvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 14:57:42 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<rwVFNFBHlCwjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  1 14:58:25 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<fu/XNlBHntlnmud6>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  1 14:58:33 host2 pure-ftpd[2888951]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  1 15:00:15 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<ReVhPVBHYDJ100Db>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 150.241.116.232
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures [Service]=[whostmgrd] [Local IP Address]=[66.85.158.91] [Local Port]=[2087] [Remote IP Address]=[150.241.116.232] [Remote Port]=[49675] [Authentication Database]=[system] [Username]=[root] (5/5 failures) (blocked until [Thu Jan  1 09:46:07 2026 UTC/Thu Jan  1 15:16:07 2026 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.241.116.232
country_id: 6252001
description:
2026-01-01 15:00:55 dovecot_plain authenticator failed for H=([150.241.116.232]) [150.241.116.232]:49364: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 150.241.116.232
country_id: 6252001
description:
Jan  1 15:01:01 host2 pure-ftpd[2891925]: (?@150.241.116.232) [INFO] New connection from 150.241.116.232


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 150.241.116.232
country_id: 6252001
description:
[2026-01-01 15:01:04 +0530] info [webmaild] 150.241.116.232 - env_eng@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 15:01:25 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<GWiYQVBHJMaeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  1 15:02:53 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=</w/YRlBHwSdniu0S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.238.191.229
country_id: 6252001
description:
Jan  1 15:05:02 host2 dovecot[2747808]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.238.191.229, lip=66.85.158.91, session=<Zh+fTlBHaKwD7r/l>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.121.218.229
country_id: 2542007
description:
2026-01-01 15:08:45 dovecot_plain authenticator failed for H=(R27PCKV70FQ2DWX) [196.121.218.229]:62362: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  1 15:11:27 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<oKN7ZVBH4DRo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  1 15:11:59 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<avZTZ1BHrpKeRdGr>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  1 15:15:18 host2 sshd[2908394]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.234.80.128
country_id: 6252001
description:
Jan  1 15:17:10 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=54.234.80.128, lip=66.85.158.92, TLS, session=<7PcCelBHBrI26lCA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 15:20:23 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<3hhthVBH6uqeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  1 15:24:34 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<x0VhlFBHtsJCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  1 15:29:45 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<TJ/QplBH9MkyBsPO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 203.55.131.5
country_id: 6252001
description:
Jan  1 15:30:46 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=203.55.131.5, lip=66.85.158.91, session=<ah2qqlBHSq3LN4MF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 15:34:46 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<7pnWuFBHJOgv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  1 15:39:47 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<NpzMylBH1uKi8GQy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.50.220.159
country_id: 3017382
description:
Jan  1 15:40:17 host2 dovecot[2747808]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=149.50.220.159, lip=66.85.158.91, session=<LnGtzFBHmNCVMtyf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 217.138.193.189
country_id: 290557
description:
Jan  1 15:40:24 host2 dovecot[2747808]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=217.138.193.189, lip=66.85.158.91, TLS handshaking: Connection closed, session=<1UUhzVBHCrnZisG9>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 188.241.80.136
country_id: 1814991
description:
Jan  1 15:40:16 host2 pure-ftpd[2935102]: (?@188.241.80.136) [INFO] New connection from 188.241.80.136


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.134.212.206
country_id: 798544
description:
Jan  1 15:40:17 host2 dovecot[2747808]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=45.134.212.206, lip=66.85.158.91, TLS handshaking: Connection closed, session=<KG20zFBHMrcthtTO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 176.125.228.149
country_id: 2589581
description:
Jan  1 15:40:17 host2 dovecot[2747808]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=176.125.228.149, lip=66.85.158.91, session=<WOivzFBHjtCwfeSV>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 188.215.235.43
country_id: 1831722
description:
Jan  1 15:40:20 host2 pure-ftpd[2935222]: (?@188.215.235.43) [INFO] New connection from 188.215.235.43


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.253.160.138
country_id: 174982
description:
Jan  1 15:40:23 host2 dovecot[2747808]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=185.253.160.138, lip=66.85.158.91, session=<9lEHzVBHXMS5/aCK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.239.194.41
country_id: 2077456
description:
Jan  1 15:40:17 host2 dovecot[2747808]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=173.239.194.41, lip=66.85.158.91, TLS, session=<1GW2zFBHPret78Ip>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 154.47.29.249
country_id: 3202326
description:
Jan  1 15:40:18 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=154.47.29.249, lip=66.85.158.91, TLS handshaking: Connection closed, session=<sRPIzFBHlLaaLx35>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.70.15.8
country_id: 1733045
description:
Jan  1 15:40:22 host2 dovecot[2747808]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=146.70.15.8, lip=66.85.158.91, session=<nt4GzVBHAO6SRg8I>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.235.134
country_id: 102358
description:
Jan  1 15:40:23 host2 dovecot[2747808]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=95.181.235.134, lip=66.85.158.91, session=<pDsMzVBHVsRfteuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  1 15:40:53 host2 sshd[2935748]: Disconnected from invalid user user 2.57.121.25 port 15643 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 203.130.248.214
country_id: 1643084
description:
Jan  1 15:41:14 host2 sshd[2936387]: Disconnected from invalid user rapid 203.130.248.214 port 55114 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.10.86.130
country_id: 3895114
description:
Jan  1 15:42:12 host2 sshd[2937417]: Disconnected from invalid user mom 186.10.86.130 port 36902 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.10.86.130
country_id: 3895114
description:
Jan  1 15:42:49 host2 sshd[2937913]: Disconnected from invalid user postgres 186.10.86.130 port 35428 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 15:43:43 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<7vzV2FBH0FMjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.37.138.249
country_id: 3017382
description:
Jan  1 15:45:15 host2 sshd[2940368]: Disconnected from invalid user testing 54.37.138.249 port 44032 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.198.215.66
country_id: 241170
description:
Jan  1 15:45:27 host2 sshd[2940623]: Disconnected from invalid user lab 154.198.215.66 port 53612 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 54.37.138.249
country_id: 3017382
description:
Jan  1 15:46:27 host2 sshd[2941615]: Disconnected from invalid user dima 54.37.138.249 port 57170 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.198.215.66
country_id: 241170
description:
Jan  1 15:47:06 host2 sshd[2942091]: Disconnected from invalid user hadoop 154.198.215.66 port 50524 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.37.138.249
country_id: 3017382
description:
Jan  1 15:48:13 host2 sshd[2943407]: Disconnected from invalid user parth 54.37.138.249 port 39832 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.169.4.104
country_id: 2635167
description:
Jan  1 15:48:29 host2 pure-ftpd[2943661]: (?@185.169.4.104) [INFO] New connection from 185.169.4.104


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  1 15:48:32 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<Oy0U6lBHtlWi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 15:48:42 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<9xiz6lBHTsEzTcpt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.238.191.229
country_id: 6252001
description:
Jan  1 15:48:04 host2 dovecot[2935713]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.238.191.229, lip=66.85.158.92, session=<WnOO6FBHXsQD7r/l>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.198.215.66
country_id: 241170
description:
Jan  1 15:48:17 host2 sshd[2943480]: Disconnected from invalid user mia 154.198.215.66 port 49594 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.186.182.85
country_id: 6252001
description:
Jan  1 15:47:51 host2 dovecot[2935713]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=52.186.182.85, lip=66.85.158.92, TLS, session=<vBXE51BHIq00urZV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  1 15:49:37 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<p6Lz7VBHuopn9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.122.251.178
country_id: 130758
description:
Jan  1 15:50:42 host2 sshd[2945727]: Disconnected from invalid user applmgr 109.122.251.178 port 60854 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 109.122.251.178
country_id: 130758
description:
Jan  1 15:52:01 host2 sshd[2946811]: Disconnected from invalid user usr01 109.122.251.178 port 60978 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.169.4.104
country_id: 2635167
description:
Jan  1 15:52:37 host2 pure-ftpd[2947294]: (?@185.169.4.104) [INFO] New connection from 185.169.4.104


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 15:53:44 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<RYOx/FBHasQzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 16:00:14 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<I7TxE1FHFqojupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  1 16:00:43 host2 sshd[2955466]: Disconnected from invalid user admin 2.57.121.112 port 44379 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  1 16:02:08 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<+LOvGlFHnAdniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 16:02:25 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<vs27G1FH0tKeRdY+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  1 16:01:44 host2 pure-ftpd[2956310]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  1 16:03:48 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<B9KrIFFHwZF100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  1 16:04:12 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<+dALIlFHVNJnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.137.94
country_id: 6252001
description:
Jan  1 16:07:03 host2 sshd[2962205]: Disconnected from invalid user odin 143.110.137.94 port 43940 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  1 16:11:26 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<GqP6O1FHGNEFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Jan  1 16:11:40 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<Vy7SPFFHlK4FhH+s>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.137.94
country_id: 6252001
description:
Jan  1 16:12:32 host2 sshd[2967146]: Disconnected from invalid user alien 143.110.137.94 port 48182 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Jan  1 16:13:01 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<iRioQVFHbMWYNcU1>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 143.110.137.94
country_id: 6252001
description:
Jan  1 16:13:08 host2 sshd[2967670]: Disconnected from invalid user amir 143.110.137.94 port 51332 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.73.168.229
country_id: 149590
description:
Jan  1 16:13:18 host2 sshd[2967790]: Disconnected from invalid user boomi 154.73.168.229 port 57174 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.73.168.229
country_id: 149590
description:
Jan  1 16:14:02 host2 sshd[2968361]: Disconnected from invalid user bill 154.73.168.229 port 57232 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.145.34.68
country_id: 1643084
description:
Jan  1 16:14:58 host2 sshd[2969187]: Disconnected from invalid user farhan 203.145.34.68 port 47748 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.73.168.229
country_id: 149590
description:
Jan  1 16:15:28 host2 sshd[2969942]: Disconnected from invalid user bitwarden 154.73.168.229 port 57352 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.137.94
country_id: 6252001
description:
Jan  1 16:15:41 host2 sshd[2970161]: Disconnected from invalid user debian 143.110.137.94 port 42096 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 16:16:12 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<BiAMTVFHar0v/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.137.94
country_id: 6252001
description:
Jan  1 16:16:40 host2 sshd[2971185]: Disconnected from invalid user admin 143.110.137.94 port 36744 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.145.34.68
country_id: 1643084
description:
Jan  1 16:15:44 host2 sshd[2970146]: Disconnected from invalid user fts 203.145.34.68 port 37200 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.73.168.229
country_id: 149590
description:
Jan  1 16:16:59 host2 sshd[2971475]: Disconnected from invalid user amir 154.73.168.229 port 57466 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.95.221.140
country_id: 1643084
description:
Jan  1 16:17:06 host2 sshd[2971604]: Disconnected from invalid user fts 36.95.221.140 port 34384 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.145.34.68
country_id: 1643084
description:
Jan  1 16:17:15 host2 sshd[2971699]: Disconnected from invalid user admin 203.145.34.68 port 44890 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.95.221.140
country_id: 1643084
description:
Jan  1 16:17:44 host2 sshd[2972224]: Disconnected from invalid user bitwarden 36.95.221.140 port 42994 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.106.155.11
country_id: 798544
description:
Jan  1 16:17:44 host2 dovecot[2935713]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=193.106.155.11, lip=66.85.158.91, TLS, session=<2l+nUVFHXefBapsL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.73.168.229
country_id: 149590
description:
Jan  1 16:17:47 host2 sshd[2972271]: Disconnected from invalid user fts 154.73.168.229 port 57522 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.46
country_id: 3865483
description:
Jan  1 16:18:06 host2 dovecot[2935713]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=179.0.250.46, lip=66.85.158.91, TLS, session=<3zzMUlFHxqezAPou>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2026-01-01 16:21:24 dovecot_plain authenticator failed for H=c-73-13-220-220.hsd1.de.comcast.net (vabjure) [73.13.220.220]:35726: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.85.104.2
country_id: 6252001
description:
2026-01-01 16:21:28 dovecot_plain authenticator failed for H=(speres) [96.85.104.2]:55050: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 16:21:41 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<h7qmYFFHbJ+eRdY+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 108.173.137.12
country_id: 6251999
description:
Jan  1 16:21:54 host2 sshd[2976122]: Disconnected from invalid user ubuntu 108.173.137.12 port 45172 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.172.81.227
country_id: 1880251
description:
Jan  1 16:22:23 host2 sshd[2976492]: Disconnected from invalid user artur 167.172.81.227 port 33708 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.61.108.185
country_id: 2510769
description:
Jan  1 16:22:52 host2 sshd[2976883]: Disconnected from invalid user jorgodubare 47.61.108.185 port 35854 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.74
country_id: 2635167
description:
Jan  1 16:23:15 host2 dovecot[2935713]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.74, lip=66.85.158.91, TLS, session=<gIFgZlFHWay594lK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.56
country_id: 2635167
description:
Jan  1 16:23:17 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.56, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<Pkt7ZlFH9du594k4>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 47.61.108.185
country_id: 2510769
description:
Jan  1 16:23:26 host2 sshd[2977415]: Disconnected from invalid user 1 47.61.108.185 port 36674 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 108.173.137.12
country_id: 6251999
description:
Jan  1 16:24:19 host2 sshd[2978241]: Disconnected from invalid user de 108.173.137.12 port 58372 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.57
country_id: 2635167
description:
Jan  1 16:24:24 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.57, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<TAZyalFHf8xX7LA5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.67
country_id: 2635167
description:
Jan  1 16:23:50 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.67, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<2px2aFFHbYdX7LBD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.66
country_id: 2635167
description:
Jan  1 16:24:57 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.66, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<b1htbFFHT49X7LBC>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.223.57.188
country_id: 1880251
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 159.223.57.188 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.53
country_id: 2635167
description:
Jan  1 16:25:30 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.53, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<m8doblFHt6y594k1>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 108.173.137.12
country_id: 6251999
description:
Jan  1 16:26:03 host2 sshd[2979906]: Disconnected from invalid user ods 108.173.137.12 port 60766 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.63
country_id: 2635167
description:
Jan  1 16:26:03 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.63, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<7BRicFFHcea594k/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.172.81.227
country_id: 1880251
description:
Jan  1 16:26:09 host2 sshd[2979977]: Disconnected from invalid user de 167.172.81.227 port 58286 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.66
country_id: 2635167
description:
Jan  1 16:26:37 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.66, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<U2RfclFHxZBX7LBC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.56
country_id: 2635167
description:
Jan  1 16:27:10 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.56, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<QqNadFFHRc5X7LA4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.172.81.227
country_id: 1880251
description:
Jan  1 16:27:17 host2 sshd[2980833]: Disconnected from invalid user jarservice 167.172.81.227 port 51170 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.40
country_id: 2635167
description:
Jan  1 16:27:43 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.40, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<nCBUdlFHt71X7LAo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.55
country_id: 2635167
description:
Jan  1 16:28:16 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.55, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<K3BPeFFH3YO594k3>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  1 16:29:40 host2 sshd[2982772]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 167.172.81.227
country_id: 1880251
description:
Jan  1 16:29:03 host2 sshd[2982302]: Disconnected from invalid user ramin 167.172.81.227 port 40920 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.127
country_id: 6252001
description:
Jan  1 16:29:13 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.127, lip=66.85.158.92, TLS handshaking: Connection closed, session=<tfOye1FHCHVChJl/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  1 16:29:23 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<Kd8cfFFH6JYvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  1 16:31:48 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<hDbThFFHkPJo7MS0>


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 45.44.153.70
country_id: 6251999
description:
Jan  1 16:35:40 host2 sshd[2988730]: Disconnecting authenticating user root 45.44.153.70 port 40659: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 45.44.153.70
country_id: 6251999
description:
Jan  1 16:35:40 host2 sshd[2988730]: error: maximum authentication attempts exceeded for root from 45.44.153.70 port 40659 ssh2 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.44.153.70
country_id: 6251999
description:
Jan  1 16:35:51 host2 sshd[2988906]: Disconnecting invalid user admin 45.44.153.70 port 41582: Too many authentication failures [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.196.48.232
country_id: 6252001
description:
Jan  1 16:36:32 host2 dovecot[2935713]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=54.196.48.232, lip=66.85.158.91, TLS, session=<T9TclVFHQJ42xDDo>


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 45.44.153.70
country_id: 6251999
description:
Jan  1 16:35:44 host2 sshd[2988782]: Disconnecting authenticating user root 45.44.153.70 port 40970: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 45.44.153.70
country_id: 6251999
description:
Jan  1 16:35:44 host2 sshd[2988782]: error: maximum authentication attempts exceeded for root from 45.44.153.70 port 40970 ssh2 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 16:37:10 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<2YP8l1FHZI4v/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  1 16:39:35 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<w4qhoFFHPNqi8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-01 16:44:24 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:52261: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  1 16:45:14 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<EmbatFFH3OJCdMzo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.39.163.240
country_id: 357994
description:
2026-01-01 16:46:20 dovecot_plain authenticator failed for H=(LF21D45A3WC8) [41.39.163.240]:49572: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 16:46:20 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<tNPRuFFHxugjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  1 16:51:47 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<f5M9zFFHlNZn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  1 16:52:46 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<1cvKz1FHphii8Jp9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.133.193.25
country_id: 2629691
description:
Jan  1 16:59:37 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.133.193.25, lip=66.85.158.91, TLS, session=</rJs6FFHwLEthcEZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.236.152
country_id: 614540
description:
Jan  1 16:59:37 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=95.181.236.152, lip=66.85.158.91, TLS handshaking: Connection closed, session=<A5Rs6FFH9IhfteyY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  1 16:59:39 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<hhJi6FFHKMwyBsPO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  1 17:00:31 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<MNp561FHKxZniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  1 17:01:09 host2 sshd[3017699]: Disconnected from invalid user user 2.57.121.25 port 40243 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.53.32.129
country_id: 2921044
description:
Jan  1 17:01:30 host2 sshd[3017992]: Disconnected from invalid user storage 152.53.32.129 port 43312 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  1 17:01:35 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<pxRT71FHlq2eRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 17:01:54 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<szJw8FFHvMYzTcpt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.68.84.17
country_id: 2328926
description:
Jan  1 17:02:03 host2 sshd[3018364]: Disconnected from invalid user nina 102.68.84.17 port 38166 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 17:02:15 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<IS6x8VFHINAjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 17:02:49 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<0sK981FHTI6eRdY+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.44.178.180
country_id: 3175395
description:
Jan  1 17:02:53 host2 sshd[3019209]: Disconnected from invalid user develop 151.44.178.180 port 19515 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  1 17:03:55 host2 sshd[3020394]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.254.21
country_id: 1819730
description:
Jan  1 17:04:02 host2 sshd[3020443]: Disconnected from invalid user m1 152.32.254.21 port 53296 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  1 17:04:47 host2 pure-ftpd[3021156]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.254.21
country_id: 1819730
description:
Jan  1 17:05:54 host2 sshd[3022403]: Disconnected from invalid user ftp_user 152.32.254.21 port 33964 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.44.178.180
country_id: 3175395
description:
Jan  1 17:06:28 host2 sshd[3022881]: Disconnected from invalid user oracle 151.44.178.180 port 19141 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 17:06:54 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<GYBdAlJHnqYzTcpt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.53.32.129
country_id: 2921044
description:
Jan  1 17:06:58 host2 sshd[3023243]: Disconnected from invalid user carol 152.53.32.129 port 60650 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.235.179
country_id: 6252001
description:
Jan  1 17:07:35 host2 sshd[3023766]: Disconnected from invalid user ftp_user 165.154.235.179 port 45896 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  1 17:06:47 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<5+XqAVJHOeZ100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.122.23
country_id: 1819730
description:
Jan  1 17:08:05 host2 sshd[3024239]: Disconnected from invalid user desarrollo 101.36.122.23 port 47584 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.122.23
country_id: 1819730
description:
Jan  1 17:08:44 host2 sshd[3024801]: Disconnected from invalid user rogerio 101.36.122.23 port 39434 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  1 17:10:24 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<uEfZDlJHbrNnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.44.178.180
country_id: 3175395
description:
Jan  1 17:15:11 host2 sshd[3031471]: Disconnected from invalid user helen 151.44.178.180 port 19522 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 17:19:01 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<+ceqLVJHMJIv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Jan  1 17:19:23 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@kiriaswanu.com>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<OLH1LlJHhIUFhH+s>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.44.178.180
country_id: 3175395
description:
Jan  1 17:19:30 host2 sshd[3036059]: Disconnected from invalid user user2 151.44.178.180 port 19568 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 17:21:30 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<1QeSNlJHvLSeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.253.124
country_id: 99237
description:
Jan  1 17:22:19 host2 dovecot[2935713]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=65.20.253.124, lip=66.85.158.91, TLS, session=<wIaQOFJHfKtBFP18>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.177.113.77
country_id: 3175395
description:
Jan  1 17:22:38 host2 dovecot[2935713]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<charanaw>, method=PLAIN, rip=195.177.113.77, lip=66.85.158.91, TLS, session=<P9GwOVJHWLvDsXFN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  1 17:23:23 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<c6RJPVJHBL6eRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  1 17:24:55 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<hw6/QlJHsp8FhXlo>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.81.132.52
country_id: 6252001
description:
Jan  1 17:34:04 host2 pure-ftpd[3050001]: (?@172.81.132.52) [INFO] New connection from 172.81.132.52


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.90.124.138
country_id: 3042225
description:
Jan  1 17:36:10 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.90.124.138, lip=66.85.158.91, TLS handshaking: Connection closed, session=<DPYga1JHOp9bWnyK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.244.42.152
country_id: 1835841
description:
Jan  1 17:36:10 host2 dovecot[2935713]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=173.244.42.152, lip=66.85.158.91, session=<nUcba1JHvLSt9CqY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.236.149
country_id: 614540
description:
Jan  1 17:36:09 host2 dovecot[2935713]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=95.181.236.149, lip=66.85.158.91, session=<EYEYa1JHDMhfteyV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.244.49.12
country_id: 1668284
description:
Jan  1 17:36:10 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=173.244.49.12, lip=66.85.158.91, session=<T1Iga1JHurSt9DEM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.215.235.43
country_id: 1831722
description:
Jan  1 17:36:10 host2 dovecot[2935713]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=188.215.235.43, lip=66.85.158.91, session=<6lQda1JHBsi81+sr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.241.80.141
country_id: 1814991
description:
Jan  1 17:36:10 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=188.241.80.141, lip=66.85.158.91, TLS, session=<TOsia1JHPp+88VCN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.248.82.67
country_id: 2750405
description:
Jan  1 17:38:45 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=104.248.82.67, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<LJlfdFJHUOxo+FJD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  1 17:39:45 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<FFLBd1JHCJui8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 17:40:02 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<zBTUeFJHrrYv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  1 17:43:37 host2 sshd[3060007]: Disconnected from invalid user admin 2.57.121.112 port 10671 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 17:47:16 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<P9q2klJHQKYjupN+>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.213
country_id: 2635167
description:
Jan  1 17:50:02 host2 dovecot[2935713]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.213, lip=66.85.158.91, TLS, session=<uEuznFJHU7G594nV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  1 17:52:43 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<cNsjplJHcnpo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  1 17:53:52 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<wnlSqlJHTt9n9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  1 17:57:30 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<mrYut1JH4j+i8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  1 17:59:12 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<C8devVJH1UJniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  1 18:01:48 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<HbKfxlJHeDZ100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 18:03:11 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<Kt2by1JHhuojupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 18:02:32 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<+4RMyVJHpqueRdY+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.60.12.168
country_id: 6252001
description:
Jan  1 18:02:36 host2 pure-ftpd[3079075]: (?@103.60.12.168) [INFO] New connection from 103.60.12.168


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  1 18:03:17 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<X6b6y1JHTLkvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  1 18:05:18 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<uUIy01JH7r9CdMzo>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.230.168.35
country_id: 6252001
description:
Jan  1 18:05:48 host2 pure-ftpd[3082363]: (?@91.230.168.35) [INFO] New connection from 91.230.168.35


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.230.168.161
country_id: 6252001
description:
Jan  1 18:05:48 host2 pure-ftpd[3082361]: (?@91.230.168.161) [INFO] New connection from 91.230.168.161


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.74.136.134
country_id: 6252001
description:
2026-01-01 18:07:08 dovecot_plain authenticator failed for H=syn-050-074-136-134.biz.spectrum.com (clionne) [50.74.136.134]:37720: 535 Incorrect authentication data (set_id=admin@v-deploy.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  1 18:08:21 host2 pure-ftpd[3085617]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.117.57.134
country_id: 1643084
description:
Jan  1 18:09:42 host2 sshd[3087055]: Disconnected from invalid user admin 103.117.57.134 port 42948 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Jan  1 18:09:50 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<kXhJ41JHROmYNcU1>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.117.57.134
country_id: 1643084
description:
Jan  1 18:10:26 host2 sshd[3087956]: Disconnected from invalid user developer 103.117.57.134 port 46870 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 18:15:27 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<WBJ191JHFJczTcpt>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  1 18:17:40 host2 sshd[3095882]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  1 18:18:03 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<8+W1AFNHvI9nmud6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 143.198.179.99
country_id: 6252001
description:
Jan  1 18:18:24 host2 dovecot[2935713]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=143.198.179.99, lip=66.85.158.91, TLS, session=<kBAqAlNHLuePxrNj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 18:20:35 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<postfix@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<qUjPCVNHQLIzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 18:21:07 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<koHEC1NHeNueRdY+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.250.10.42
country_id: 1643084
description:
Jan  1 18:22:08 host2 sshd[3099820]: Disconnected from invalid user django 103.250.10.42 port 47714 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 18:22:25 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<MWlrEFNHDOsv/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
country_id: 99237
description:
2026-01-01 18:27:09 dovecot_plain authenticator failed for H=(polotard) [65.20.191.12]:51146: 535 Incorrect authentication data (set_id=ruwini@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.10.62
country_id: 2635167
description:
Jan  1 18:27:36 host2 sshd[3105622]: Disconnected from invalid user rstudio 185.196.10.62 port 43936 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan  1 18:27:37 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<RZQfI1NHjMIDiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.238.252.133
country_id: 241170
description:
Jan  1 18:27:47 host2 sshd[3105797]: Disconnected from invalid user apps 156.238.252.133 port 53980 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.114.55.236
country_id: 2921044
description:
[2026-01-01 18:28:51 +0530] info [webmaild] 74.114.55.236 - senthil@yashiholdings.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.247.220.10
country_id: 6252001
description:
[2026-01-01 18:28:51 +0530] info [webmaild] 170.247.220.10 - yashiholdings@yashiholdings.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.124
country_id: 6252001
description:
Jan  1 18:29:08 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.124, lip=66.85.158.92, TLS: Connection closed, session=<2ziQKFNHDsJChJl8>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.238.252.133
country_id: 241170
description:
Jan  1 18:28:20 host2 sshd[3106390]: Disconnected from invalid user ocadmin 156.238.252.133 port 40174 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.238.252.133
country_id: 241170
description:
Jan  1 18:29:24 host2 sshd[3107395]: Disconnected from invalid user mapr 156.238.252.133 port 34252 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan  1 18:29:35 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<N+UwKlNHJrEDiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.10.62
country_id: 2635167
description:
Jan  1 18:29:57 host2 sshd[3107841]: Disconnected from invalid user ftp1 185.196.10.62 port 42320 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.250.10.42
country_id: 1643084
description:
Jan  1 18:30:32 host2 sshd[3108539]: Disconnected from invalid user db2inst1 103.250.10.42 port 49044 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan  1 18:31:22 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS, session=<N96JMFNHHLkDiUnd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  1 18:31:56 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<ue9sMlNHopwyBsPO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.10.62
country_id: 2635167
description:
Jan  1 18:32:22 host2 sshd[3110583]: Disconnected from invalid user peter 185.196.10.62 port 39322 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan  1 18:32:26 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<8JNhNFNHHMMDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan  1 18:33:38 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: Connection closed, session=<SGmkOFNHCKgDiUnd>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  1 18:37:15 host2 sshd[3115471]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.185.95
country_id: 6252001
description:
Jan  1 18:37:44 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=44.220.185.95, lip=66.85.158.92, TLS handshaking: Connection closed, session=<sxpJR1NHGoEs3Llf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.31.253.56
country_id: 6252001
description:
Jan  1 18:38:26 host2 sshd[3116395]: Disconnected from invalid user bitrix 144.31.253.56 port 36460 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  1 18:39:00 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<3161S1NHgLUFhXlo>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 144.31.253.56
country_id: 6252001
description:
Jan  1 18:39:25 host2 sshd[3117200]: Disconnected from invalid user tom 144.31.253.56 port 60200 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 137.184.62.46
country_id: 6252001
description:
Jan  1 18:39:32 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=137.184.62.46, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<Oxa/TVNHEryJuD4u>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.31.253.56
country_id: 6252001
description:
Jan  1 18:40:22 host2 sshd[3118193]: Disconnected from invalid user ftpuser 144.31.253.56 port 57706 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  1 18:41:29 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 15 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<kVDZU1NHTrqi8GQy>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.80.150.222
country_id: 3190538
description:
Jan  1 18:42:25 host2 pure-ftpd[3119637]: (?@195.80.150.222) [INFO] New connection from 195.80.150.222


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 191.96.168.36
country_id: 2750405
description:
Jan  1 18:42:29 host2 dovecot[2935713]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=191.96.168.36, lip=66.85.158.91, TLS, session=<1ktJWFNHWLy/YKgk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.64.98.10
country_id: 1655842
description:
Jan  1 18:42:29 host2 dovecot[2935713]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.64.98.10, lip=66.85.158.91, TLS handshaking: Connection closed, session=<IHxKWFNHTLxAQGIK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.31.253.56
country_id: 6252001
description:
Jan  1 18:44:06 host2 sshd[3120602]: Disconnected from invalid user sinusbot 144.31.253.56 port 35808 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 18:43:39 host2 dovecot[2935713]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<gn9QXFNHTL4v/AU1>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.87.21.241
country_id: 953987
description:
Jan  1 18:45:43 host2 sshd[3122090]: Disconnected from invalid user info 20.87.21.241 port 58820 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 18:48:37 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<RrgfblNH+rEjupN+>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  1 18:51:57 host2 sshd[3127183]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-01-01 18:52:42 dovecot_plain authenticator failed for H=(mullus) [154.144.243.93]:43080: 535 Incorrect authentication data (set_id=admin@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.143.255
country_id: 1880251
description:
Jan  1 18:53:13 host2 sshd[3128424]: Disconnected from invalid user bartek 101.47.143.255 port 33406 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.139.180.113
country_id: 3175395
description:
Jan  1 18:55:10 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=185.139.180.113, lip=66.85.158.91, TLS, session=<YpuqhFNHWJO5i7Rx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  1 18:55:10 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<kDZmhVNH7OBn9M4G>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.138
country_id: 6252001
description:
Jan  1 18:54:42 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.138, lip=66.85.158.91, TLS: Connection closed, session=<PQz4g1NHoHhChJmK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.174.73.106
country_id: 798544
description:
Jan  1 18:55:28 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<charanaw>, method=PLAIN, rip=46.174.73.106, lip=66.85.158.91, TLS, session=<vOvChVNHxMkurklq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  1 18:55:29 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<2I2ohlNHpfl100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.143.255
country_id: 1880251
description:
Jan  1 18:56:51 host2 sshd[3132108]: Disconnected from invalid user postgres 101.47.143.255 port 54328 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  1 18:57:13 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<c4ffjFNH8yRniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  1 19:01:13 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<jqsvm1NHdFqi8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.72.176.66
country_id: 2542007
description:
2026-01-01 19:01:22 dovecot_plain authenticator failed for H=(supindenes) [105.72.176.66]:44104: 535 Incorrect authentication data (set_id=admin@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 19:02:20 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<APwkn1NHHJ2eRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 19:04:42 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<JDKlp1NHhJEjupN+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  1 19:12:13 host2 pure-ftpd[3146902]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  1 19:14:47 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<info@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<mLOTy1NHguyeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  1 19:15:48 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<zGRKz1NH8l1o7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 19:21:19 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<NhwL41NHerqeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 19:26:10 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<JuBi9FNHJocv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  1 19:27:01 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<jYlr91NH6rBnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  1 19:27:31 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<eYk3+VNH/tFCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 19:30:23 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<ZZZ0A1RHqOYzTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.29.138.157
country_id: 3175395
description:
2026-01-01 19:31:03 dovecot_plain authenticator failed for H=(sophy) [212.29.138.157]:48893: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  1 19:32:16 host2 sshd[3166434]: Disconnected from invalid user admin 2.57.121.112 port 34993 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  1 19:34:44 host2 sshd[3168538]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.129
country_id: 6252001
description:
Jan  1 19:34:23 host2 dovecot[3122720]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=66.132.153.129, lip=66.85.158.91, session=<rLTmEVRHiB1ChJmB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 19:35:32 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<LfzrFVRHfLEzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  1 19:38:20 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<qmvMH1RHQpmeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  1 19:38:24 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<QOwmIFRHHt4vWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  1 19:43:49 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<mRaBM1RHspei8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 19:47:34 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<CC/uQFRHKNAv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 19:50:43 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<N285TFRHcFojupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  1 19:50:55 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<nJXgTFRHVUd100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  1 19:54:38 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<c7U4WlRHYowFhXlo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  1 19:54:47 host2 sshd[3188323]: Disconnected from invalid user user 2.57.121.25 port 17380 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  1 19:55:33 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<iA9+XVRHEgZniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  1 19:57:19 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<fqTDY1RHjOBn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.28.14
country_id: 798544
description:
Jan  1 19:58:12 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=178.216.28.14, lip=66.85.158.91, TLS, session=<L5HKZVRHnKuy2BwO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.136.142.134
country_id: 130758
description:
Jan  1 19:58:33 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=188.136.142.134, lip=66.85.158.91, TLS, session=<G/owZ1RHfhK8iI6G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 20:03:16 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<XOgUeVRHloOeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  1 20:05:10 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<71zbf1RH8royBsPO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  1 20:04:26 host2 sshd[3198800]: Disconnected from invalid user admin 2.57.121.112 port 12394 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2026-01-01 20:05:00 dovecot_plain authenticator failed for H=(valicimen) [91.73.195.150]:35473: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  1 20:06:17 host2 sshd[3200750]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Jan  1 20:05:38 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<zkmBgVRHMKeYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  1 20:05:51 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<TSBLglRHnAyi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 20:06:55 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<kfIdhlRHPmMjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-01 20:09:52 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:51627: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.231.112.22
country_id: 3017382
description:
2026-01-01 20:13:14 dovecot_login authenticator failed for H=([188.231.112.22]) [188.231.112.22]:44806: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.156
country_id: 1269750
description:
2026-01-01 20:13:34 dovecot_login authenticator failed for H=([103.146.233.156]) [103.146.233.156]:37284: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  1 20:15:57 host2 pure-ftpd[3209921]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.124
country_id: 6252001
description:
Jan  1 20:18:49 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (no auth attempts in 16 secs): user=<>, rip=66.132.153.124, lip=66.85.158.92, TLS handshaking: Connection closed, session=<7RTKsFRHKnRChJl8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 20:22:14 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<lXvsvFRHmMSeRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.53.199.160
country_id: 6252001
description:
2026-01-01 20:28:09 dovecot_login authenticator failed for H=(136-53-199-160.googlefiber.net) [136.53.199.160]:50300: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.114
country_id: 1269750
description:
2026-01-01 20:28:23 dovecot_login authenticator failed for H=([182.95.25.142]) [182.95.61.114]:54396: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 20:30:09 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<vBg62VRH3sAv/AU1>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.123
country_id: 6252001
description:
Jan  1 20:33:59 host2 pure-ftpd[3228652]: (?@66.132.153.123) [INFO] New connection from 66.132.153.123


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.142
country_id: 6252001
description:
Jan  1 20:35:17 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.142, lip=66.85.158.91, session=<Ukm661RHSqVAPpyO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.142
country_id: 6252001
description:
Jan  1 20:35:28 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.142, lip=66.85.158.91, TLS: Connection closed, session=<r05g7FRHSrVAPpyO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  1 20:36:21 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<contact@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<gIpJ71RHZsRnmud6>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  1 20:41:05 host2 sshd[3236695]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  1 20:40:29 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<iKgx/lRHxuBo7MS0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  1 20:42:27 host2 sshd[3238114]: Disconnected from invalid user admin 2.57.121.112 port 19325 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.95.157.171
country_id: 1861060
description:
Jan  1 20:44:04 host2 sshd[3239799]: Disconnected from invalid user minecraft 150.95.157.171 port 60618 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.166.49.42
country_id: 1269750
description:
Jan  1 20:44:12 host2 sshd[3239937]: Disconnected from invalid user deployer 122.166.49.42 port 39936 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 20:44:56 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<HzQQDlVHeL8zTcpt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.4
country_id: 2635167
description:
Jan  1 20:45:18 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 45 secs): user=<>, rip=35.203.211.4, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<vimLD1VHaMAjy9ME>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.166.49.42
country_id: 1269750
description:
Jan  1 20:46:05 host2 sshd[3242416]: Disconnected from invalid user admin 122.166.49.42 port 36254 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.4
country_id: 2635167
description:
Jan  1 20:45:39 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=35.203.211.4, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<IZnEEFVHsPgjy9ME>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.107.103
country_id: 1819730
description:
Jan  1 20:45:50 host2 sshd[3241877]: Disconnected from invalid user ftpuser 101.36.107.103 port 49372 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  1 20:46:50 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<41HkFFVHdrei8GQy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.112
country_id: 6252001
description:
Jan  1 20:47:10 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.112, lip=66.85.158.92, TLS: Connection closed, session=<HpEuFlVHPCtChJlw>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 150.95.157.171
country_id: 1861060
description:
Jan  1 20:47:13 host2 sshd[3243631]: Disconnected from invalid user sysadmin 150.95.157.171 port 57168 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  1 20:46:34 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<cabuE1VHp2R100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.95.157.171
country_id: 1861060
description:
Jan  1 20:47:52 host2 sshd[3244395]: Disconnected from invalid user haproxy 150.95.157.171 port 42760 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.166.49.42
country_id: 1269750
description:
Jan  1 20:48:38 host2 sshd[3245132]: Disconnected from invalid user rahul 122.166.49.42 port 53508 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.95.157.171
country_id: 1861060
description:
Jan  1 20:48:30 host2 sshd[3244993]: Disconnected from invalid user teamspeak 150.95.157.171 port 56586 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.142
country_id: 6252001
description:
Jan  1 20:49:44 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.142, lip=66.85.158.92, TLS: Connection closed, session=<vtFaH1VHem9ChJmO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 20:50:04 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<LHd3IFVHzuwzTcpt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.107.103
country_id: 1819730
description:
Jan  1 20:50:06 host2 sshd[3246545]: Disconnected from invalid user ftpadmin 101.36.107.103 port 34044 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.166.49.42
country_id: 1269750
description:
Jan  1 20:50:31 host2 sshd[3247124]: Disconnected from invalid user jenny 122.166.49.42 port 59376 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.107.103
country_id: 1819730
description:
Jan  1 20:50:48 host2 sshd[3247401]: Disconnected from invalid user onyx 101.36.107.103 port 41598 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  1 20:51:10 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<UtFfJFVHzLdCdMzo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.4
country_id: 2635167
description:
Jan  1 20:52:11 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.4, lip=66.85.158.92, TLS, session=<EBUjKFVHTuMjy9ME>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.166.49.42
country_id: 1269750
description:
Jan  1 20:52:19 host2 sshd[3249040]: Disconnected from invalid user odoo 122.166.49.42 port 37010 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.107.103
country_id: 1819730
description:
Jan  1 20:51:27 host2 sshd[3248097]: Disconnected from invalid user rf 101.36.107.103 port 41078 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 13.89.125.225
country_id: 6252001
description:
Jan  1 20:51:26 host2 pure-ftpd[3248110]: (?@13.89.125.225) [INFO] New connection from 13.89.125.225


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 20:51:38 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<Tr0SJlVHvowv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 20:52:56 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<aMK0KlVHvn0jupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  1 20:54:24 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<qlveL1VH0TNniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  1 20:59:50 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<DOBcQ1VH0tRn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 21:04:08 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<g+e9UlVHrOueRdY+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.104.184
country_id: 6252001
description:
Jan  1 21:05:12 host2 sshd[3261357]: Disconnected from invalid user pentest 107.150.104.184 port 57464 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.181.87.33
country_id: 298795
description:
Jan  1 21:06:10 host2 sshd[3262194]: Disconnected from invalid user student 5.181.87.33 port 49042 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.254.103.32
country_id: 3017382
description:
Jan  1 21:06:11 host2 sshd[3262211]: Disconnected from invalid user dmp 51.254.103.32 port 49384 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.188.172.6
country_id: 3923057
description:
Jan  1 21:07:12 host2 sshd[3263117]: Disconnected from invalid user valera 181.188.172.6 port 34225 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.185.168.78
country_id: 3469034
description:
Jan  1 21:06:24 host2 sshd[3262386]: Disconnected from invalid user administrator 191.185.168.78 port 52186 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.191.96.115
country_id: 2510769
description:
Jan  1 21:06:31 host2 sshd[3262457]: Disconnected from invalid user frappe 92.191.96.115 port 33480 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.104.184
country_id: 6252001
description:
Jan  1 21:08:11 host2 sshd[3263946]: Disconnected from invalid user wildfly 107.150.104.184 port 38228 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.236.75.54
country_id: 1819730
description:
Jan  1 21:08:14 host2 sshd[3263985]: Disconnected from invalid user sysadmin 156.236.75.54 port 58866 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.75.54
country_id: 1819730
description:
Jan  1 21:07:35 host2 sshd[3263452]: Disconnected from invalid user newuser 156.236.75.54 port 46928 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.68.201
country_id: 3932488
description:
Jan  1 21:07:59 host2 sshd[3263744]: Disconnected from invalid user roberto 161.132.68.201 port 34318 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.185.168.78
country_id: 3469034
description:
Jan  1 21:08:36 host2 sshd[3264323]: Disconnected from invalid user manuel 191.185.168.78 port 59468 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 21:09:17 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<DkUrZVVHKNAjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.255.62.58
country_id: 1819730
description:
Jan  1 21:08:23 host2 sshd[3264139]: Disconnected from invalid user server 20.255.62.58 port 34078 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.87
country_id: 6252001
description:
Jan  1 21:08:29 host2 pure-ftpd[3264254]: (?@147.185.132.87) [INFO] New connection from 147.185.132.87


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.128.212.198
country_id: 798544
description:
Jan  1 21:09:56 host2 sshd[3265363]: Disconnected from invalid user frappe 57.128.212.198 port 56102 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.225.55.168
country_id: 6252001
description:
Jan  1 21:09:59 host2 sshd[3265426]: Disconnected from invalid user kafka 64.225.55.168 port 58696 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.181.87.33
country_id: 298795
description:
Jan  1 21:10:23 host2 sshd[3266028]: Disconnected from invalid user rebecca 5.181.87.33 port 54318 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.128.212.198
country_id: 798544
description:
Jan  1 21:10:37 host2 sshd[3266229]: Disconnected from invalid user kali 57.128.212.198 port 58616 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.225.55.168
country_id: 6252001
description:
Jan  1 21:10:40 host2 sshd[3266270]: Disconnected from invalid user ftpuser 64.225.55.168 port 49596 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.188.172.6
country_id: 3923057
description:
Jan  1 21:10:58 host2 sshd[3266524]: Disconnected from invalid user backend 181.188.172.6 port 36203 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.191.96.115
country_id: 2510769
description:
Jan  1 21:10:56 host2 sshd[3266500]: Disconnected from invalid user jramirez 92.191.96.115 port 49972 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.68.201
country_id: 3932488
description:
Jan  1 21:10:30 host2 sshd[3266152]: Disconnected from invalid user frappe 161.132.68.201 port 36202 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.254.103.32
country_id: 3017382
description:
Jan  1 21:10:45 host2 sshd[3266360]: Disconnected from invalid user user 51.254.103.32 port 43182 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 191.185.168.78
country_id: 3469034
description:
Jan  1 21:10:50 host2 sshd[3266418]: Disconnected from invalid user ts3 191.185.168.78 port 38528 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.128.212.198
country_id: 798544
description:
Jan  1 21:11:53 host2 sshd[3267363]: Disconnected from invalid user admin 57.128.212.198 port 39632 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.104.184
country_id: 6252001
description:
Jan  1 21:11:56 host2 sshd[3267478]: Disconnected from invalid user student 107.150.104.184 port 56996 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  1 21:12:00 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<ck/hblVH1toFhXlo>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 92.191.96.115
country_id: 2510769
description:
Jan  1 21:12:08 host2 sshd[3267744]: Disconnected from invalid user username 92.191.96.115 port 18142 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.212.81.228
country_id: 3895114
description:
Jan  1 21:11:20 host2 sshd[3266869]: Disconnected from invalid user mcadmin 181.212.81.228 port 59806 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.106.168.113
country_id: 6252001
description:
Jan  1 21:11:25 host2 pure-ftpd[3266979]: (?@20.106.168.113) [INFO] New connection from 20.106.168.113


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  1 21:11:26 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 6 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<yk+ZbFVHYr6i8Jp9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.212.81.228
country_id: 3895114
description:
Jan  1 21:12:42 host2 sshd[3268196]: Disconnected from invalid user student 181.212.81.228 port 54752 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.181.87.33
country_id: 298795
description:
Jan  1 21:12:43 host2 sshd[3268207]: Disconnected from invalid user frappe 5.181.87.33 port 40114 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.205.68
country_id: 1643084
description:
Jan  1 21:13:17 host2 sshd[3268700]: Disconnected from invalid user lam 103.172.205.68 port 34936 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.225.55.168
country_id: 6252001
description:
Jan  1 21:13:30 host2 sshd[3268908]: Disconnected from invalid user dd 64.225.55.168 port 50586 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.225.55.168
country_id: 6252001
description:
Jan  1 21:14:05 host2 sshd[3269540]: Disconnected from invalid user administrator 64.225.55.168 port 38800 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.214.138.55
country_id: 2510769
description:
Jan  1 21:14:13 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=185.214.138.55, lip=66.85.158.91, TLS, session=<HfTqdVVHmp+51oo3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.128.212.198
country_id: 798544
description:
Jan  1 21:14:18 host2 sshd[3269761]: Disconnected from invalid user wildfly 57.128.212.198 port 45486 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.123
country_id: 6252001
description:
Jan  1 21:16:05 host2 pure-ftpd[3271621]: (?@66.132.153.123) [INFO] New connection from 66.132.153.123


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  1 21:14:25 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<postfix@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<4vuAd1VHgJYvWBNS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.124
country_id: 6252001
description:
Jan  1 21:15:51 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.124, lip=66.85.158.91, TLS: Connection closed, session=<jKLKfFVHIP1ChJl8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 131.0.248.71
country_id: 3469034
description:
Jan  1 21:14:33 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw>, method=PLAIN, rip=131.0.248.71, lip=66.85.158.91, TLS, session=<p30Qd1VHELODAPhH>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  1 21:15:18 host2 pure-ftpd[3270933]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 157.66.34.121
country_id: 1643084
description:
Jan  1 21:16:17 host2 sshd[3271797]: Disconnected from invalid user mcserver 157.66.34.121 port 36440 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.205.68
country_id: 1643084
description:
Jan  1 21:16:26 host2 sshd[3271931]: Disconnected from invalid user dd 103.172.205.68 port 55954 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.68.201
country_id: 3932488
description:
Jan  1 21:17:57 host2 sshd[3273456]: Disconnected from invalid user ts3 161.132.68.201 port 60506 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 87.236.176.143
country_id: 2635167
description:
Jan  1 21:18:29 host2 pure-ftpd[3274001]: (?@87.236.176.143) [INFO] New connection from 87.236.176.143


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.108.174.158
country_id: 1269750
description:
Jan  1 21:22:10 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=103.108.174.158, lip=66.85.158.91, TLS, session=<sl1ck1VHVtZnbK6e>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.108.174.158
country_id: 1269750
description:
Jan  1 21:22:11 host2 pure-ftpd[3277897]: (?@103.108.174.158) [INFO] New connection from 103.108.174.158


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.253.160.157
country_id: 174982
description:
Jan  1 21:22:10 host2 pure-ftpd[3277885]: (?@185.253.160.157) [INFO] New connection from 185.253.160.157


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 21:23:15 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<HrMcl1VHFpKeRdY+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.174.247
country_id: 6252001
description:
Jan  1 21:24:10 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (disconnected before auth was ready, waited 0 secs): user=<>, rip=40.124.174.247, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<j2CEmlVHxsYofK73>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 203.188.182.122
country_id: 2635167
description:
Jan  1 21:25:07 host2 dovecot[3122720]: pop3-login: Disconnected: Inactivity (no auth attempts in 180 secs): user=<>, rip=203.188.182.122, lip=66.85.158.91, TLS handshaking, session=<4//pnVVHbKnLvLZ6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.225.223.108
country_id: 3865483
description:
Jan  1 21:27:53 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=190.225.223.108, lip=66.85.158.91, TLS, session=<6eezplVHZ4u+4d9s>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.55.105.252
country_id: 1269750
description:
Jan  1 21:28:15 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=103.55.105.252, lip=66.85.158.91, TLS, session=<+KTup1VHisdnN2n8>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.208.24.217
country_id: 6252001
description:
Jan  1 21:29:55 host2 sshd[3284770]: Disconnected from invalid user ts3server 172.208.24.217 port 54624 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.221.72.24
country_id: 6252001
description:
Jan  1 21:30:05 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.221.72.24, lip=66.85.158.91, TLS handshaking: Connection closed, session=<S92wr1VHsIwU3UgY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.208.24.217
country_id: 6252001
description:
Jan  1 21:34:03 host2 sshd[3288994]: Disconnected from invalid user runner 172.208.24.217 port 10596 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.208.24.217
country_id: 6252001
description:
Jan  1 21:35:17 host2 sshd[3290293]: Disconnected from invalid user sachin 172.208.24.217 port 65250 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.237.94.18
country_id: 6252001
description:
Jan  1 21:34:22 host2 sshd[3289338]: Disconnected from invalid user anonymous 35.237.94.18 port 38112 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 21:34:41 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<JDL5v1VHqMYv/AU1>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.237.94.18
country_id: 6252001
description:
Jan  1 21:35:02 host2 sshd[3289971]: Disconnected from invalid user op 35.237.94.18 port 51950 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.191.212.112
country_id: 337996
description:
Jan  1 21:35:46 host2 sshd[3290771]: Disconnected from invalid user ftpuser 196.191.212.112 port 17374 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.28.242.198
country_id: 2361809
description:
Jan  1 21:35:34 host2 sshd[3290637]: Disconnected from invalid user felipe 196.28.242.198 port 59788 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.237.94.18
country_id: 6252001
description:
Jan  1 21:35:44 host2 sshd[3290764]: Disconnected from invalid user ubuntu 35.237.94.18 port 37502 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.28.242.198
country_id: 2361809
description:
Jan  1 21:36:53 host2 sshd[3291864]: Disconnected from invalid user www 196.28.242.198 port 58606 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  1 21:37:04 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 8 secs): user=<sales@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<QN0uyFVHEp+eRdGr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.191.212.112
country_id: 337996
description:
Jan  1 21:37:52 host2 sshd[3292772]: Disconnected from invalid user sander 196.191.212.112 port 1167 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.208.24.217
country_id: 6252001
description:
Jan  1 21:38:20 host2 sshd[3293183]: Disconnected from invalid user olivier 172.208.24.217 port 32296 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.191.212.112
country_id: 337996
description:
Jan  1 21:38:30 host2 sshd[3293319]: Disconnected from invalid user deploy 196.191.212.112 port 17414 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  1 21:39:32 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<z8Jb0VVHHOwyBsPO>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.219.237.115
country_id: 6252001
description:
Jan  1 21:41:49 host2 pure-ftpd[3296700]: (?@104.219.237.115) [INFO] New connection from 104.219.237.115


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  1 21:42:53 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<phhD3VVHBAB100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  1 21:46:57 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<z8DN61VH7pVnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  1 21:49:55 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<OwWB9lVHfOai8GQy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  1 21:52:08 host2 sshd[3305901]: Disconnected from invalid user admin 2.57.121.112 port 34299 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  1 21:52:20 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<bhgU/1VH/RVniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 21:54:35 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<Q+kvB1ZHALQjupN+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 176.125.229.142
country_id: 3194884
description:
Jan  1 21:55:57 host2 pure-ftpd[3310004]: (?@176.125.229.142) [INFO] New connection from 176.125.229.142


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 173.244.49.49
country_id: 1668284
description:
Jan  1 21:55:57 host2 pure-ftpd[3310015]: (?@173.244.49.49) [INFO] New connection from 173.244.49.49


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.90.124.135
country_id: 3042225
description:
Jan  1 21:56:00 host2 dovecot[3122720]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=91.90.124.135, lip=66.85.158.91, session=<8HJhDFZHxtNbWnyH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.239.205.23
country_id: 3595528
description:
Jan  1 21:56:00 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=173.239.205.23, lip=66.85.158.91, TLS, session=<zWxjDFZHXpKt780X>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.80.150.222
country_id: 3190538
description:
Jan  1 21:56:00 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.80.150.222, lip=66.85.158.91, session=<4D1kDFZH7onDUJbe>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.34.242.250
country_id: 2963597
description:
Jan  1 21:56:00 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=149.34.242.250, lip=66.85.158.91, TLS, session=<Qh5kDFZHjLmVIvL6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.253.160.157
country_id: 174982
description:
Jan  1 21:56:00 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=185.253.160.157, lip=66.85.158.91, TLS handshaking: Connection closed, session=<1OJjDFZHGNG5/aCd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.213.175.140
country_id: 2510769
description:
Jan  1 21:55:39 host2 sshd[3309736]: Disconnected from invalid user db2admin 185.213.175.140 port 1688 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 21:56:18 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<zilSDVZHjogv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.213.175.140
country_id: 2510769
description:
Jan  1 21:56:51 host2 sshd[3311028]: Disconnected from invalid user tanvir 185.213.175.140 port 31596 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.213.175.140
country_id: 2510769
description:
Jan  1 21:57:21 host2 sshd[3311470]: Disconnected from invalid user bitrix 185.213.175.140 port 43488 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 22:00:13 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<JhZIG1ZH6q4zTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  1 22:00:26 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<OYzsG1ZHcNWeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  1 22:00:41 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<7Wn1HFZHaNxn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Jan  1 22:01:27 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<Zbm8H1ZHFMiYNcU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.188
country_id: 6252001
description:
Jan  1 22:01:47 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=65.49.1.188, lip=66.85.158.91, session=<QJEFIVZHKXVBMQG8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.182
country_id: 6252001
description:
Jan  1 22:01:58 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.182, lip=66.85.158.91, TLS: Connection closed, session=<Z7+3IVZHjldBMQG2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 22:03:55 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<brmPKFZH3tCeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  1 22:06:04 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<K7gSMFZHLg9o7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 22:05:22 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<zMPDLVZHRNIzTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2026-01-01 22:06:24 dovecot_plain authenticator failed for H=c-73-197-236-163.hsd1.nj.comcast.net (helromult) [73.197.236.163]:33320: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  1 22:11:24 host2 sshd[3325300]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.187.58.165
country_id: 1269750
description:
2026-01-01 22:10:08 dovecot_plain authenticator failed for H=(P756S1ACH72QLPV) [115.187.58.165]:60451: 535 Incorrect authentication data (set_id=kasunp@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 22:10:19 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<UTJsP1ZHroYjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 59.98.83.57
country_id: 1269750
description:
Jan  1 22:12:07 host2 sshd[3325986]: Disconnected from invalid user postgres 59.98.83.57 port 44030 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 130.131.161.17
country_id: 6252001
description:
Jan  1 22:14:10 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=130.131.161.17, lip=66.85.158.91, TLS, session=<JzhZTVZHLqqCg6ER>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 59.98.83.57
country_id: 1269750
description:
Jan  1 22:14:16 host2 sshd[3329345]: Disconnected from invalid user odoo 59.98.83.57 port 43950 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  1 22:14:27 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<qQMwTlZHhF2i8Jp9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.76.120.30
country_id: 3469034
description:
Jan  1 22:15:06 host2 sshd[3332361]: Disconnected from invalid user userlog 201.76.120.30 port 34740 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  1 22:16:51 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<QhbDVlZHoItCdMzo>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.28.57.98
country_id: 1643084
description:
Jan  1 22:17:04 host2 sshd[3340487]: Disconnected from invalid user userlog 103.28.57.98 port 25089 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.28.57.98
country_id: 1643084
description:
Jan  1 22:16:21 host2 sshd[3336700]: Disconnected from invalid user test2 103.28.57.98 port 18185 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.76.120.30
country_id: 3469034
description:
Jan  1 22:16:38 host2 sshd[3337761]: Disconnected from invalid user postgres 201.76.120.30 port 34414 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.76.120.30
country_id: 3469034
description:
Jan  1 22:17:20 host2 sshd[3341993]: Disconnected from invalid user test 201.76.120.30 port 48364 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 158.69.223.34
country_id: 6251999
description:
Jan  1 22:17:21 host2 sshd[3342183]: Received disconnect from 158.69.223.34 port 32826:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.28.57.98
country_id: 1643084
description:
Jan  1 22:17:43 host2 sshd[3343203]: Disconnected from invalid user admin 103.28.57.98 port 31988 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 86.54.42.188
country_id: 241170
description:
Jan  1 22:17:51 host2 sshd[3343613]: Disconnected from invalid user admin 86.54.42.188 port 41846 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  1 22:18:53 host2 pure-ftpd[3344697]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.28.57.98
country_id: 1643084
description:
Jan  1 22:18:24 host2 sshd[3344234]: Disconnected from invalid user ansible 103.28.57.98 port 38889 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.223.34
country_id: 6251999
description:
Jan  1 22:18:40 host2 sshd[3344486]: Disconnected from invalid user milan 158.69.223.34 port 51574 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.223.34
country_id: 6251999
description:
Jan  1 22:19:20 host2 sshd[3345082]: Disconnected from invalid user roota 158.69.223.34 port 55474 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.76.120.30
country_id: 3469034
description:
Jan  1 22:21:08 host2 sshd[3346910]: Disconnected from invalid user frappe 201.76.120.30 port 33426 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 158.69.223.34
country_id: 6251999
description:
Jan  1 22:20:23 host2 sshd[3346265]: Disconnected from invalid user ubuntu 158.69.223.34 port 53786 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 86.54.42.188
country_id: 241170
description:
Jan  1 22:20:48 host2 sshd[3346634]: Disconnected from invalid user root2 86.54.42.188 port 57290 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 22:22:10 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<OdrTaVZHWsieRdY+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.248.139
country_id: 1880251
description:
Jan  1 22:21:17 host2 sshd[3347067]: Disconnected from invalid user ansible 188.166.248.139 port 35272 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 86.54.42.188
country_id: 241170
description:
Jan  1 22:21:46 host2 sshd[3347500]: Received disconnect from 86.54.42.188 port 49806:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 86.54.42.188
country_id: 241170
description:
Jan  1 22:21:46 host2 sshd[3347500]: Disconnected from invalid user testftp 86.54.42.188 port 49806 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.76.120.30
country_id: 3469034
description:
Jan  1 22:21:55 host2 sshd[3347666]: Disconnected from invalid user admin 201.76.120.30 port 47382 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.248.139
country_id: 1880251
description:
Jan  1 22:22:40 host2 sshd[3348413]: Disconnected from invalid user frappe 188.166.248.139 port 52548 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  1 22:23:50 host2 sshd[3349750]: Disconnected from invalid user admin 2.57.121.112 port 57201 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.248.139
country_id: 1880251
description:
Jan  1 22:24:50 host2 sshd[3350655]: Disconnected from invalid user sammy 188.166.248.139 port 49672 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 59.98.83.57
country_id: 1269750
description:
Jan  1 22:26:26 host2 sshd[3352193]: Disconnected from invalid user admin 59.98.83.57 port 53902 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 188.166.248.139
country_id: 1880251
description:
Jan  1 22:26:28 host2 sshd[3352272]: Disconnected from invalid user admin 188.166.248.139 port 39458 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  1 22:29:05 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<AFuUglZHMOUFhXlo>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 216.218.206.69
country_id: 6252001
description:
Jan  1 22:31:02 host2 pure-ftpd[3356570]: (?@216.218.206.69) [INFO] New connection from 216.218.206.69


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  1 22:31:00 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: Connection closed, session=<onaLiVZHfowDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  1 22:31:21 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: Connection closed, session=<WkPOilZHnOYDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  1 22:32:13 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<ANPpjVZHnpMDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.157.109.95
country_id: 453733
description:
Jan  1 22:33:45 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=185.157.109.95, lip=66.85.158.91, TLS, session=<DSpdklZH8L+5nW1f>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.207.35.196
country_id: 6290252
description:
Jan  1 22:34:03 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<charanaw>, method=PLAIN, rip=109.207.35.196, lip=66.85.158.91, TLS, session=<VxB0k1ZH+phtzyPE>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.38.106.200
country_id: 2802361
description:
Jan  1 22:34:14 host2 pure-ftpd[3359586]: (?@34.38.106.200) [INFO] New connection from 34.38.106.200


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  1 22:34:45 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<7Or5llZHUOwDhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.4.10.9
country_id: 3469034
description:
Jan  1 22:35:46 host2 sshd[3360930]: Disconnected from invalid user pokemon 189.4.10.9 port 44848 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  1 22:37:02 host2 dovecot[3122720]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<y4oXn1ZHDpgDhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.166.242.149
country_id: 6252001
description:
Jan  1 22:36:13 host2 sshd[3361345]: Disconnected from invalid user test01 43.166.242.149 port 40766 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  1 22:37:10 host2 dovecot[3122720]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<XtaTn1ZH7JEDhBfJ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.166.242.149
country_id: 6252001
description:
Jan  1 22:39:05 host2 sshd[3363807]: Disconnected from invalid user frappe 43.166.242.149 port 50160 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  1 22:39:09 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: Connection closed, session=<n4i1plZHHLADhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 22:39:13 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<61PPplZHPOgv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.166.242.149
country_id: 6252001
description:
Jan  1 22:40:09 host2 sshd[3364709]: Disconnected from invalid user misha 43.166.242.149 port 33784 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  1 22:41:09 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<oavSrVZHvOwDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  1 22:40:43 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<pkMlrFZH+aR100Db>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  1 22:41:17 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<o1pUrlZHOtgDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  1 22:43:15 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<YuhQtVZHXpEDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  1 22:46:45 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<RjTBwVZHNx9niu0S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.240.54
country_id: 2921044
description:
Jan  1 22:47:29 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=46.101.240.54, lip=66.85.158.92, session=<0ReAxFZHrX4uZfA2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.193.56
country_id: 2921044
description:
Jan  1 22:47:38 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=46.101.193.56, lip=66.85.158.92, session=<vC4CxVZHcBEuZcE4>


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 207.90.244.14
country_id: 6252001
description:
Jan  1 22:49:25 host2 pure-ftpd[3373652]: (?@207.90.244.14) [INFO] New connection from 207.90.244.14


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  1 22:49:56 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<vwAgzVZHppOi8GQy>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 207.90.244.14
country_id: 6252001
description:
Jan  1 22:49:20 host2 pure-ftpd[3373568]: (?@207.90.244.14) [INFO] New connection from 207.90.244.14


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.27.27
country_id: 3923057
description:
Jan  1 22:49:46 host2 sshd[3373964]: Disconnected from invalid user test 190.181.27.27 port 49090 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.72.233.36
country_id: 2464461
description:
Jan  1 22:51:03 host2 sshd[3375266]: Disconnected from invalid user api_user 154.72.233.36 port 54596 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.4.10.9
country_id: 3469034
description:
Jan  1 22:50:25 host2 sshd[3374723]: Disconnected from invalid user tsbot 189.4.10.9 port 59986 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.72.233.36
country_id: 2464461
description:
Jan  1 22:51:41 host2 sshd[3375796]: Disconnected from invalid user sun 154.72.233.36 port 48874 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.255.157.62
country_id: 3469034
description:
Jan  1 22:52:10 host2 sshd[3376262]: Disconnected from invalid user ftproot 138.255.157.62 port 50514 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  1 22:52:21 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<d0zA1VZHlsAvWBNS>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.255.157.62
country_id: 3469034
description:
Jan  1 22:54:10 host2 sshd[3378114]: Disconnected from invalid user sftpuser 138.255.157.62 port 33346 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.124.127
country_id: 1819730
description:
Jan  1 22:53:28 host2 sshd[3377536]: Disconnected from invalid user sftpuser 101.36.124.127 port 32868 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  1 22:55:01 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<VDlN31ZHLO5nmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.224.170
country_id: 1880251
description:
Jan  1 22:54:46 host2 sshd[3379270]: Disconnected from invalid user user01 68.183.224.170 port 40392 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 22:54:48 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<yFSE3lZH4iwjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.59.55.50
country_id: 1269750
description:
Jan  1 22:55:19 host2 sshd[3379976]: Disconnected from invalid user uploader 137.59.55.50 port 40490 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.84.144.113
country_id: 6252001
description:
Jan  1 22:55:38 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.84.144.113, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<ja+f4VZHeOIUVJBx>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.59.55.50
country_id: 1269750
description:
Jan  1 22:57:04 host2 sshd[3382093]: Disconnected from invalid user pub 137.59.55.50 port 36964 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.183.224.170
country_id: 1880251
description:
Jan  1 22:56:50 host2 sshd[3381803]: Disconnected from invalid user dev 68.183.224.170 port 50492 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.27.27
country_id: 3923057
description:
Jan  1 22:57:36 host2 sshd[3382627]: Disconnected from invalid user nextcloud 190.181.27.27 port 46608 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.124.127
country_id: 1819730
description:
Jan  1 22:57:53 host2 sshd[3382840]: Disconnected from invalid user ftproot 101.36.124.127 port 47634 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 79.110.118.226
country_id: 732800
description:
Jan  1 22:58:43 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=79.110.118.226, lip=66.85.158.91, TLS, session=<Gh2w61ZHwMVPbnbi>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.124.127
country_id: 1819730
description:
Jan  1 22:59:05 host2 sshd[3383960]: Disconnected from invalid user ubuntu 101.36.124.127 port 36338 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.125.4.14
country_id: 798544
description:
Jan  1 22:58:25 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=185.125.4.14, lip=66.85.158.91, TLS, session=<yCGc6lZHzNS5fQQO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.124.127
country_id: 1819730
description:
Jan  1 22:58:32 host2 sshd[3383406]: Disconnected from invalid user mine 101.36.124.127 port 49726 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  1 22:58:30 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<qcG861ZHvo9n9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.27.27
country_id: 3923057
description:
Jan  1 22:58:17 host2 sshd[3383227]: Disconnected from invalid user test 190.181.27.27 port 41938 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.238.104
country_id: 1643084
description:
Jan  1 23:00:18 host2 sshd[3385296]: Disconnected from invalid user dev 103.49.238.104 port 42998 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 23:00:44 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<6XrC81ZHtLov/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2026-01-01 23:00:55 dovecot_login authenticator failed for H=(187-51-252-236.customer.tdatabrasil.net.br) [186.201.54.90]:54622: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.15
country_id: 1733045
description:
2026-01-01 23:01:14 dovecot_login authenticator failed for H=([49.124.151.15]) [49.124.151.15]:36352: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.173.160.152
country_id: 6252001
description:
Jan  1 23:01:31 host2 sshd[3386431]: Disconnected from invalid user chromeuser 107.173.160.152 port 37484 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.115.134
country_id: 6252001
description:
Jan  1 23:02:13 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 8 secs): user=<>, rip=45.79.115.134, lip=66.85.158.91, session=<Ybgt+VZH04UtT3OG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 23:02:28 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<bGHs+VZHGsSeRdY+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.160.152
country_id: 6252001
description:
Jan  1 23:02:48 host2 sshd[3387604]: Disconnected from invalid user filip 107.173.160.152 port 55978 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 23:10:42 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<APdlF1dH1GwjupN+>


