# incident

plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 06:44:17 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<cpanel@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<PWDt5K1H2IAIhpC/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2026-01-06 06:45:47 dovecot_plain authenticator failed for H=(bellin) [102.53.15.180]:42445: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.163.123.45
country_id: 1880251
description:
Jan  6 06:44:59 host2 sshd[1521498]: Disconnected from invalid user claude 43.163.123.45 port 48004 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 06:46:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<cpanel@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<dt41661HtNJCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 06:47:16 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contacts@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<OOiN761H0qxA46ZK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.163.123.45
country_id: 1880251
description:
Jan  6 06:47:28 host2 sshd[1524181]: Disconnected from invalid user tester 43.163.123.45 port 33644 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.230.231
country_id: 1861060
description:
Jan  6 06:47:41 host2 sshd[1524338]: Disconnected from invalid user claude 118.194.230.231 port 46928 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.194.230.231
country_id: 1861060
description:
Jan  6 06:48:22 host2 sshd[1524966]: Disconnected from invalid user qw 118.194.230.231 port 46988 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 06:48:16 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<commercial@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<cRgm861Hpu0IijoY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.163.123.45
country_id: 1880251
description:
Jan  6 06:49:50 host2 sshd[1526133]: Disconnected from invalid user ubuntu 43.163.123.45 port 52918 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.32.48.81
country_id: 6251999
description:
2026-01-06 06:50:30 dovecot_login authenticator failed for H=(ADMIN) [212.32.48.81]:19190: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  6 06:51:43 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<rPWc/61H6MADhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2026-01-06 06:51:45 dovecot_login authenticator failed for H=([152.52.234.46]) [182.95.176.194]:42272: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 166.198.103.11
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 166.198.103.11 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.41.251.88
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 73.41.251.88 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.108.117.44
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 74.108.117.44 - tradeceylon "GET /login/?login_only=1&user=tradeceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.123.5.44
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 99.123.5.44 - tradeceylo "GET /login/?login_only=1&user=tradeceylo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceylo (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.175.193.205
country_id: 1269750
description:
Jan  6 06:52:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postmaster@sobaherbal.com>, method=PLAIN, rip=122.175.193.205, lip=66.85.158.91, session=<YbiDAK5H5uZ6r8HN>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.163.123.45
country_id: 1880251
description:
Jan  6 06:52:40 host2 sshd[1528884]: Disconnected from invalid user john 43.163.123.45 port 55826 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.241.61.64
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 108.241.61.64 - tradeceyloncom "GET /login/?login_only=1&user=tradeceyloncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyloncom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.149.79
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 172.58.149.79 - tradece2 "GET /login/?login_only=1&user=tradece2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece2 (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 06:52:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<VOmlAa5H+qIifrCV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  6 06:52:31 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: Connection closed, session=<FKd3Aq5HeLADhBfJ>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 122.175.193.205
country_id: 1269750
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[122.175.193.205] [Remote Port]=[59110] [Authentication Database]=[mail] [Username]=[postmaster@sobaherbal.com] (10/10 failures) (blocked until [Wed Jan  7 01:21:58 2026 UTC/Wed Jan  7 06:51:58 2026 LOCAL])


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.197.36.151
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 107.197.36.151 - tradecey "GET /login/?login_only=1&user=tradecey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradecey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.65.144.107
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 99.65.144.107 - tradece "GET /login/?login_only=1&user=tradece&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.10.0.164
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 68.10.0.164 - trade "GET /login/?login_only=1&user=trade&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trade (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 140.186.244.228
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 140.186.244.228 - tradece1 "GET /login/?login_only=1&user=tradece1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.105.245.48
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 143.105.245.48 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.150.97.94
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 69.150.97.94 - tradec "GET /login/?login_only=1&user=tradec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 147.136.9.237
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 147.136.9.237 - trad "GET /login/?login_only=1&user=trad&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trad (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 199.241.224.114
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 199.241.224.114 - tra "GET /login/?login_only=1&user=tra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tra (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.20.84.55
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 76.20.84.55 - tr "GET /login/?login_only=1&user=tr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tr (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.222
country_id: 1733045
description:
2026-01-06 06:52:12 dovecot_login authenticator failed for H=([49.124.152.222]) [49.124.152.222]:49240: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 06:52:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<client@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<5jUjAa5HlLei8KbF>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.228.114.202
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 68.228.114.202 - tradeceyl "GET /login/?login_only=1&user=tradeceyl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyl (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.49.246.176
country_id: 6252001
description:
Jan  6 06:54:12 host2 sshd[1530322]: Disconnected from invalid user celery 69.49.246.176 port 41242 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  6 06:54:13 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<yeCDCK5HougDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 06:54:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contacts@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<Zj4UCa5H7LMyBsPO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  6 06:55:20 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<hVuJDK5H3KQDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 06:55:37 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notice@sobaherbal.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<mTZoDa5H9uAvWBNS>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 69.49.246.176
country_id: 6252001
description:
Jan  6 06:55:48 host2 sshd[1532137]: Disconnected from invalid user claude 69.49.246.176 port 40308 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  6 06:55:56 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<6MqrDq5HdK8DhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.49.246.176
country_id: 6252001
description:
Jan  6 06:56:17 host2 sshd[1532565]: Disconnected from invalid user testuser 69.49.246.176 port 33384 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  6 06:56:51 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: Connection closed, session=<W+/6Ea5HEsgDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 06:58:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<1S8lFq5HbtVm2gqW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.28.242.198
country_id: 2361809
description:
Jan  6 06:58:12 host2 sshd[1534326]: Disconnected from invalid user luser 196.28.242.198 port 52604 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Jan  6 06:58:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<ni2XGK5HditetwuC>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.16
country_id: 2635167
description:
Jan  6 06:59:04 host2 dovecot[1170291]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.16, lip=66.85.158.92, TLS, session=<2xbgGa5HJ+e594kQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.80
country_id: 2635167
description:
Jan  6 06:59:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.80, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<pIfFGq5H+9O594lQ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.28.242.198
country_id: 2361809
description:
Jan  6 06:59:33 host2 sshd[1535502]: Disconnected from invalid user testuser 196.28.242.198 port 55182 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  6 06:58:54 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<EblRGa5HGOkDhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.28.242.198
country_id: 2361809
description:
Jan  6 07:00:11 host2 sshd[1536263]: Disconnected from invalid user webadm 196.28.242.198 port 44084 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.78
country_id: 2635167
description:
Jan  6 07:00:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.78, lip=66.85.158.92, TLS handshaking: Connection closed, session=<NQq8Hq5Hd+C594lO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.76
country_id: 2635167
description:
Jan  6 06:59:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.76, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<C8zAHK5HXbG594lM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.100
country_id: 2635167
description:
Jan  6 07:00:59 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=185.247.137.100, lip=66.85.158.92, TLS handshaking: Connection closed, session=<B223IK5Hc6K594lk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.89
country_id: 2635167
description:
Jan  6 07:01:32 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.89, lip=66.85.158.92, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<BNeyIq5Hv6FX7LBZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.100
country_id: 2635167
description:
Jan  6 07:02:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.100, lip=66.85.158.92, TLS handshaking: Connection closed, session=<+3qpJq5Hb5e594lk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.106
country_id: 2635167
description:
Jan  6 07:02:05 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.106, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<hy+sJK5H+55X7LBq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 07:02:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<h3HuJa5HqqV100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 07:02:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<commercial@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<PrsVJq5HKNQIijoY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.81
country_id: 2635167
description:
Jan  6 07:03:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=87.236.176.81, lip=66.85.158.92, TLS handshaking: Connection closed, session=<+tqkKK5HQ61X7LBR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  6 07:03:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@melanifinefood.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<Dwl3Kq5H7NEyBvlc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.91
country_id: 2635167
description:
Jan  6 07:03:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<yCyeKq5HLdpX7LBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.93
country_id: 2635167
description:
Jan  6 07:04:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.93, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<5ZWZLK5HJZJX7LBd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 07:06:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<L9hxM65HLJii8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 07:08:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notice@lankaherbalsolutions.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<miz9PK5HKoovWBNS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.133.47.11
country_id: 1522867
description:
2026-01-06 07:09:29 dovecot_login authenticator failed for H=(ADMIN) [62.133.47.11]:14428: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 07:10:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<L8zgQK5HSecz0msW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.184.83.17
country_id: 6252001
description:
2026-01-06 07:10:22 dovecot_login authenticator failed for H=h17.83.184.173.dynamic.ip.windstream.net [173.184.83.17]:54732: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.103.120.150
country_id: 1819730
description:
2026-01-06 07:10:43 dovecot_login authenticator failed for H=150.120.103.218.static.netvigator.com [218.103.120.150]:52636: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 07:12:37 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contacts@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<TCk1Sq5H6JVA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 07:14:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<l2fFT65HyOlm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 07:16:48 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sale@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<gTUuWa5H/p1CdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  6 07:17:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<cpanel@melanifinefood.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<BAgMW65H/LUyBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 07:18:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<panel@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<Z0wNXq5HJuUIhpC/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 07:19:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<43ldYq5H/KVA46ZK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.39.58.191
country_id: 2635167
description:
Jan  6 07:19:30 host2 sshd[1555464]: Disconnected from invalid user logger 34.39.58.191 port 33962 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.39.58.191
country_id: 2635167
description:
Jan  6 07:20:02 host2 sshd[1555854]: Disconnected from invalid user csczserver 34.39.58.191 port 32908 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.39.58.191
country_id: 2635167
description:
Jan  6 07:21:04 host2 sshd[1556934]: Disconnected from invalid user m1 34.39.58.191 port 41638 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.190.155.43
country_id: 6252001
description:
2026-01-06 07:21:35 dovecot_plain authenticator failed for H=(hienests) [76.190.155.43]:35085: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 07:22:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<nEjxbK5HsI4IijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 07:22:53 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<q+z1bq5HdpKi8KbF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 07:24:42 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<dg1xda5HzL0yBsPO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.250.81.123
country_id: 1733045
description:
Jan  6 07:24:22 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=783) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=47.250.81.123, lip=66.85.158.91, TLS handshaking: read(size=783) failed: Connection reset by peer, session=<DyBjdK5HOKAv+lF7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.175.193.205
country_id: 1269750
description:
Jan  6 07:24:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shop@lankaherbalsolutions.com>, method=PLAIN, rip=122.175.193.205, lip=66.85.158.91, session=<+sm4dK5HruF6r8HN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.250.81.123
country_id: 1733045
description:
Jan  6 07:24:53 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=47.250.81.123, lip=66.85.158.91, TLS, session=<h00wdq5HPKAv+lF7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 07:26:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mail@sobaherbal.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<zlLxe65HvK8vWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 07:26:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<0QAsfa5H5LYifrCV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-06 07:34:35 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:49591: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.232.44
country_id: 2542007
description:
2026-01-06 07:35:47 dovecot_login authenticator failed for H=(ADMIN) [95.181.232.44]:17988: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.248.129.252
country_id: 2921044
description:
Jan  6 07:43:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=104.248.129.252, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<DWmiua5H05Bo+IH8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2026-01-06 07:43:13 dovecot_login authenticator failed for H=([196.191.212.236]) [213.55.85.202]:4086: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.217.204.91
country_id: 2658434
description:
2026-01-06 07:43:26 dovecot_login authenticator failed for H=adsl-89-217-204-91.adslplus.ch [89.217.204.91]:33370: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.123
country_id: 6252001
description:
Jan  6 07:43:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 16 secs): user=<>, rip=66.132.153.123, lip=66.85.158.91, TLS handshaking: Connection closed, session=<7Zuoua5HDghChJl7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.122.80
country_id: 2921044
description:
Jan  6 07:44:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=46.101.122.80, lip=66.85.158.91, TLS handshaking: Connection closed, session=<oJC8u65HdMcuZXpQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.248.129.252
country_id: 2921044
description:
Jan  6 07:43:56 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=104.248.129.252, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<Nhleuq5HuTNo+IH8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.143
country_id: 6252001
description:
Jan  6 07:45:21 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.143, lip=66.85.158.91, TLS: Connection closed, session=<IGZpv65HBjJChJmP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 161.35.79.234
country_id: 2921044
description:
Jan  6 07:44:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=161.35.79.234, lip=66.85.158.91, TLS handshaking: Connection closed, session=<3DHNva5HbrWhI0/q>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 212.154.234.9
country_id: 1522867
description:
Jan  6 07:46:46 host2 sshd[1581515]: Disconnected from invalid user nc 212.154.234.9 port 58881 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.154.234.9
country_id: 1522867
description:
Jan  6 07:47:33 host2 sshd[1582183]: Disconnected from invalid user bodega 212.154.234.9 port 11399 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.154.234.9
country_id: 1522867
description:
Jan  6 07:48:07 host2 sshd[1582682]: Disconnected from invalid user minecraft 212.154.234.9 port 41920 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.106.76
country_id: 3469034
description:
Jan  6 07:49:36 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=187.120.106.76, lip=66.85.158.91, TLS, session=<eG51za5HV4G7eGpM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.87.201.135
country_id: 3469034
description:
Jan  6 07:49:57 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=177.87.201.135, lip=66.85.158.91, TLS, session=<Cai4zq5H8tGxV8mH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.47.53.19
country_id: 798549
description:
Jan  6 07:53:39 host2 sshd[1588195]: Disconnected from invalid user admin 89.47.53.19 port 32794 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.121.61.198
country_id: 3017382
description:
2026-01-06 07:55:07 dovecot_login authenticator failed for H=ip198.ip-91-121-61.eu (ADMIN) [91.121.61.198]:57084: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.47.53.19
country_id: 798549
description:
Jan  6 07:55:18 host2 sshd[1590429]: Disconnected from invalid user admin 89.47.53.19 port 40382 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.156.128.122
country_id: 2264397
description:
Jan  6 07:56:35 host2 pure-ftpd[1591787]: (?@45.156.128.122) [INFO] New connection from 45.156.128.122


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 89.47.53.19
country_id: 798549
description:
Jan  6 07:56:48 host2 sshd[1592006]: Disconnected from invalid user claude 89.47.53.19 port 47382 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.47.53.19
country_id: 798549
description:
Jan  6 07:57:19 host2 sshd[1592496]: Disconnected from invalid user claude 89.47.53.19 port 59122 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.154.77.48
country_id: 1643084
description:
Jan  6 07:57:42 host2 sshd[1592882]: Disconnected from invalid user claude 103.154.77.48 port 48830 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.89.28.139
country_id: 1643084
description:
Jan  6 07:58:49 host2 sshd[1593869]: Disconnected from invalid user ghost 36.89.28.139 port 42994 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.89.28.139
country_id: 1643084
description:
Jan  6 07:59:26 host2 sshd[1594426]: Disconnected from invalid user sun 36.89.28.139 port 39444 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.154.77.48
country_id: 1643084
description:
Jan  6 07:59:46 host2 sshd[1594677]: Disconnected from invalid user admin 103.154.77.48 port 55714 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.154.77.48
country_id: 1643084
description:
Jan  6 08:00:54 host2 sshd[1595925]: Disconnected from invalid user claude 103.154.77.48 port 49576 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.97.24.41
country_id: 732800
description:
Jan  6 08:01:44 host2 sshd[1596699]: Disconnected from invalid user xuhao 83.97.24.41 port 60332 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 08:01:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<btX8+a5HMtgifrCV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.218.149
country_id: 1880251
description:
Jan  6 08:02:03 host2 sshd[1597177]: Disconnected from invalid user admin 152.32.218.149 port 40174 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 83.97.24.41
country_id: 732800
description:
Jan  6 08:02:14 host2 sshd[1597331]: Disconnected from invalid user tung 83.97.24.41 port 44104 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.64.27.145
country_id: 3932488
description:
Jan  6 08:02:42 host2 sshd[1597765]: Disconnected from invalid user tung 181.64.27.145 port 52936 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.89.28.139
country_id: 1643084
description:
Jan  6 08:01:59 host2 sshd[1597080]: Disconnected from invalid user claude 36.89.28.139 port 49468 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.164.107.6
country_id: 6252001
description:
Jan  6 08:03:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=194.164.107.6, lip=66.85.158.92, session=<I85T/65HEKPCpGsG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.89.28.139
country_id: 1643084
description:
Jan  6 08:03:17 host2 sshd[1598441]: Disconnected from invalid user testuser 36.89.28.139 port 55588 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.64.27.145
country_id: 3932488
description:
Jan  6 08:03:21 host2 sshd[1598569]: Disconnected from invalid user terry 181.64.27.145 port 43070 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.218.149
country_id: 1880251
description:
Jan  6 08:04:00 host2 sshd[1599154]: Disconnected from invalid user claude 152.32.218.149 port 35468 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.64.27.145
country_id: 3932488
description:
Jan  6 08:05:26 host2 sshd[1600838]: Disconnected from invalid user adminuser 181.64.27.145 port 36612 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.64.27.145
country_id: 3932488
description:
Jan  6 08:06:06 host2 sshd[1601402]: Disconnected from invalid user claude 181.64.27.145 port 52370 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.203.22
country_id: 1880251
description:
Jan  6 08:06:12 host2 sshd[1601490]: Disconnected from invalid user test 45.78.203.22 port 43018 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.64.27.145
country_id: 3932488
description:
Jan  6 08:06:46 host2 sshd[1601935]: Disconnected from invalid user ashok 181.64.27.145 port 56512 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 166.170.48.43
country_id: 6252001
description:
Jan  6 08:07:03 host2 sshd[1602204]: Disconnected from invalid user proxyuser 166.170.48.43 port 63401 [preauth]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 195.178.110.132
country_id: 732800
description:
Denial of Service (DoS) attack was discovered from 195.178.110.132: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 166.170.48.43
country_id: 6252001
description:
Jan  6 08:07:47 host2 sshd[1602839]: Disconnected from invalid user dk 166.170.48.43 port 2174 [preauth]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 195.178.110.132
country_id: 732800
description:
Denial of Service (DoS) attack was discovered from 195.178.110.132: 445 connections per 30 seconds to 443 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.188.130
country_id: 3144096
description:
2026-01-06 08:08:33 dovecot_login authenticator failed for H=(cm-84.213.188.130.get.no) [84.213.188.130]:50226: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.50.154
country_id: 1269750
description:
2026-01-06 08:08:45 dovecot_login authenticator failed for H=([125.19.93.105]) [182.95.50.154]:45708: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 166.170.48.43
country_id: 6252001
description:
Jan  6 08:08:59 host2 sshd[1604324]: Disconnected from invalid user alice 166.170.48.43 port 24219 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.142
country_id: 1269750
description:
2026-01-06 08:09:04 dovecot_login authenticator failed for H=([128.185.227.142]) [128.185.227.142]:39444: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.84
country_id: 1210997
description:
2026-01-06 08:09:15 dovecot_login authenticator failed for H=([103.115.252.60]) [103.115.252.84]:44304: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.142
country_id: 1269750
description:
2026-01-06 08:09:50 dovecot_login authenticator failed for H=([182.79.202.89]) [182.95.230.142]:37414: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.203.22
country_id: 1880251
description:
Jan  6 08:10:25 host2 sshd[1605774]: Disconnected from invalid user bitrix 45.78.203.22 port 51104 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.32.122.72
country_id: 597427
description:
2026-01-06 08:13:15 dovecot_login authenticator failed for H=(ADMIN) [194.32.122.72]:1325: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2026-01-06 08:17:36 dovecot_plain authenticator failed for H=(genear) [65.20.205.197]:52239: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2026-01-06 08:18:23 dovecot_plain authenticator failed for H=c-73-137-7-97.hsd1.ga.comcast.net (eltessal) [73.137.7.97]:32984: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2026-01-06 08:18:21 dovecot_plain authenticator failed for H=(heratrid) [23.30.11.253]:38754: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-01-06 08:22:32 dovecot_plain authenticator failed for H=host-196-47-172-253.afnet.net (ocyper) [196.47.172.253]:43493: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.62.238
country_id: 953987
description:
Jan  6 08:27:39 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<charanaw>, method=PLAIN, rip=102.129.62.238, lip=66.85.158.91, TLS, session=<C6B0Va9HwcZmgT7u>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 93.174.180.151
country_id: 3057568
description:
Jan  6 08:27:16 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=93.174.180.151, lip=66.85.158.91, TLS, session=<ql1NVK9H8JRdrrSX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.210
country_id: 1269750
description:
2026-01-06 08:31:07 dovecot_login authenticator failed for H=(nsg-corporate-49.218.186.122.airtel.in) [103.251.31.210]:60992: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
country_id: 99237
description:
2026-01-06 08:30:20 dovecot_login authenticator failed for H=([65.20.191.12]) [65.20.191.12]:40448: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.124.25
country_id: 3042225
description:
2026-01-06 08:30:35 dovecot_login authenticator failed for H=(ADMIN) [91.90.124.25]:45521: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.146
country_id: 1819730
description:
2026-01-06 08:30:45 dovecot_login authenticator failed for H=146.47.246.220.static.netvigator.com [220.246.47.146]:57691: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.5.135
country_id: 798544
description:
2026-01-06 08:30:50 dovecot_login authenticator failed for H=89-67-5-135.dynamic.play.pl [89.67.5.135]:60289: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.165.219
country_id: 1605651
description:
2026-01-06 08:31:04 dovecot_login authenticator failed for H=([106.0.165.219]) [106.0.165.219]:60310: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.205
country_id: 6252001
description:
Jan  6 08:32:37 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.205, lip=66.85.158.91, session=<VVZtaK9HuOHN0h/N>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.185
country_id: 6252001
description:
Jan  6 08:33:53 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.185, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<QaP2bK9HgN7N0h+5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 08:36:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<LzUdd69HxIAifrCV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.212.241.39
country_id: 1880251
description:
Jan  6 08:37:43 host2 sshd[1638067]: Disconnected from invalid user es 20.212.241.39 port 59308 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.126.105.42
country_id: 3469034
description:
2026-01-06 08:47:02 dovecot_login authenticator failed for H=187-126-105-42.user.vtal.net.br (187-126-105-145.user.vtal.net.br) [187.126.105.42]:48599: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2026-01-06 08:47:26 dovecot_login authenticator failed for H=([193.46.192.20]) [193.46.192.20]:41385: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  6 08:49:47 host2 sshd[1652717]: Disconnected from invalid user admin 2.57.121.112 port 20277 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.149.52.111
country_id: 6251999
description:
2026-01-06 08:51:37 dovecot_login authenticator failed for H=(ADMIN) [89.149.52.111]:56953: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 102.204.223.185
country_id: 2328926
description:
Jan  6 08:51:30 host2 pure-ftpd[1654994]: (?@102.204.223.185) [INFO] New connection from 102.204.223.185


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 08:52:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mail@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<tTw5sK9HRI6i8GQy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.212.241.39
country_id: 1880251
description:
Jan  6 08:53:00 host2 sshd[1656454]: Disconnected from invalid user claude 20.212.241.39 port 50704 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 08:52:32 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<iFWUr69HatUIhpC/>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 08:54:16 host2 sshd[1658251]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 08:54:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@lankaherbalsolutions.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<woC0ta9H1NwvWBNS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.21.104
country_id: 1269750
description:
2026-01-06 08:56:08 dovecot_login authenticator failed for H=(abts-north-static-104.21.176.122.airtelbroadband.in) [122.176.21.104]:35665: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.191.70.126
country_id: 6252001
description:
2026-01-06 08:56:56 dovecot_login authenticator failed for H=pool-71-191-70-126.washdc.fios.verizon.net [71.191.70.126]:56490: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 08:56:14 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<panel@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<OsTOvK9HYq4z0msW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.238.2.56
country_id: 3469034
description:
2026-01-06 08:56:30 dovecot_login authenticator failed for H=45-238-2-56.netmaisfibra.net.br [45.238.2.56]:46736: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 08:56:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postmaster@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<vlSQvq9HeLlA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 08:57:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<commercial@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<Dqe8wK9Hwumi8KbF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 08:58:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<tccPxa9H58l100Db>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.212.241.39
country_id: 1880251
description:
Jan  6 08:58:34 host2 sshd[1662829]: Disconnected from invalid user ubuntu 20.212.241.39 port 57598 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.24
country_id: 241170
description:
Jan  6 09:01:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.24, lip=66.85.158.91, session=<LEyez69HjrvE+2YY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2026-01-06 09:04:02 dovecot_plain authenticator failed for H=c-24-1-200-187.hsd1.il.comcast.net (chark) [24.1.200.187]:33478: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 09:07:19 host2 sshd[1671493]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 09:07:41 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<Tlu35a9H1KxCdMzo>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 09:09:12 host2 sshd[1673019]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 09:10:26 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postmaster@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<+huX769HcqlA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 09:11:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<invoice@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<L7lk8q9HquwIijoY>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.64.215.64
country_id: 298795
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 212.64.215.64 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 09:11:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<fSQW869HcOpm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 09:11:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<kywU869HbL0yBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 09:11:27 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<Q9Iv869HjJIifrCV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.233.17
country_id: 2993457
description:
2026-01-06 09:13:09 dovecot_login authenticator failed for H=(ADMIN) [95.181.233.17]:7683: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 09:12:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<invoice@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<PJ+H9q9HktUIijoY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.224.242.137
country_id: 2635167
description:
2026-01-06 09:13:41 dovecot_login authenticator failed for H=([109.224.242.137]) [109.224.242.137]:55022: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.102.149.135
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 191.102.149.135 - lezzarotech@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.179.59.108
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 186.179.59.108 - marketing@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2026-01-06 09:14:22 dovecot_login authenticator failed for H=(netcomafrica.com) [41.219.149.74]:65472: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.3
country_id: 1668284
description:
Jan  6 09:15:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.3, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<IdrhAbBHEcDG6xgD>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.49.50.6
country_id: 3686110
description:
Jan  6 09:18:19 host2 sshd[1681502]: Disconnected from invalid user bitrix 181.49.50.6 port 40728 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 09:18:59 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<k6cfDrBHgrRm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Jan  6 09:19:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notice@sivagnanamfoundation.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<20W8DrBH9oxetwuC>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.49.50.6
country_id: 3686110
description:
Jan  6 09:20:08 host2 sshd[1683077]: Disconnected from invalid user damian 181.49.50.6 port 52408 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.165.121.195
country_id: 1269750
description:
Jan  6 09:21:44 host2 sshd[1684587]: Disconnected from invalid user admin 122.165.121.195 port 37710 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 09:21:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@sobaherbal.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<yUW9FrBHqL8vWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 09:23:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<Pig8HbBHRM2i8GQy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.165.121.195
country_id: 1269750
description:
Jan  6 09:23:28 host2 sshd[1686226]: Disconnected from invalid user damian 122.165.121.195 port 45540 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.107.103
country_id: 1819730
description:
Jan  6 09:23:37 host2 sshd[1686351]: Disconnected from invalid user claude 101.36.107.103 port 51806 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 09:25:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<account@lankaherbalsolutions.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<KXMSJLBHfKsvWBNS>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.107.103
country_id: 1819730
description:
Jan  6 09:24:17 host2 sshd[1687030]: Disconnected from invalid user sergey 101.36.107.103 port 57816 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.165.121.195
country_id: 1269750
description:
Jan  6 09:24:18 host2 sshd[1687080]: Disconnected from invalid user claude 122.165.121.195 port 54592 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.174
country_id: 6252001
description:
Jan  6 09:24:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=205.210.31.174, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<EY+5IbBHtsPN0h+u>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.165.121.195
country_id: 1269750
description:
Jan  6 09:26:04 host2 sshd[1688729]: Disconnected from invalid user bitrix 122.165.121.195 port 55694 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 09:25:49 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<GLOQJrBHc6kz0msW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.165.121.195
country_id: 1269750
description:
Jan  6 09:26:55 host2 sshd[1689541]: Disconnected from invalid user admin 122.165.121.195 port 49264 [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 95.178.85.71
country_id: 102358
description:
Jan  6 09:27:03 host2 sshd[1689619]: Disconnecting authenticating user root 95.178.85.71 port 40984: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 95.178.85.71
country_id: 102358
description:
Jan  6 09:27:03 host2 sshd[1689619]: error: maximum authentication attempts exceeded for root from 95.178.85.71 port 40984 ssh2 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 09:26:47 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postmaster@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<QjETKrBH/IgIhpC/>


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 95.178.85.71
country_id: 102358
description:
Jan  6 09:27:13 host2 sshd[1689781]: error: maximum authentication attempts exceeded for root from 95.178.85.71 port 42184 ssh2 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2026-01-06 09:28:00 dovecot_plain authenticator failed for H=(doweged) [50.217.40.11]:40016: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 09:28:08 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<sZ/eLrBHFOui8KbF>


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 95.178.85.71
country_id: 102358
description:
Jan  6 09:27:13 host2 sshd[1689781]: Disconnecting authenticating user root 95.178.85.71 port 42184: Too many authentication failures [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.112.186.122
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 71.112.186.122 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.105.173
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 172.56.105.173 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 15.218.145.174
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 15.218.145.174 - tradece "GET /login/?login_only=1&user=tradece&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.218.190.116
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 47.218.190.116 - trade "GET /login/?login_only=1&user=trade&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trade (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.218.110.160
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 47.218.110.160 - tradeceyloncom "GET /login/?login_only=1&user=tradeceyloncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyloncom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.56.1.207
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 99.56.1.207 - tradeceylo "GET /login/?login_only=1&user=tradeceylo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceylo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.49.6.29
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 99.49.6.29 - tradeceyl "GET /login/?login_only=1&user=tradeceyl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 142.79.112.144
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 142.79.112.144 - tradec "GET /login/?login_only=1&user=tradec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.129.245.242
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 68.129.245.242 - tradece2 "GET /login/?login_only=1&user=tradece2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.138.100.159
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 69.138.100.159 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.217.47.250
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 107.217.47.250 - tradece1 "GET /login/?login_only=1&user=tradece1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.60.51.72
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 73.60.51.72 - tradeceylon "GET /login/?login_only=1&user=tradeceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.129.68
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 172.59.129.68 - tradecey "GET /login/?login_only=1&user=tradecey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradecey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.131.45.200
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 70.131.45.200 - trad "GET /login/?login_only=1&user=trad&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trad (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.23.23.146
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 184.23.23.146 - tr "GET /login/?login_only=1&user=tr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.161.249.112
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 107.161.249.112 - tra "GET /login/?login_only=1&user=tra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tra (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 09:30:34 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<account@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<s8iRN7BH6KJA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 09:31:27 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<Wh+4OrBHMPl100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.214.122.105
country_id: 357994
description:
2026-01-06 09:36:08 dovecot_login authenticator failed for H=(ADMIN) [188.214.122.105]:35038: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2026-01-06 09:38:28 dovecot_plain authenticator failed for H=c-174-169-224-27.hsd1.vt.comcast.net (meraters) [174.169.224.27]:42518: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 09:38:26 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<wrGwU7BHyrBCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 09:41:57 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<5FRHYLBHgNwyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 09:44:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<0pbiabBHluVm2gqW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.143
country_id: 6252001
description:
Jan  6 09:45:26 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.143, lip=66.85.158.91, TLS: Connection closed, session=<ypDdbLBHSLVChJmP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 09:46:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<cpanel@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<KBjBbrBHwo0IijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 09:45:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<account@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<aqudbLBH0KRA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 09:46:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<+N75b7BHdpEifrCV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 09:47:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<cpanel@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<bFMHc7BH8OQIijoY>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.122.139
country_id: 1819730
description:
Jan  6 09:48:39 host2 sshd[1709706]: Disconnected from invalid user vivek 101.36.122.139 port 39972 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Jan  6 09:51:02 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<cpanel@sivagnanamfoundation.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<NePAgLBHy49etwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 09:52:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=</4MjhbBHNO5m2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 09:52:36 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<account@sobaherbal.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<pg1lhrBH+o4vWBNS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.25.59.5
country_id: 3469034
description:
2026-01-06 09:53:56 dovecot_login authenticator failed for H=(ip-177-25-59-5.user.vivozap.com.br) [177.25.59.5]:59893: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 09:54:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<NIsqjLBHcp+i8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.224.242.137
country_id: 2635167
description:
2026-01-06 09:54:20 dovecot_login authenticator failed for H=([109.224.242.137]) [109.224.242.137]:37614: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 09:55:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<tpv1kbBH66Yz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 09:56:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@lankaherbalsolutions.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<2k/0k7BHKukvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 09:59:14 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<invoice@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<SQkXnrBHeNmi8KbF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  6 10:01:06 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<lJnkpLBHwNcDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.126
country_id: 6252001
description:
Jan  6 10:02:06 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.126, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<WnJ2qLBHgNTG6xh+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.10
country_id: 6252001
description:
Jan  6 10:01:20 host2 pure-ftpd[1720671]: (?@147.185.132.10) [INFO] New connection from 147.185.132.10


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 10:01:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<PZ1jprBHkpkIhpC/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  6 10:01:53 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<p9usp7BHhMMDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  6 10:02:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<EXndqLBH1M8DgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 10:03:41 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<aRT+rbBHzoZA46ZK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.57.148
country_id: 2921044
description:
2026-01-06 10:03:19 dovecot_login authenticator failed for H=(ADMIN) [212.102.57.148]:54968: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.106.136
country_id: 3865483
description:
Jan  6 10:04:50 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw>, method=PLAIN, rip=45.238.106.136, lip=66.85.158.91, TLS, session=<I5EnsbBHZ6Qt7mqI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.122.162
country_id: 226074
description:
Jan  6 10:04:30 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=196.0.122.162, lip=66.85.158.91, TLS, session=<tTHYr7BH88nEAHqi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 10:04:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postmaster@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<FEFnsbBH6Td100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2026-01-06 10:04:51 dovecot_plain authenticator failed for H=(stiones) [91.73.188.251]:33059: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  6 10:05:36 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<6o37tLBHSq0DgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  6 10:06:32 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS, session=<ZE5UuLBHwpADgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.107.155.206
country_id: 798544
description:
Jan  6 10:07:26 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=89.107.155.206, lip=66.85.158.91, TLS, session=<6SSQurBH8axZa5vO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.154.227.101
country_id: 3469034
description:
Jan  6 10:07:49 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<charanaw>, method=PLAIN, rip=177.154.227.101, lip=66.85.158.91, TLS, session=<yYOqu7BHKoaxmuNl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  6 10:08:48 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: Connection closed, session=<QsFrwLBHyMwDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 10:09:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<cpanel@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<8zAlwrBHgJJCdMzo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  6 10:10:59 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<sBw8yLBHKKoDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.179.18
country_id: 2921044
description:
Jan  6 10:11:35 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=164.92.179.18, lip=66.85.158.91, session=<+RppyrBH9U2kXLMS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.111.59
country_id: 2921044
description:
Jan  6 10:11:36 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=157.230.111.59, lip=66.85.158.91, session=<FPVwyrBHoIad5m87>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan  6 10:11:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS, session=<kPAPy7BHiNMDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.135
country_id: 6252001
description:
Jan  6 10:14:40 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.135, lip=66.85.158.91, session=<9rpr1bBHzdnDuEyH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.130
country_id: 6252001
description:
Jan  6 10:14:50 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=195.184.76.130, lip=66.85.158.91, session=<zb0G1rBH65HDuEyC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.131
country_id: 6252001
description:
Jan  6 10:15:02 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=195.184.76.131, lip=66.85.158.91, session=<lIO81rBHudTDuEyD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.213
country_id: 6252001
description:
Jan  6 10:15:42 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.213, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<AGYZ2bBHwcvN0h/V>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-01-06 10:16:10 dovecot_plain authenticator failed for H=(matitarize) [24.187.213.29]:50640: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 10:17:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<O5Zl37BHjrJA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 10:17:56 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<Iznm4LBHestm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 10:21:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<dSYG7bBHFp0IijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 10:21:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<uiYG7bBHUu0ifrCV>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 10:23:04 host2 sshd[1740393]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Jan  6 10:23:01 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notice@sivagnanamfoundation.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<PZQj87BHN7RetwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 10:22:29 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<Nzs68bBH+oUIijoY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.81.142.53
country_id: 3996063
description:
2026-01-06 10:23:15 dovecot_login authenticator failed for H=(ADMIN) [77.81.142.53]:42916: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 10:24:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@sobaherbal.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<O31m97BHPs0vWBNS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.217
country_id: 6252001
description:
Jan  6 10:24:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 17 secs): user=<>, rip=147.185.133.217, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<Fz9o+bBHE8CTuYXZ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 10:25:49 host2 sshd[1742774]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 10:25:14 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mail@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<BKkT+7BHfOKi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 10:25:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<iRYD/LBHTpRm2gqW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.217
country_id: 6252001
description:
Jan  6 10:25:47 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=147.185.133.217, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<NcQq/bBHavaTuYXZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 10:26:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<yyLP/bBHEqUz0msW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.217
country_id: 6252001
description:
Jan  6 10:26:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=147.185.133.217, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<oGCR/rBHTuKTuYXZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.12
country_id: 6252001
description:
Jan  6 10:26:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=162.216.149.12, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<CRjX/rBHTsei2JUM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.12
country_id: 6252001
description:
Jan  6 10:27:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 12 secs): user=<>, rip=162.216.149.12, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<fAYdArFHqOGi2JUM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 10:28:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<6KL4BLFHILkvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 10:30:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<Ct4KDbFHINWi8KbF>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.94.210.79
country_id: 2750405
description:
Jan  6 10:31:09 host2 pure-ftpd[1747696]: (?@158.94.210.79) [INFO] New connection from 158.94.210.79


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 10:33:09 host2 sshd[1749072]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.209.245.114
country_id: 2921044
description:
Jan  6 10:34:04 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=134.209.245.114, lip=66.85.158.91, TLS, session=<GD7LGrFHhJyG0fVy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.12
country_id: 6252001
description:
Jan  6 10:34:04 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.12, lip=66.85.158.91, TLS, session=<b3fHGrFHRP6i2JUM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.217
country_id: 6252001
description:
Jan  6 10:33:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.217, lip=66.85.158.92, TLS, session=<4WLjF7FHVuWTuYXZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.217
country_id: 6252001
description:
Jan  6 10:34:21 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.133.217, lip=66.85.158.92, TLS, session=<Ao/GG7FHxPWTuYXZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.195.138.52
country_id: 6252001
description:
2026-01-06 10:34:31 dovecot_plain authenticator failed for H=c-98-195-138-52.hsd1.tx.comcast.net (riginia) [98.195.138.52]:53066: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.209.245.114
country_id: 2921044
description:
Jan  6 10:34:15 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=134.209.245.114, lip=66.85.158.91, session=<jF13G7FHQl+G0fVy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 10:35:42 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<UIqAILFHzs9A46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 10:36:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postmaster@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<bSpNJLFHgqgIhpC/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 10:37:47 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<account@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<jdz2J7FHRZ5100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 10:40:06 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<g6E+MLFH+t5CdMzo>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.253.162.162
country_id: 146669
description:
Jan  6 10:41:04 host2 pure-ftpd[1756290]: (?@185.253.162.162) [INFO] New connection from 185.253.162.162


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.134.212.206
country_id: 798544
description:
Jan  6 10:41:05 host2 pure-ftpd[1756295]: (?@45.134.212.206) [INFO] New connection from 45.134.212.206


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 10:41:53 host2 sshd[1757008]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.34.242.231
country_id: 2963597
description:
Jan  6 10:41:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=149.34.242.231, lip=66.85.158.91, TLS handshaking: Connection closed, session=<pvsBNLFHEoOVIvLn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.232.51
country_id: 2542007
description:
2026-01-06 10:41:21 dovecot_login authenticator failed for H=(ADMIN) [95.181.232.51]:6591: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 154.47.16.230
country_id: 3686110
description:
Jan  6 10:41:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=154.47.16.230, lip=66.85.158.91, TLS, session=<gQQDNLFHesCaLxDm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.64.98.5
country_id: 1655842
description:
Jan  6 10:41:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=64.64.98.5, lip=66.85.158.91, TLS, session=<ZcfuNLFHjrJAQGIF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.154.155.6
country_id: 3932488
description:
Jan  6 10:41:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=45.154.155.6, lip=66.85.158.91, TLS handshaking: Connection closed, session=<VK3tNLFHgrItmpsG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.231.243.28
country_id: 6252001
description:
2026-01-06 10:41:54 dovecot_plain authenticator failed for H=(preuddylas) [50.231.243.28]:40846: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2026-01-06 10:42:41 dovecot_plain authenticator failed for H=(amatably) [65.20.233.110]:38931: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 10:43:36 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<Lj3HPLFHaOoyBsPO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.14
country_id: 1814991
description:
Jan  6 10:43:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=94.231.206.14, lip=66.85.158.91, session=<3z35PLFHPcxe584O>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.4
country_id: 1814991
description:
Jan  6 10:43:48 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=94.231.206.4, lip=66.85.158.91, session=<ZgeZPbFHT+Be584E>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.4
country_id: 1814991
description:
Jan  6 10:44:08 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=94.231.206.4, lip=66.85.158.91, session=<plfIPrFHKexe584E>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.7
country_id: 1814991
description:
Jan  6 10:44:04 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=94.231.206.7, lip=66.85.158.91, session=<aAOQPrFHRb9e584H>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.212.198
country_id: 732800
description:
Jan  6 10:46:52 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=185.255.212.198, lip=66.85.158.91, TLS, session=<4ZWLR7FHnq+5/9TG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.222.8.179
country_id: 3077311
description:
Jan  6 10:47:10 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=31.222.8.179, lip=66.85.158.91, TLS, session=<vPGnSLFHBbcf3giz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-06 10:48:31 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:65326: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 10:49:32 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<Ja//UbFHfIVA46ZK>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.169.66.57
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 209.169.66.57 - tradecey "GET /login/?login_only=1&user=tradecey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradecey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.93.200.199
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 73.93.200.199 - tradece "GET /login/?login_only=1&user=tradece&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.38.184.120
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 99.38.184.120 - trad "GET /login/?login_only=1&user=trad&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trad (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.132.118.224
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 68.132.118.224 - tradece1 "GET /login/?login_only=1&user=tradece1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.85.250
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 172.56.85.250 - tradece2 "GET /login/?login_only=1&user=tradece2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.105.111.208
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 143.105.111.208 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.166.247
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 172.58.166.247 - tradeceylo "GET /login/?login_only=1&user=tradeceylo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceylo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 142.79.83.133
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 142.79.83.133 - tradec "GET /login/?login_only=1&user=tradec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.230.233.173
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 68.230.233.173 - tr "GET /login/?login_only=1&user=tr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.5.232.224
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 68.5.232.224 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.187.58.146
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 71.187.58.146 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.238.19.162
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 96.238.19.162 - tradeceylon "GET /login/?login_only=1&user=tradeceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 206.85.120.81
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 206.85.120.81 - tradeceyloncom "GET /login/?login_only=1&user=tradeceyloncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyloncom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.43.84.240
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 99.43.84.240 - tradeceyl "GET /login/?login_only=1&user=tradeceyl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.113.242.141
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 98.113.242.141 - trade "GET /login/?login_only=1&user=trade&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trade (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.110.3.89
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 46.110.3.89 - tra "GET /login/?login_only=1&user=tra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tra (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 10:51:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<panel@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<GK0eWLFHJulm2gqW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.194
country_id: 6252001
description:
Jan  6 10:51:17 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.247.194, lip=66.85.158.91, TLS handshaking: Connection closed, session=<o4FfWLFHKt+4affC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.11.181.236
country_id: 6252001
description:
Jan  6 10:51:58 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 3 secs): user=<>, rip=198.11.181.236, lip=66.85.158.92, session=<WNDOWrFH8JrGC7Xs>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 10:54:50 host2 sshd[1769768]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.129.57.71
country_id: 6252001
description:
2026-01-06 10:55:14 dovecot_plain authenticator failed for H=c-73-129-57-71.hsd1.md.comcast.net (throd) [73.129.57.71]:48498: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.183.11.130
country_id: 130758
description:
Jan  6 10:55:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mail@sivagnanamfoundation.com>, method=PLAIN, rip=94.183.11.130, lip=66.85.158.91, session=<X4vlZrFHPSdetwuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 10:56:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<ijKQarFHSL0ifrCV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 10:56:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sale@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<3WGKarFHQLWi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 10:56:14 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<rezzabFHqqMz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 10:56:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<oArfabFHVJ0vWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 10:57:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<client@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<NM0VbrFHSqwIijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Jan  6 10:57:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@melanifinefood.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<+St8brFHTuwvT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 10:58:36 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<client@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<JztlcrFHNJUIijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 10:58:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<panel@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<sZp6c7FHnuJm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 11:00:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@lankaherbalsolutions.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<KbjOd7FHdIkvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 11:01:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<II7afLFHxKai8KbF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.88.103.70
country_id: 1861060
description:
2026-01-06 11:02:51 dovecot_login authenticator failed for H=(ADMIN) [149.88.103.70]:57042: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 11:07:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<cpanel@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<5e9ok7FHpsJA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 11:11:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<panel@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<By9pn7FHOJdCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 11:11:26 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<invoice@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=</QVLoLFHJt9100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 11:12:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<MDUjpLFHOK8IhpC/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 11:14:59 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mailer-demo@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<NrT+rLFHxpgyBsPO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.235.204.218
country_id: 2017370
description:
2026-01-06 11:15:30 dovecot_login authenticator failed for H=(37-235-204-218.dynamic.customer.lanta.me) [37.235.204.218]:48250: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2026-01-06 11:15:17 dovecot_plain authenticator failed for H=(coalmolly) [75.97.190.237]:39220: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-01-06 11:16:10 dovecot_login authenticator failed for H=([200.106.49.149]) [200.106.49.149]:58164: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.40.31.154
country_id: 3865483
description:
Jan  6 11:17:36 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=179.40.31.154, lip=66.85.158.91, TLS, session=<czRNtbFHp7mzKB+a>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.26.42
country_id: 1269750
description:
Jan  6 11:17:58 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<charanaw>, method=PLAIN, rip=103.164.26.42, lip=66.85.158.91, TLS, session=<CMictrFHzLNnpBoq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2026-01-06 11:21:02 dovecot_plain authenticator failed for H=c-73-183-74-177.hsd1.pa.comcast.net (aster) [73.183.74.177]:34046: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.228.21.109
country_id: 6251999
description:
2026-01-06 11:22:00 dovecot_login authenticator failed for H=(ADMIN) [140.228.21.109]:30475: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 11:21:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<cpanel@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<TTgUxbFHKqJA46ZK>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.94.210.79
country_id: 2750405
description:
Jan  6 11:23:03 host2 pure-ftpd[1795757]: (?@158.94.210.79) [INFO] New connection from 158.94.210.79


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 11:24:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<Fr50z7FHGOFm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 11:26:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<cToj1rFHUqIz0msW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.116
country_id: 6252001
description:
Jan  6 11:27:09 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=66.132.153.116, lip=66.85.158.92, TLS: Connection closed, session=<YqOc2LFH0vdChJl0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 11:27:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<CJwr27FHhoai8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 11:28:16 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<notify@sobaherbal.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<IWh03LFHBtwvWBNS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.247
country_id: 1733045
description:
2026-01-06 11:30:16 dovecot_login authenticator failed for H=([49.124.152.247]) [49.124.152.247]:44996: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.220
country_id: 2186224
description:
2026-01-06 11:31:04 dovecot_login authenticator failed for H=([121.73.162.220]) [121.73.162.220]:53300: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2026-01-06 11:31:17 dovecot_plain authenticator failed for H=c-68-40-189-43.hsd1.mi.comcast.net (sterwhed) [68.40.189.43]:43474: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 11:31:26 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<fjDb57FHcqQifrCV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 11:32:05 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<panel@lankaherbalsolutions.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<NMAn6rFH/McvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 11:32:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<r7ta67FHkN1m2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 11:32:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sale@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<UQFv7LFHIoCi8KbF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 11:32:58 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<dtVW7bFHlrsIijoY>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 11:34:01 host2 sshd[1805339]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 11:34:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<j9eh8bFHfqQIijoY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.137.230
country_id: 1269750
description:
2026-01-06 11:37:30 dovecot_login authenticator failed for H=(abts-north-static-230.137.160.122.airtelbroadband.in) [122.160.137.230]:45874: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
country_id: 1269750
description:
2026-01-06 11:38:08 dovecot_login authenticator failed for H=(nsg-static-82.71.76.182-airtel.com) [182.76.71.82]:56990: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 11:39:58 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<vip@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<J3ZWBrJH9NJA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 11:42:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<webmaster@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<b+x/DrJHoJlCdMzo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.65.138
country_id: 2328926
description:
2026-01-06 11:44:13 dovecot_login authenticator failed for H=(ADMIN) [146.70.65.138]:31794: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 11:45:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<XEAHGbJH1l1100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 11:46:27 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contacts@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<JrCFHbJH/q8yBsPO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2026-01-06 11:47:41 dovecot_plain authenticator failed for H=c-73-213-237-28.hsd1.va.comcast.net (bilia) [73.213.237.28]:59748: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.116.165
country_id: 3144096
description:
2026-01-06 11:47:47 dovecot_login authenticator failed for H=(cm-178.232.116.165.get.no) [178.232.116.165]:53013: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.72.202.86
country_id: 192950
description:
2026-01-06 11:48:00 dovecot_login authenticator failed for H=([41.72.201.170]) [41.72.202.86]:48768: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 11:48:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<rPmjI7JHOukIhpC/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 11:53:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<vip@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<ovYkOLJHLqFA46ZK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.25
country_id: 6252001
description:
Jan  6 11:56:04 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.25, lip=66.85.158.92, TLS, session=<HjcOQLJHOufN0h8Z>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.218.50
country_id: 1269750
description:
2026-01-06 11:56:07 dovecot_login authenticator failed for H=([125.19.218.50]) [125.19.218.50]:43236: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 11:56:34 host2 sshd[1826500]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.51.135
country_id: 3144096
description:
2026-01-06 11:56:30 dovecot_login authenticator failed for H=(cm-178.232.51.135.get.no) [178.232.51.135]:50581: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 11:57:05 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<account@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<3oqCQ7JHV6Iz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 11:58:37 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shop@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<NtIKSbJHqr1m2gqW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2026-01-06 11:58:10 dovecot_plain authenticator failed for H=c-174-169-224-27.hsd1.vt.comcast.net (veles) [174.169.224.27]:56036: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 11:59:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<midoTbJHTsqi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 12:00:35 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<panel@sobaherbal.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<rBQQULJHnqwvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 12:04:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<service@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<lQtzXLJHPKai8KbF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 12:04:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<client@lankaherbalsolutions.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<4Y35XbJHvJgvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 12:05:39 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<buUsYrJHvLEifrCV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 12:06:16 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shop@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<hLthZLJHBNxm2gqW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.235.147
country_id: 102358
description:
2026-01-06 12:08:41 dovecot_login authenticator failed for H=(ADMIN) [95.181.235.147]:34081: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 12:09:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<jED6brJH4soIijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 12:10:26 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<5ORUc7JHxrMIijoY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2026-01-06 12:12:02 dovecot_plain authenticator failed for H=c-73-137-7-97.hsd1.ga.comcast.net (thelitione) [73.137.7.97]:45984: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 12:12:48 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<Lxe/e7JHbI9A46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Jan  6 12:13:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<shop@melanifinefood.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<ooWgfLJHwKwvT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 12:13:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<vip@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<B34/frJH8JhCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 12:18:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<s3DGjrJH4pkyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 12:18:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<mail@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<QXt5kbJHE2F100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.118.215.229
country_id: 1880251
description:
Jan  6 12:20:07 host2 sshd[1848324]: Disconnected from invalid user gov 161.118.215.229 port 44894 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.118.215.229
country_id: 1880251
description:
Jan  6 12:20:10 host2 sshd[1848398]: Disconnected from invalid user gov 161.118.215.229 port 47522 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.10.86.130
country_id: 3895114
description:
Jan  6 12:23:45 host2 sshd[1851942]: Disconnected from invalid user rajesh 186.10.86.130 port 50214 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 12:23:57 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<Pcioo7JHcOgIhpC/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.10.86.130
country_id: 3895114
description:
Jan  6 12:26:10 host2 sshd[1854141]: Disconnected from invalid user ec2-user 186.10.86.130 port 43974 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.248.245.89
country_id: 2921044
description:
Jan  6 12:25:47 host2 sshd[1853829]: Disconnected from invalid user apollo 104.248.245.89 port 35704 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.248.245.89
country_id: 2921044
description:
Jan  6 12:26:20 host2 sshd[1854285]: Disconnected from invalid user tester 104.248.245.89 port 56728 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 12:26:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<cikRrrJHoqFA46ZK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.10
country_id: 1269750
description:
2026-01-06 12:27:24 dovecot_login authenticator failed for H=(aes-static-137.135.17.125.airtel.in) [182.95.228.10]:46814: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.242.112.200
country_id: 1269750
description:
2026-01-06 12:27:42 dovecot_login authenticator failed for H=(121.242.112.200.static-hyderabad.vsnl.net.in) [121.242.112.200]:41930: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 12:27:57 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<A434sbJHTKQz0msW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.10.86.130
country_id: 3895114
description:
Jan  6 12:28:15 host2 sshd[1855955]: Disconnected from invalid user james 186.10.86.130 port 45450 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.248.245.89
country_id: 2921044
description:
Jan  6 12:28:19 host2 sshd[1856013]: Disconnected from invalid user josh 104.248.245.89 port 39210 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.137.144
country_id: 1605651
description:
Jan  6 12:28:21 host2 sshd[1856055]: Disconnected from invalid user mongodb 27.254.137.144 port 35756 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 12:29:46 host2 sshd[1857262]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  6 12:30:09 host2 sshd[1857359]: Disconnected from invalid user user 2.57.121.25 port 51808 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2026-01-06 12:29:40 dovecot_plain authenticator failed for H=c-73-196-144-25.hsd1.nj.comcast.net (sness) [73.196.144.25]:57044: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.55.189.211
country_id: 6252001
description:
2026-01-06 12:30:38 dovecot_login authenticator failed for H=(wllk99-129-211.dsl.netins.net) [67.55.189.211]:50237: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.188.140
country_id: 3996063
description:
2026-01-06 12:31:00 dovecot_login authenticator failed for H=([140.84.188.140]) [140.84.188.140]:39460: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.209.108.42
country_id: 6254930
description:
2026-01-06 12:31:12 dovecot_plain authenticator failed for H=(nonon) [185.209.108.42]:35096: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.254.137.144
country_id: 1605651
description:
Jan  6 12:30:21 host2 sshd[1857955]: Disconnected from invalid user arjun 27.254.137.144 port 46174 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 12:31:34 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sale@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<RJ7fvrJHUJ2i8GQy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.52.88
country_id: 6252001
description:
Jan  6 12:31:49 host2 sshd[1859101]: Disconnected from invalid user claude 209.141.52.88 port 48920 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 12:32:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<dPYww7JHOLpm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 12:32:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<client@sobaherbal.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<zuOww7JHwusvWBNS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.156
country_id: 3703430
description:
Jan  6 12:32:56 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (disconnected before auth was ready, waited 0 secs): user=<>, rip=45.227.254.156, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<LfDmw7JHHv8t4/6c>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.215.235.115
country_id: 1831722
description:
2026-01-06 12:35:54 dovecot_login authenticator failed for H=(ADMIN) [188.215.235.115]:63592: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.203.49.121
country_id: 2963597
description:
Jan  6 12:36:05 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=37.203.49.121, lip=66.85.158.91, TLS, session=<hfc0zrJHcLglyzF5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 12:35:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<vip@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<6yxszbJHLr+i8KbF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.186.12.17
country_id: 798544
description:
Jan  6 12:35:48 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=89.186.12.17, lip=66.85.158.91, TLS, session=<uwclzbJH5blZugwR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 12:36:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<D4Gx0bJH3tcvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.17.125.224
country_id: 690791
description:
Jan  6 12:36:53 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=185.17.125.224, lip=66.85.158.91, TLS, session=<kwYI0bJH1da5EX3g>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.124.182.140
country_id: 3175395
description:
Jan  6 12:37:16 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=185.124.182.140, lip=66.85.158.91, TLS, session=<z3lC0rJHsJq5fLaM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 12:39:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<LZ4p27JHcroifrCV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 12:40:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<jDKP3rJH8qZm2gqW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.83.151.102
country_id: 6252001
description:
Jan  6 12:41:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.83.151.102, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<LMOt4rJHxt0UU5dm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.170.26.169
country_id: 2077456
description:
2026-01-06 12:41:52 dovecot_login authenticator failed for H=(124-170-26-169.tpgi.com.au) [124.170.26.169]:52690: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 12:42:43 host2 sshd[1869774]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.122
country_id: 1269750
description:
2026-01-06 12:42:27 dovecot_login authenticator failed for H=([182.95.230.122]) [182.95.230.122]:49084: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 12:45:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<uL/K77JHONoIijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 12:44:51 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<yYZa7rJH0oVCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 12:46:41 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<9sbq9LJHcONA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 12:46:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<M0Am9LJHJMMIijoY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.126
country_id: 6252001
description:
Jan  6 12:51:23 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.126, lip=66.85.158.92, session=<PlndBbNHTOmTuYR+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 12:52:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<kt6vCrNHtUh100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.102.232.38
country_id: 3057568
description:
2026-01-06 12:57:49 dovecot_login authenticator failed for H=(ADMIN) [149.102.232.38]:64020: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 12:58:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<zrZaH7NHXpkIhpC/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 12:58:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<o8QJILNHKuGi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  6 13:00:17 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<doCPJbNHXNIvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 13:02:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<HsFhLLNHjtwz0msW>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 13:02:37 host2 sshd[1890564]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 13:02:41 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<4zImLrNHWtFA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 13:03:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<DEB8MLNHiuCi8KbF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2026-01-06 13:04:20 dovecot_login authenticator failed for H=([152.52.218.233]) [182.78.79.134]:59582: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 13:04:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<1HgdNrNHDzB100Db>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 138.197.42.221
country_id: 6252001
description:
Jan  6 13:05:04 host2 pure-ftpd[1893245]: (?@138.197.42.221) [INFO] New connection from 138.197.42.221


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.199.197.102
country_id: 6252001
description:
Jan  6 13:06:16 host2 pure-ftpd[1894351]: (?@134.199.197.102) [INFO] New connection from 134.199.197.102


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Jan  6 13:08:39 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@melanifinefood.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<062FQ7NHwLYvT1jH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.16.157.39
country_id: 6252001
description:
2026-01-06 13:09:14 dovecot_plain authenticator failed for H=([10.5.0.2]) [154.16.157.39]:17007: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.16.157.39
country_id: 6252001
description:
2026-01-06 13:09:20 dovecot_login authenticator failed for H=([10.5.0.2]) [154.16.157.39]:17007: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.27.92.31
country_id: 6252001
description:
[2026-01-06 13:11:12 +0530] info [cpaneld] 45.27.92.31 - tradece "GET /login/?login_only=1&user=tradece&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.91.157.162
country_id: 6252001
description:
[2026-01-06 13:11:15 +0530] info [cpaneld] 68.91.157.162 - tradec "GET /login/?login_only=1&user=tradec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 132.147.156.194
country_id: 6252001
description:
[2026-01-06 13:11:02 +0530] info [cpaneld] 132.147.156.194 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.72.244.154
country_id: 6252001
description:
[2026-01-06 13:11:00 +0530] info [cpaneld] 108.72.244.154 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.192.138.188
country_id: 6252001
description:
[2026-01-06 13:11:05 +0530] info [whostmgrd] 72.192.138.188 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.244.84.239
country_id: 6252001
description:
[2026-01-06 13:11:07 +0530] info [cpaneld] 108.244.84.239 - tradeceylo "GET /login/?login_only=1&user=tradeceylo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceylo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.111.238.115
country_id: 6252001
description:
[2026-01-06 13:11:17 +0530] info [cpaneld] 68.111.238.115 - trade "GET /login/?login_only=1&user=trade&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trade (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.66.91.165
country_id: 6252001
description:
[2026-01-06 13:11:10 +0530] info [cpaneld] 108.66.91.165 - tradecey "GET /login/?login_only=1&user=tradecey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradecey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.86.225.0
country_id: 6252001
description:
[2026-01-06 13:11:06 +0530] info [cpaneld] 67.86.225.0 - tradeceyloncom "GET /login/?login_only=1&user=tradeceyloncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyloncom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.248.148.21
country_id: 6252001
description:
[2026-01-06 13:11:03 +0530] info [cpaneld] 167.248.148.21 - tradeceylon "GET /login/?login_only=1&user=tradeceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.188.215
country_id: 6252001
description:
[2026-01-06 13:11:09 +0530] info [cpaneld] 172.59.188.215 - tradeceyl "GET /login/?login_only=1&user=tradeceyl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.61.160.224
country_id: 6252001
description:
[2026-01-06 13:11:23 +0530] info [cpaneld] 24.61.160.224 - tradece1 "GET /login/?login_only=1&user=tradece1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.56.75.94
country_id: 6252001
description:
[2026-01-06 13:11:24 +0530] info [cpaneld] 98.56.75.94 - tradece2 "GET /login/?login_only=1&user=tradece2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece2 (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.169.105.48
country_id: 6252001
description:
Jan  6 13:11:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.169.105.48, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<vVu1TrNHRoAUqWkw>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.18.83.250
country_id: 6252001
description:
[2026-01-06 13:11:18 +0530] info [cpaneld] 47.18.83.250 - trad "GET /login/?login_only=1&user=trad&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trad (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.67.83.28
country_id: 6252001
description:
[2026-01-06 13:11:20 +0530] info [cpaneld] 97.67.83.28 - tra "GET /login/?login_only=1&user=tra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tra (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.117.36.181
country_id: 6252001
description:
[2026-01-06 13:11:21 +0530] info [cpaneld] 24.117.36.181 - tr "GET /login/?login_only=1&user=tr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tr (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 13:13:02 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<PcIzU7NHFqEifrCV>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 66.116.204.232
country_id: 1269750
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[66.116.204.232] [Remote Port]=[49944] [Authentication Database]=[mail] [Username]=[sales@kiriaswanu.com] (10/10 failures) (blocked until [Wed Jan  7 07:43:36 2026 UTC/Wed Jan  7 13:13:36 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 13:13:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<IodMVbNHGMNCdMzo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 144.126.237.13
country_id: 2635167
description:
Jan  6 13:15:11 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=144.126.237.13, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<VVb3WrNHcqGQfu0N>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 13:15:24 host2 sshd[1903633]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.244.52.64
country_id: 798549
description:
2026-01-06 13:15:46 dovecot_login authenticator failed for H=(ADMIN) [143.244.52.64]:44959: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 13:16:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<vtQwX7NHZI9A46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 13:17:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<hmohY7NHlNAIijoY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.94.66
country_id: 1269750
description:
2026-01-06 13:17:49 dovecot_login authenticator failed for H=([27.123.94.66]) [27.123.94.66]:39428: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.67.22
country_id: 1269750
description:
2026-01-06 13:18:07 dovecot_login authenticator failed for H=(nsg-corporate-246.50.185.122.airtel.in) [182.78.67.22]:51952: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 13:17:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=</JqRYrNHTr1m2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 13:17:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<Bbu8YrNHhpMyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 13:18:39 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<xYxKZ7NHfLkIijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.18.235
country_id: 2300660
description:
Jan  6 13:18:50 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=41.139.18.235, lip=66.85.158.91, TLS, session=<oMnMZrNH8bEpixLr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.62.192
country_id: 953987
description:
Jan  6 13:19:25 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=102.129.62.192, lip=66.85.158.91, TLS, session=<yeL4aLNHKOlmgT7A>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 188.241.177.36
country_id: 3469034
description:
Jan  6 13:23:51 host2 dovecot[1170291]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=188.241.177.36, lip=66.85.158.91, session=<Fd31ebNHpMe88bEk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 154.47.29.203
country_id: 3202326
description:
Jan  6 13:23:51 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=154.47.29.203, lip=66.85.158.91, TLS handshaking: Connection closed, session=<nJf4ebNHptyaLx3L>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.78.54.111
country_id: 2750405
description:
Jan  6 13:23:48 host2 pure-ftpd[1910911]: (?@195.78.54.111) [INFO] New connection from 195.78.54.111


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.70.11.62
country_id: 3895114
description:
Jan  6 13:23:51 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=146.70.11.62, lip=66.85.158.91, TLS, session=<uGv4ebNHrtySRgs+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.78.138.227
country_id: 2802361
description:
Jan  6 13:24:57 host2 pure-ftpd[1911995]: (?@34.78.138.227) [INFO] New connection from 34.78.138.227


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 13:24:56 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<nzGrfbNHyMZm2gqW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.85.196
country_id: 294640
description:
2026-01-06 13:25:57 dovecot_login authenticator failed for H=(31-154-85-196.orange.net.il) [2.55.85.196]:57429: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.220.168
country_id: 337996
description:
2026-01-06 13:26:20 dovecot_login authenticator failed for H=([196.190.220.168]) [196.190.220.168]:48050: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 13:29:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<yHrBjbNHtLOi8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2026-01-06 13:31:44 dovecot_plain authenticator failed for H=(alibis) [75.97.190.237]:37854: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 13:31:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<glUvlrNHntcz0msW>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 51.210.107.22
country_id: 3017382
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[51.210.107.22] [Remote Port]=[55198] [Authentication Database]=[mail] [Username]=[info@mathsmotorcysle.xyz] (10/10 failures) (blocked until [Wed Jan  7 08:01:44 2026 UTC/Wed Jan  7 13:31:44 2026 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.210.105.202
country_id: 3175395
description:
2026-01-06 13:32:46 dovecot_login authenticator failed for H=95-210-105-202.ip.skylogicnet.com [95.210.105.202]:65042: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.133.161.162
country_id: 130758
description:
2026-01-06 13:33:01 dovecot_login authenticator failed for H=([85.133.161.162]) [85.133.161.162]:36448: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 13:33:37 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<ro3LnLNHCLAIhpC/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 13:34:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<OpC2nrNHipei8KbF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 13:35:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=</hyCorNHYuNA46ZK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.152.42
country_id: 2658434
description:
2026-01-06 13:35:53 dovecot_login authenticator failed for H=(ADMIN) [158.173.152.42]:26134: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.237.107
country_id: 3144096
description:
2026-01-06 13:36:13 dovecot_login authenticator failed for H=(cm-178.232.237.107.get.no) [178.232.237.107]:53676: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.138
country_id: 1269750
description:
2026-01-06 13:36:29 dovecot_login authenticator failed for H=([128.185.201.138]) [128.185.201.138]:52342: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.98.91
country_id: 6252001
description:
Jan  6 13:38:18 host2 sshd[1924574]: Disconnected from invalid user ubuntu 101.36.98.91 port 47952 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 13:38:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<dMQ9rrNHL+B100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.199.224.52
country_id: 357994
description:
Jan  6 13:40:11 host2 sshd[1926395]: Disconnected from invalid user vpn 197.199.224.52 port 51678 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.199.224.52
country_id: 357994
description:
Jan  6 13:41:25 host2 sshd[1927646]: Disconnected from invalid user claude 197.199.224.52 port 50814 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.199.224.52
country_id: 357994
description:
Jan  6 13:42:37 host2 sshd[1928721]: Disconnected from invalid user joaquin 197.199.224.52 port 49966 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.98.91
country_id: 6252001
description:
Jan  6 13:43:13 host2 sshd[1929403]: Disconnected from invalid user usuario1 101.36.98.91 port 38796 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.98.91
country_id: 6252001
description:
Jan  6 13:43:46 host2 sshd[1929813]: Disconnected from invalid user vpn 101.36.98.91 port 55462 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.98.91
country_id: 6252001
description:
Jan  6 13:44:17 host2 sshd[1930250]: Disconnected from invalid user claude 101.36.98.91 port 51478 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 13:44:58 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<wWNexbNHFppCdMzo>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 57.128.239.181
country_id: 798544
description:
Jan  6 13:45:25 host2 sshd[1931469]: Disconnected from invalid user claude 57.128.239.181 port 54822 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Jan  6 13:46:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<LerHybNHltAvT1jH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.128.239.181
country_id: 798544
description:
Jan  6 13:46:29 host2 sshd[1932698]: Disconnected from invalid user vpn 57.128.239.181 port 56636 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 13:46:58 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<87uBzLNHeMcifrCV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 13:48:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<Xt/S0LNHOrAyBsPO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  6 13:47:21 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<QPAFzrNHBowDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 13:49:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<fZK31LNHjrtA46ZK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  6 13:48:43 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<uXrv0rNHetUDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  6 13:50:27 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<d28Z2bNH/JsDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 13:50:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<W7GV2rNHZuVm2gqW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  6 13:51:30 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<t7fW3LNHZJ0DhBfJ>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  6 13:52:12 host2 dovecot[1170291]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=</vNY37NHOo8DhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 13:52:47 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<5sBP4bNH8t8IijoY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  6 13:53:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<LQK94rNHFt4DhBfJ>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  6 13:53:15 host2 dovecot[1170291]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<r5Eh47NHxsoDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  6 13:53:28 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<jmLq47NHAosDhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  6 13:53:36 host2 sshd[1939539]: Disconnected from invalid user admin 2.57.121.112 port 52724 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.56.52.106
country_id: 6251999
description:
2026-01-06 13:53:40 dovecot_login authenticator failed for H=(ADMIN) [212.56.52.106]:50851: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 13:54:02 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<IazE5bNH1sgIijoY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.23.199.49
country_id: 1643084
description:
Jan  6 13:54:19 host2 sshd[1940445]: Disconnected from invalid user claude 103.23.199.49 port 45292 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  6 13:54:28 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<Izt957NH8qEDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.241.132.152
country_id: 1269750
description:
2026-01-06 13:54:31 dovecot_login authenticator failed for H=(static.ill.117.248.107.130.bsnl.co.in) [43.241.132.152]:43080: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2026-01-06 13:54:48 dovecot_login authenticator failed for H=([83.136.176.12]) [83.136.176.12]:53365: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.43.123
country_id: 6252001
description:
2026-01-06 13:55:25 dovecot_plain authenticator failed for H=c-71-229-43-123.hsd1.ga.comcast.net (baren) [71.229.43.123]:50658: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.77.137.236
country_id: 1605651
description:
2026-01-06 13:55:42 dovecot_login authenticator failed for H=([110.77.137.236]) [110.77.137.236]:37450: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 13:58:37 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<Ylos9rNHDq5m2gqW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.216.211.19
country_id: 1269750
description:
Jan  6 13:59:06 host2 sshd[1944794]: Disconnected from invalid user guest 117.216.211.19 port 37284 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.100
country_id: 3469034
description:
Jan  6 13:59:45 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=190.89.137.100, lip=66.85.158.91, TLS, session=<HwkN+bNHUu2+WYlk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.60.190
country_id: 953987
description:
Jan  6 14:00:06 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<charanaw>, method=PLAIN, rip=102.129.60.190, lip=66.85.158.91, TLS, session=<7TSG+rNH3rBmgTy+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.227.147.163
country_id: 6252001
description:
Jan  6 13:59:36 host2 sshd[1945249]: Disconnected from invalid user console 23.227.147.163 port 46802 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 189.202.206.163
country_id: 3996063
description:
Jan  6 14:00:56 host2 dovecot[1170291]: imap-login: Disconnected: Aborted login by logging out (auth failed, 1 attempts in 3 secs): user=<training@v-deploy.com>, method=PLAIN, rip=189.202.206.163, lip=66.85.158.91, TLS, session=<Dvdz/rNH3Ie9ys6j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.216.211.19
country_id: 1269750
description:
Jan  6 14:01:01 host2 sshd[1946715]: Disconnected from invalid user postgres 117.216.211.19 port 35698 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 23.227.147.163
country_id: 6252001
description:
Jan  6 14:00:41 host2 sshd[1946466]: Disconnected from invalid user claude 23.227.147.163 port 34720 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.253.226
country_id: 1269750
description:
2026-01-06 14:01:07 dovecot_login authenticator failed for H=(abts-kk-static-226.253.166.122.airtelbroadband.in) [122.166.253.226]:39599: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-06 14:01:14 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:64755: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.69.161.214
country_id: 6252001
description:
2026-01-06 14:01:17 dovecot_login authenticator failed for H=([208.69.161.214]) [208.69.161.214]:39768: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 14:00:29 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<uFvg/LNHXIai8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.205.135
country_id: 298795
description:
2026-01-06 14:01:08 dovecot_login authenticator failed for H=([5.11.205.135]) [5.11.205.135]:47513: 535 Incorrect authentication data


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.227.147.163
country_id: 6252001
description:
Jan  6 14:02:17 host2 sshd[1947987]: Disconnected from invalid user guest 23.227.147.163 port 47700 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 14:01:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<9BU6ALRHTNMz0msW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.233.118.22
country_id: 3469034
description:
Jan  6 14:03:30 host2 sshd[1949396]: Disconnected from invalid user friend 186.233.118.22 port 39470 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 117.216.211.19
country_id: 1269750
description:
Jan  6 14:03:26 host2 sshd[1949316]: Disconnected from invalid user zhangbin 117.216.211.19 port 43736 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 37.46.115.45
country_id: 6290252
description:
Jan  6 14:04:26 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=37.46.115.45, lip=66.85.158.91, TLS, session=<X6MXC7RHQJklLnMt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 102.129.145.92
country_id: 6252001
description:
Jan  6 14:04:26 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=102.129.145.92, lip=66.85.158.91, TLS handshaking: Connection closed, session=<vUcXC7RHNJlmgZFc>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.108.174.163
country_id: 1269750
description:
Jan  6 14:04:25 host2 pure-ftpd[1950390]: (?@103.108.174.163) [INFO] New connection from 103.108.174.163


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 93.62.72.229
country_id: 3175395
description:
Jan  6 14:04:17 host2 sshd[1950208]: Disconnecting authenticating user root 93.62.72.229 port 14286: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 93.62.72.229
country_id: 3175395
description:
Jan  6 14:04:17 host2 sshd[1950208]: error: maximum authentication attempts exceeded for root from 93.62.72.229 port 14286 ssh2 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 14:05:21 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<S5tNDrRHhLGi8KbF>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.203.58.203
country_id: 6252001
description:
Jan  6 14:05:40 host2 sshd[1951809]: Disconnected from invalid user claude 172.203.58.203 port 59590 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.233.118.22
country_id: 3469034
description:
Jan  6 14:06:48 host2 sshd[1953023]: Disconnected from invalid user smbuser 186.233.118.22 port 56600 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.233.118.22
country_id: 3469034
description:
Jan  6 14:07:26 host2 sshd[1953675]: Disconnected from invalid user book 186.233.118.22 port 50408 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 14:08:05 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<1FsKGLRHOshA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 14:09:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<4Iz4HLRHrJIIhpC/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.203.58.203
country_id: 6252001
description:
Jan  6 14:09:42 host2 sshd[1956178]: Disconnected from invalid user magento 172.203.58.203 port 54468 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 14:11:39 host2 sshd[1958503]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 14:12:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<wQwmJ7RHC0Z100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.18.140
country_id: 2921044
description:
2026-01-06 14:14:02 dovecot_login authenticator failed for H=(ADMIN) [138.199.18.140]:60533: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 14:16:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<mXwXN7RH7MVCdMzo>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 14:17:31 host2 sshd[1965303]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.252.229.25
country_id: 1819730
description:
Jan  6 14:18:50 host2 sshd[1966705]: Disconnected from invalid user socks 43.252.229.25 port 45560 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 14:19:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<Klk5QLRH3rYyBsPO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.211.55.20
country_id: 2328926
description:
Jan  6 14:19:25 host2 sshd[1967529]: Disconnected from invalid user sysadmin 197.211.55.20 port 49252 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2026-01-06 14:20:36 dovecot_plain authenticator failed for H=c-73-195-211-98.hsd1.nj.comcast.net (cologion) [73.195.211.98]:32890: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 14:21:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<RpooR7RHSq0ifrCV>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.211.55.20
country_id: 2328926
description:
Jan  6 14:22:06 host2 sshd[1971208]: Disconnected from invalid user claude 197.211.55.20 port 34138 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 14:22:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<k3YDS7RHgrlA46ZK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.252.229.25
country_id: 1819730
description:
Jan  6 14:22:27 host2 sshd[1971558]: Disconnected from invalid user webmaster 43.252.229.25 port 33080 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.211.55.20
country_id: 2328926
description:
Jan  6 14:22:44 host2 sshd[1971853]: Disconnected from invalid user tushar 197.211.55.20 port 35634 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 14:24:40 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<MKteU7RHkLBm2gqW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.211.55.20
country_id: 2328926
description:
Jan  6 14:26:00 host2 sshd[1975778]: Disconnected from invalid user ais 197.211.55.20 port 52808 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Jan  6 14:26:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<732/WbRHNtYvT1jH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.53.32.129
country_id: 2921044
description:
Jan  6 14:26:32 host2 sshd[1976384]: Disconnected from invalid user agent 152.53.32.129 port 52334 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 14:28:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<5vDaX7RHFIEIijoY>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.252.229.25
country_id: 1819730
description:
Jan  6 14:28:30 host2 sshd[1978516]: Disconnected from invalid user system 43.252.229.25 port 40322 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.53.32.129
country_id: 2921044
description:
Jan  6 14:28:35 host2 sshd[1978732]: Disconnected from invalid user ubuntu 152.53.32.129 port 55732 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.118
country_id: 3017382
description:
Jan  6 14:30:03 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.196.152.118, lip=66.85.158.92, TLS: Connection closed, session=<mg/BZrRHqc1bxJh2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 14:29:21 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<VsAfZLRHUNgIijoY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.191
country_id: 3017382
description:
Jan  6 14:29:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=91.231.89.191, lip=66.85.158.92, TLS handshaking: Connection closed, session=<NWRCZLRHU+lb51m/>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.53.32.129
country_id: 2921044
description:
Jan  6 14:29:41 host2 sshd[1979932]: Disconnected from invalid user navid 152.53.32.129 port 58888 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.41
country_id: 3017382
description:
Jan  6 14:29:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.231.89.41, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<OQe+ZbRHlcZb51kp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.45
country_id: 3017382
description:
Jan  6 14:29:32 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.231.89.45, lip=66.85.158.92, TLS: Connection closed, session=<AdHpZLRHQ9Bb51kt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.27
country_id: 3017382
description:
Jan  6 14:29:53 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.196.152.27, lip=66.85.158.92, TLS handshaking: Connection closed, session=<800hZrRHibFbxJgb>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 14:30:33 host2 sshd[1981057]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.40
country_id: 6252001
description:
Jan  6 14:30:53 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.40, lip=66.85.158.91, TLS, session=<FL68abRHguLN0h8o>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.188.183.95
country_id: 3017382
description:
2026-01-06 14:30:55 dovecot_login authenticator failed for H=(ADMIN) [203.188.183.95]:54609: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.118
country_id: 3017382
description:
Jan  6 14:30:20 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.118, lip=66.85.158.92, TLS: Connection closed, session=<QgO5Z7RHqaZbxJh2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.176.157.57
country_id: 6252001
description:
2026-01-06 14:30:40 dovecot_plain authenticator failed for H=c-73-176-157-57.hsd1.il.comcast.net (crocal) [73.176.157.57]:55188: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 14:31:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<xNHRa7RHXNEz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 14:31:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<pwfCbLRH5sai8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 14:32:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<g2/1brRH7Llm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 14:36:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<fCMpf7RHqoSi8KbF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.5
country_id: 130758
description:
2026-01-06 14:38:17 dovecot_login authenticator failed for H=(localhost) [62.60.130.5]:16366: 535 Incorrect authentication data (set_id=rqwrqwrqw)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.21
country_id: 798549
description:
Jan  6 14:38:51 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=85.217.149.21, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<dSA3hrRHvLBV2ZUV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.12
country_id: 798549
description:
Jan  6 14:40:03 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=85.217.149.12, lip=66.85.158.91, session=<G0l/irRHUpxV2ZUM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 14:41:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<5+cvjrRHQsdA46ZK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.14
country_id: 798549
description:
Jan  6 14:43:22 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.14, lip=66.85.158.91, TLS: Connection closed, session=<4JlXlrRHrotV2ZUO>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 14:44:24 host2 sshd[1994047]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 14:45:05 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<pYFlnLRHAoUIhpC/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.129.75
country_id: 2264397
description:
Jan  6 14:44:27 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_read failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=45.156.129.75, lip=66.85.158.92, TLS: SSL_read failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<BVg0mrRHltEtnIFL>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 45.156.129.75
country_id: 2264397
description:
Jan  6 14:44:26 host2 dovecot[1170291]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=45.156.129.75, lip=66.85.158.92, TLS, session=<0jUxmrRHo6YtnIFL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.129.78
country_id: 2264397
description:
Jan  6 14:44:27 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.156.129.78, lip=66.85.158.92, TLS, session=<7eU2mrRHNZAtnIFO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.129.76
country_id: 2264397
description:
Jan  6 14:44:27 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=45.156.129.76, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<k6U3mrRHYcotnIFM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.157.158
country_id: 1269750
description:
2026-01-06 14:45:44 dovecot_login authenticator failed for H=([128.185.70.193]) [125.19.157.158]:34848: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.39
country_id: 2186224
description:
2026-01-06 14:46:13 dovecot_login authenticator failed for H=([121.73.163.39]) [121.73.163.39]:56774: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2026-01-06 14:46:41 dovecot_login authenticator failed for H=([173.25.186.130]) [173.25.186.130]:57159: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 85.217.149.12
country_id: 798549
description:
Jan  6 14:46:44 host2 pure-ftpd[1996623]: (?@85.217.149.12) [INFO] New connection from 85.217.149.12


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 14:46:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<LP02orRHOlR100Db>


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 85.217.149.12
country_id: 798549
description:
Jan  6 14:46:49 host2 pure-ftpd[1996753]: (?@85.217.149.12) [INFO] New connection from 85.217.149.12


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.83.107
country_id: 2635167
description:
Jan  6 14:47:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=46.101.83.107, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<nUelprRH2LUuZVNr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 14:48:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<p/wPqbRHDIxCdMzo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.46.148.180
country_id: 6252001
description:
2026-01-06 14:49:28 dovecot_plain authenticator failed for H=c-68-46-148-180.hsd1.mi.comcast.net (dingnous) [68.46.148.180]:53896: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 14:50:22 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<nhVFr7RH5pAyBsPO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.32.50.39
country_id: 6252001
description:
2026-01-06 14:50:36 dovecot_login authenticator failed for H=(ADMIN) [212.32.50.39]:46733: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 14:55:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<gU7uwLRHauNA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 14:55:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<z34WwrRHmogifrCV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 14:58:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<KSbqy7RHitJm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 15:01:37 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<xbF317RHLc8z0msW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.82.194
country_id: 1269750
description:
2026-01-06 15:03:00 dovecot_login authenticator failed for H=([59.145.171.168]) [182.78.82.194]:40960: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.115.237.19
country_id: 3923057
description:
2026-01-06 15:02:39 dovecot_login authenticator failed for H=([181.115.237.19]) [181.115.237.19]:56109: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 15:03:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<3SLs3bRHmpqi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 15:03:29 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<PH0q3rRHgJAIijoY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2026-01-06 15:04:07 dovecot_plain authenticator failed for H=c-71-224-169-28.hsd1.pa.comcast.net (ittly) [71.224.169.28]:51178: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Jan  6 15:04:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@melanifinefood.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<nRl64bRHDIkvT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 15:04:39 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<tdlU4rRHrucIijoY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-06 15:05:24 dovecot_plain authenticator failed for H=(togerdeste) [64.72.74.162]:49093: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 15:06:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<bKC457RH0rJm2gqW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.250.201.1
country_id: 2245662
description:
2026-01-06 15:07:11 dovecot_login authenticator failed for H=([196.250.201.125]) [196.250.201.1]:10141: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.143
country_id: 1819730
description:
2026-01-06 15:06:56 dovecot_login authenticator failed for H=(223-197-153-143.static.imsbiz.com) [223.197.153.143]:60953: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 15:08:06 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<5Fix7rRHtq2i8KbF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.194
country_id: 99237
description:
2026-01-06 15:08:31 dovecot_plain authenticator failed for H=(dumbles) [65.20.148.194]:34952: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.122.43
country_id: 3042058
description:
2026-01-06 15:11:03 dovecot_login authenticator failed for H=(ADMIN) [91.90.122.43]:8389: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 15:13:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<43N3A7VHwpZA46ZK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-01-06 15:17:39 dovecot_plain authenticator failed for H=(chark) [102.53.15.18]:46136: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.178.136
country_id: 3175395
description:
Jan  6 15:19:03 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=217.26.178.136, lip=66.85.158.91, TLS, session=<zUC3FLVHGKvZGrKI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.231.47.253
country_id: 1269750
description:
Jan  6 15:19:03 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=103.231.47.253, lip=66.85.158.91, TLS, session=<StHCFLVHI59n5y/9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.112.105.140
country_id: 3175395
description:
Jan  6 15:19:21 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<hr>, method=PLAIN, rip=217.112.105.140, lip=66.85.158.91, TLS, session=<EvoTFrVHb7vZcGmM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.235.7.231
country_id: 3077311
description:
Jan  6 15:19:21 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<hr>, method=PLAIN, rip=109.235.7.231, lip=66.85.158.91, TLS, session=<ILkOFrVHpN1t6wfn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.112.148.66
country_id: 130758
description:
2026-01-06 15:19:27 dovecot_login authenticator failed for H=([185.112.148.66]) [185.112.148.66]:59227: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.170
country_id: 1269750
description:
2026-01-06 15:19:39 dovecot_login authenticator failed for H=([182.95.52.170]) [182.95.52.170]:54844: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 15:20:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<qv7jGrVHUKhCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 15:20:41 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<QLu1G7VHf+x100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 15:20:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<BZd/HLVHfowIhpC/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 15:21:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<Na6CHrVHRsYyBsPO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  6 15:25:38 host2 sshd[2035026]: Disconnected from invalid user admin 2.57.121.112 port 13485 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.119.198.81
country_id: 3932488
description:
Jan  6 15:27:51 host2 sshd[2036868]: Disconnected from invalid user user5 190.119.198.81 port 37868 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 15:28:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<o4s1N7VHuqRA46ZK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.124.206
country_id: 1269750
description:
2026-01-06 15:29:05 dovecot_login authenticator failed for H=([182.95.87.3]) [182.95.124.206]:34196: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2026-01-06 15:29:35 dovecot_login authenticator failed for H=([59.145.84.169]) [182.95.176.122]:45690: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.142.106.177
country_id: 298795
description:
2026-01-06 15:30:04 dovecot_login authenticator failed for H=([188.132.210.145]) [195.142.106.177]:12066: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 15:30:07 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<b/tmPbVHoIQifrCV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.6.147
country_id: 3144096
description:
2026-01-06 15:30:46 dovecot_login authenticator failed for H=(cm-78.156.6.147.get.no) [78.156.6.147]:43556: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.252
country_id: 2186224
description:
2026-01-06 15:30:26 dovecot_login authenticator failed for H=([121.73.168.252]) [121.73.168.252]:53754: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.100.64.148
country_id: 289688
description:
Jan  6 15:30:26 host2 sshd[2039476]: Disconnected from invalid user paulo 78.100.64.148 port 62868 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.211.152.138
country_id: 3469034
description:
Jan  6 15:31:09 host2 sshd[2040115]: Disconnected from invalid user ferry 102.211.152.138 port 47348 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.119.198.81
country_id: 3932488
description:
Jan  6 15:31:12 host2 sshd[2040151]: Disconnected from invalid user noc 190.119.198.81 port 34556 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 15:31:42 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<Ei0RQ7VH88wz0msW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.119.198.81
country_id: 3932488
description:
Jan  6 15:32:27 host2 sshd[2041243]: Disconnected from invalid user claude 190.119.198.81 port 58124 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 15:33:01 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<eRfOR7VH/rxm2gqW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.100.64.148
country_id: 289688
description:
Jan  6 15:33:11 host2 sshd[2041998]: Disconnected from invalid user eric 78.100.64.148 port 56364 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.242.142
country_id: 1269750
description:
2026-01-06 15:33:40 dovecot_login authenticator failed for H=([182.78.242.142]) [182.78.242.142]:37456: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.36.108
country_id: 3932488
description:
2026-01-06 15:33:53 dovecot_login authenticator failed for H=([190.223.36.108]) [190.223.36.108]:58696: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 15:35:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<pyp5T7VHkNyi8GQy>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 78.100.64.148
country_id: 289688
description:
Jan  6 15:35:13 host2 sshd[2044472]: Disconnected from invalid user admin 78.100.64.148 port 37452 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.239.23
country_id: 1227603
description:
2026-01-06 15:35:37 dovecot_login authenticator failed for H=(ADMIN) [95.181.239.23]:15684: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 15:38:36 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<RJ7HW7VHyp8IijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 15:39:39 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<yluLX7VH2MCi8KbF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 15:39:48 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<cOEIYLVHqIgIijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 15:40:40 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<jKgqY7VH+pdm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Jan  6 15:42:21 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<HvkgabVH4LkvT1jH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan  6 15:45:45 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<bopwdbVHzqEDiUnd>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 15:46:26 host2 sshd[2056416]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan  6 15:46:29 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<p+QaeLVHLtIDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan  6 15:47:43 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<bf91fLVHuOQDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.151.88.27
country_id: 6251999
description:
2026-01-06 15:48:06 dovecot_login authenticator failed for H=([184.151.88.27]) [184.151.88.27]:60150: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 15:47:17 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<EZnUerVHQNBA46ZK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.211.130.180
country_id: 6252001
description:
2026-01-06 15:47:42 dovecot_login authenticator failed for H=([162.211.130.180]) [162.211.130.180]:42715: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan  6 15:49:02 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<g4gvgbVHpOwDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan  6 15:49:35 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<D/8mg7VH0IMDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.185.119.170
country_id: 3175395
description:
2026-01-06 15:50:56 dovecot_login authenticator failed for H=([94.185.119.170]) [94.185.119.170]:36561: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.51
country_id: 3144096
description:
2026-01-06 15:50:18 dovecot_login authenticator failed for H=([62.97.170.51]) [62.97.170.51]:57947: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan  6 15:50:48 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<gIeLh7VHQocDiUnd>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.137.73.221
country_id: 6252001
description:
Jan  6 15:51:32 host2 dovecot[1170291]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<yYQgirVHlrADiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan  6 15:51:30 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<7Pj9ibVHkLADiUnd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 15:52:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<3GBzjrVHsMMyBsPO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan  6 15:52:22 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<NcQjjbVHaJ8DiUnd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 15:52:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<kxkDjbVHVshCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 15:54:30 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<BD6flLVHUUt100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.241.125.165
country_id: 6252001
description:
2026-01-06 15:55:36 dovecot_login authenticator failed for H=(ADMIN) [151.241.125.165]:53596: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.164.107.6
country_id: 6252001
description:
Jan  6 15:55:59 host2 pure-ftpd[2068464]: (?@194.164.107.6) [INFO] New connection from 194.164.107.6


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 15:57:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<D1u1nbVHAJQIhpC/>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 15:59:39 host2 sshd[2072579]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 16:01:47 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<dgmirrVHeslA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 16:02:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<N+sOsbVHJM4z0msW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.104
country_id: 1880251
description:
Jan  6 16:03:22 host2 sshd[2077361]: Disconnected from invalid user test1 45.78.230.104 port 52324 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 16:05:02 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<1yVNurVHVo8ifrCV>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 16:05:37 host2 sshd[2080143]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 16:07:05 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<PleawbVHqMdm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.36.101
country_id: 3469034
description:
Jan  6 16:07:31 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=191.240.36.101, lip=66.85.158.91, TLS, session=<VLAfwrVH+r+/8CRl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 16:07:34 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<fyRbw7VHNrGi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.37.218
country_id: 2300660
description:
Jan  6 16:07:54 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<charanaw>, method=PLAIN, rip=41.139.37.218, lip=66.85.158.91, TLS, session=<67Zyw7VHUY4piyXa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.20.58.146
country_id: 798544
description:
Jan  6 16:07:57 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=46.20.58.146, lip=66.85.158.91, TLS, session=<ojrkw7VHB+kuFDqS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.104.224
country_id: 3469034
description:
Jan  6 16:08:20 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=187.120.104.224, lip=66.85.158.91, TLS, session=<Re4GxbVHdI67eGjg>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.230.104
country_id: 1880251
description:
Jan  6 16:09:58 host2 sshd[2085019]: Disconnected from invalid user teste 45.78.230.104 port 51198 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.104
country_id: 1880251
description:
Jan  6 16:11:12 host2 sshd[2086713]: Disconnected from invalid user claude 45.78.230.104 port 58570 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 16:11:24 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<tDAT0bVHwpqi8KbF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 16:14:34 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<VsBg3LVHAK8IijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 16:14:56 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<Kfew3bVHhpVm2gqW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.155
country_id: 3703430
description:
Jan  6 16:16:29 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=45.227.254.155, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<ZhFj47VHR/4t4/6b>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.104
country_id: 1880251
description:
Jan  6 16:17:24 host2 sshd[2093576]: Disconnected from invalid user sysadmin 45.78.230.104 port 50044 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 16:18:44 host2 sshd[2095205]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Jan  6 16:20:27 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<Blpm8bVHrMYvT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 16:20:50 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<q+zH8rVH7pxA46ZK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  6 16:21:26 host2 sshd[2098247]: Disconnected from invalid user admin 2.57.121.112 port 43453 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 16:24:16 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<5N8U/7VHZscyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 16:24:51 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<0f0sAbZHso9CdMzo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.32.122.59
country_id: 597427
description:
2026-01-06 16:26:01 dovecot_login authenticator failed for H=(ADMIN) [194.32.122.59]:1126: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 16:28:58 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<ewTqD7ZHxqR100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.182.118
country_id: 1269750
description:
2026-01-06 16:30:00 dovecot_login authenticator failed for H=([59.145.86.177]) [125.19.182.118]:33094: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2026-01-06 16:29:28 dovecot_login authenticator failed for H=([103.50.5.94]) [103.50.5.94]:40084: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 16:33:17 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<LAlSH7ZHws8z0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 16:33:55 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<c4KQIbZHLJ8IhpC/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 16:35:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<6BZ0J7ZHYNdA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 16:40:02 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<ZhxoN7ZHEoii8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 16:40:02 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<Fzh0N7ZHnugifrCV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.130.206
country_id: 3144096
description:
2026-01-06 16:40:11 dovecot_login authenticator failed for H=(cm-178.232.130.206.get.no) [178.232.130.206]:46837: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.188.130
country_id: 3144096
description:
2026-01-06 16:40:46 dovecot_login authenticator failed for H=(cm-84.213.188.130.get.no) [84.213.188.130]:51538: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 16:41:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<7MKDO7ZHuKdm2gqW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.124.97.102
country_id: 2245662
description:
Jan  6 16:41:36 host2 sshd[2120131]: Disconnected from invalid user postgres 154.124.97.102 port 33093 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.183.128.237
country_id: 1269750
description:
Jan  6 16:41:47 host2 sshd[2120296]: Disconnected from invalid user shoutcast 52.183.128.237 port 35272 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.80.18.158
country_id: 3686110
description:
Jan  6 16:42:57 host2 sshd[2121568]: Disconnected from invalid user admin 186.80.18.158 port 45494 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 16:43:02 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<EmovQrZHiuei8KbF>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.80.18.158
country_id: 3686110
description:
Jan  6 16:43:32 host2 sshd[2122274]: Disconnected from invalid user bitrix 186.80.18.158 port 44122 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.183.128.237
country_id: 1269750
description:
Jan  6 16:45:05 host2 sshd[2123908]: Disconnected from invalid user claude 52.183.128.237 port 50778 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.21.38.198
country_id: 1269750
description:
Jan  6 16:44:11 host2 sshd[2122907]: Disconnected from invalid user claude 202.21.38.198 port 58304 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.80.18.158
country_id: 3686110
description:
Jan  6 16:44:12 host2 sshd[2122941]: Disconnected from invalid user claude 186.80.18.158 port 60940 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.80.18.158
country_id: 3686110
description:
Jan  6 16:45:37 host2 sshd[2124452]: Disconnected from invalid user temp 186.80.18.158 port 59100 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.183.128.237
country_id: 1269750
description:
Jan  6 16:45:44 host2 sshd[2124585]: Disconnected from invalid user bkp 52.183.128.237 port 37092 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 52.183.128.237
country_id: 1269750
description:
Jan  6 16:46:31 host2 sshd[2125413]: Disconnected from invalid user claude 52.183.128.237 port 52298 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.124.97.102
country_id: 2245662
description:
Jan  6 16:46:10 host2 sshd[2124962]: Disconnected from invalid user ahmed 154.124.97.102 port 43589 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.60.152
country_id: 2782113
description:
2026-01-06 16:46:26 dovecot_login authenticator failed for H=(ADMIN) [156.146.60.152]:45389: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.124.97.102
country_id: 2245662
description:
Jan  6 16:47:17 host2 sshd[2126116]: Disconnected from invalid user homeassistant 154.124.97.102 port 37628 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.21.38.198
country_id: 1269750
description:
Jan  6 16:47:50 host2 sshd[2126649]: Disconnected from invalid user deploy 202.21.38.198 port 59736 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 16:48:53 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<p0QgV7ZHcrdm2gqW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.124.97.102
country_id: 2245662
description:
Jan  6 16:49:20 host2 sshd[2128379]: Disconnected from invalid user admin 154.124.97.102 port 46174 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 16:50:46 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<DLLcXbZHNL4IijoY>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 130.250.191.200
country_id: 1269750
description:
Jan  6 16:51:08 host2 sshd[2130470]: Disconnected from invalid user suporte 130.250.191.200 port 55182 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 16:52:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<K/NKYrZHGKcIijoY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 130.250.191.200
country_id: 1269750
description:
Jan  6 16:52:04 host2 sshd[2131570]: Disconnected from invalid user ubuntu 130.250.191.200 port 55408 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 16:54:59 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<wuTqbLZHDoVA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 16:55:43 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<mh2Ob7ZHkL0yBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 16:57:35 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<Sb0/drZHLJNCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Jan  6 16:58:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<C/M6erZHdKwvT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 17:04:15 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<gC4YjrZH4dEz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 17:05:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<9NWIkbZHcoZ100Db>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.241.36.24
country_id: 1269750
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 43.241.36.24 - yashiholdings "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yashiholdings (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.138
country_id: 3077311
description:
2026-01-06 17:06:42 dovecot_login authenticator failed for H=(ADMIN) [212.102.39.138]:52982: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.183.74.130
country_id: 1643084
description:
Jan  6 17:09:01 host2 sshd[2147042]: Disconnected from invalid user april 103.183.74.130 port 36424 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.64.104.195
country_id: 6252001
description:
Jan  6 17:09:32 host2 pure-ftpd[2147450]: (?@20.64.104.195) [INFO] New connection from 20.64.104.195


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 17:09:49 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<qkL3obZHwOJA46ZK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.183.74.130
country_id: 1643084
description:
Jan  6 17:10:51 host2 sshd[2148568]: Disconnected from invalid user hydra 103.183.74.130 port 45478 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 17:10:59 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<zp8sprZHir4IhpC/>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.106.196.31
country_id: 6252001
description:
Jan  6 17:14:06 host2 pure-ftpd[2151961]: (?@20.106.196.31) [INFO] New connection from 20.106.196.31


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 77.83.39.144
country_id: 690791
description:
Jan  6 17:14:00 host2 sshd[2151846]: Invalid user cloudtourssrilan_travel from 77.83.39.144 port 48034


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 17:14:48 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<noHQs7ZHbq2i8KbF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 17:15:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<oYoPtbZHioFm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 17:15:14 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<VFFTtbZHRMkifrCV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 77.83.39.144
country_id: 690791
description:
Jan  6 17:16:35 host2 sshd[2154243]: Invalid user cloudtourssrilan_travel from 77.83.39.144 port 37154


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.16.52.51
country_id: 2921044
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 178.16.52.51 - env_eng@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-06 17:22:25 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:64175: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 17:22:51 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<g8GR0LZH8JJm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 17:26:47 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<XOyv3rZH9LkyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 17:27:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<eyjy4LZHTs0IijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 17:28:39 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<XAla5bZHOLYIijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 17:29:20 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<KWLE57ZHJNZA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 17:29:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<xCQw6bZHEJ5CdMzo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.215.235.109
country_id: 1831722
description:
2026-01-06 17:29:51 dovecot_login authenticator failed for H=(ADMIN) [188.215.235.109]:12970: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.5.129.68
country_id: 3017382
description:
2026-01-06 17:32:06 dovecot_plain authenticator failed for H=68.129.5.84.rev.sfr.net (aphory) [84.5.129.68]:59431: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 17:35:05 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<ZZlb/LZHkdMz0msW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.88.196.91
country_id: 6252001
description:
2026-01-06 17:34:16 dovecot_plain authenticator failed for H=c-73-88-196-91.hsd1.ky.comcast.net (koaddist) [73.88.196.91]:57226: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.59.154
country_id: 1269750
description:
2026-01-06 17:37:10 dovecot_login authenticator failed for H=([182.95.7.193]) [182.95.59.154]:42508: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 17:37:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<ZijVBbdHCdZ100Db>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.94.210.79
country_id: 2750405
description:
Jan  6 17:39:08 host2 pure-ftpd[2175889]: (?@158.94.210.79) [INFO] New connection from 158.94.210.79


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Jan  6 17:39:34 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<VytiDLdHGuwvT1jH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.59.157
country_id: 3277605
description:
2026-01-06 17:43:29 dovecot_login authenticator failed for H=([195.222.59.157]) [195.222.59.157]:45714: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.179.251
country_id: 99237
description:
2026-01-06 17:43:48 dovecot_login authenticator failed for H=([65.20.179.251]) [65.20.179.251]:52563: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 17:44:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<IKBbHbdHEoBA46ZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 17:44:25 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<+qS3HbdHEp6i8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan  6 17:46:40 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<ySu8JbdH1q6i8KbF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.134.144.191
country_id: 1814991
description:
Jan  6 17:48:45 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=8.134.144.191, lip=66.85.158.91, session=<J0o4LbdHnMAIhpC/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 17:49:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<s6bFLrdHyoNm2gqW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.2
country_id: 1269750
description:
2026-01-06 17:49:20 dovecot_login authenticator failed for H=([125.19.173.202]) [152.52.236.2]:42524: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.34.221
country_id: 1210997
description:
2026-01-06 17:49:52 dovecot_login authenticator failed for H=(113-11-34-221-smile.com.bd) [113.11.34.221]:40992: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 34.126.176.149
country_id: 1880251
description:
Jan  6 17:50:34 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=34.126.176.149, lip=66.85.158.91, session=<H5W9M7dHIt8ifrCV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.19.210.176
country_id: 6252001
description:
2026-01-06 17:51:26 dovecot_login authenticator failed for H=(ADMIN) [37.19.210.176]:16800: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 17:53:40 host2 sshd[2191568]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 17:54:27 host2 sshd[2192575]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 17:56:10 host2 sshd[2194636]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.85.144
country_id: 1269750
description:
2026-01-06 17:57:09 dovecot_login authenticator failed for H=(abts-north-static-144.85.160.122.airtelbroadband.in) [122.160.85.144]:45639: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan  6 17:56:57 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@venee.lk>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<60CLSrdHWItm2gqW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.70.19.11
country_id: 3469034
description:
2026-01-06 17:57:22 dovecot_login authenticator failed for H=(45-70-19-11.static.damsolutionsturbo.com.br) [45.70.19.11]:53260: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.174
country_id: 732800
description:
2026-01-06 17:57:50 dovecot_plain authenticator failed for H=(praers) [92.62.243.174]:51147: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  6 17:58:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<asUBT7dHTscyBsPO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2026-01-06 17:59:28 dovecot_plain authenticator failed for H=c-73-197-236-163.hsd1.nj.comcast.net (leneoly) [73.197.236.163]:45964: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.247.159
country_id: 6251999
description:
Jan  6 18:00:08 host2 sshd[2198877]: Disconnected from invalid user developer 158.69.247.159 port 63749 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 223.123.65.45
country_id: 1168579
description:
Jan  6 18:01:09 host2 sshd[2200104]: Disconnected from invalid user elasticsearch 223.123.65.45 port 56298 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.247.159
country_id: 6251999
description:
Jan  6 18:01:55 host2 sshd[2200733]: Disconnected from invalid user nextcloud 158.69.247.159 port 50696 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.156
country_id: 3865483
description:
Jan  6 18:02:24 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@jrdc.lk>, method=PLAIN, rip=179.0.251.156, lip=66.85.158.91, TLS, session=<LOHoXLdHg7SzAPuc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.85
country_id: 3865483
description:
Jan  6 18:02:25 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@jrdc.lk>, method=PLAIN, rip=179.0.252.85, lip=66.85.158.91, TLS, session=<7xjwXLdHl56zAPxV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.39.212.79
country_id: 2510769
description:
Jan  6 18:02:43 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=46.39.212.79, lip=66.85.158.91, TLS, session=<JsAuXrdHp4wuJ9RP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.33.212
country_id: 953987
description:
Jan  6 18:02:47 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=102.64.33.212, lip=66.85.158.91, TLS, session=<fRNgXrdHeqpmQCHU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.236
country_id: 3865483
description:
Jan  6 18:02:23 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@jrdc.lk>, method=PLAIN, rip=179.0.252.236, lip=66.85.158.91, TLS, session=<XV7qXLdHncmzAPzs>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.247.159
country_id: 6251999
description:
Jan  6 18:02:28 host2 sshd[2201211]: Disconnected from invalid user claude 158.69.247.159 port 53222 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.92
country_id: 3469034
description:
Jan  6 18:02:46 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=177.44.71.92, lip=66.85.158.91, TLS, session=<v0VMXrdHaImxLEdc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  6 18:02:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<c25BXbdHzJNCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.159
country_id: 3865483
description:
Jan  6 18:02:26 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info@jrdc.lk>, method=PLAIN, rip=179.0.250.159, lip=66.85.158.91, TLS, session=<9pjsXLdHQp6zAPqf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.96
country_id: 3865483
description:
Jan  6 18:02:24 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@jrdc.lk>, method=PLAIN, rip=179.0.250.96, lip=66.85.158.91, TLS, session=<BaHrXLdHTZuzAPpg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.140.123.4
country_id: 6290252
description:
Jan  6 18:02:43 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=95.140.123.4, lip=66.85.158.91, TLS, session=<0yVGXrdHHbBfjHsE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.105.135
country_id: 3865483
description:
Jan  6 18:02:54 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=45.238.105.135, lip=66.85.158.91, TLS, session=<7bfhXrdHfuEt7mmH>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 158.69.247.159
country_id: 6251999
description:
Jan  6 18:03:33 host2 sshd[2202418]: Disconnected from invalid user claude 158.69.247.159 port 28051 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 18:04:44 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@lankaherbalsolutions.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<Y+hhZrdHiNwIijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.138.58.24
country_id: 1814991
description:
Jan  6 18:05:59 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@sobaherbal.com>, method=PLAIN, rip=8.138.58.24, lip=66.85.158.91, session=<WuHUardHcMUIijoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.166.74
country_id: 1269750
description:
Jan  6 18:05:19 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@nsteeleng.com>, method=PLAIN, rip=64.227.166.74, lip=66.85.158.91, session=<n4lyaLdH8K5A46ZK>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 18:06:44 host2 sshd[2205645]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 158.69.247.159
country_id: 6251999
description:
Jan  6 18:06:17 host2 sshd[2205345]: Received disconnect from 158.69.247.159 port 14947:11: Bye Bye [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan  6 18:06:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<FUP9a7dHI9cz0msW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.36.214.46
country_id: 3469034
description:
Jan  6 23:22:27 host2 sshd[2219463]: Disconnected from invalid user claude 177.36.214.46 port 38651 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.2
country_id: 798549
description:
Jan  6 23:25:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.2, lip=66.85.158.92, session=<Ps2Q4LtH3JZV2ZUC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  6 23:24:42 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@essenceceylontea.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<ZeCo3rtHrLyi8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2026-01-06 23:25:20 dovecot_plain authenticator failed for H=217-215-74-195-no2620.tbcn.telia.com (beguess) [217.215.74.195]:60744: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.49.53
country_id: 1668284
description:
2026-01-06 23:26:33 dovecot_login authenticator failed for H=(ADMIN) [173.244.49.53]:34496: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.229.122.23
country_id: 1819730
description:
Jan  6 23:29:25 host2 sshd[2223405]: Disconnected from invalid user noreply 83.229.122.23 port 59162 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.254.20
country_id: 1819730
description:
Jan  6 23:31:22 host2 sshd[2225792]: Disconnected from invalid user student 152.32.254.20 port 35766 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.229.122.23
country_id: 1819730
description:
Jan  6 23:31:50 host2 sshd[2226387]: Disconnected from invalid user claude 83.229.122.23 port 39902 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.134.231
country_id: 6252001
description:
Jan  6 23:33:00 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=71.6.134.231, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<QlR8/LtHUsFHBobn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.229.122.23
country_id: 1819730
description:
Jan  6 23:33:12 host2 sshd[2227906]: Disconnected from invalid user desktop 83.229.122.23 port 56064 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  6 23:32:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<bWJt+rtH5up100Db>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.254.20
country_id: 1819730
description:
Jan  6 23:32:40 host2 sshd[2227418]: Disconnected from invalid user gemini 152.32.254.20 port 34374 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.227
country_id: 6252001
description:
Jan  6 23:33:32 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.227, lip=66.85.158.91, TLS handshaking: Connection closed, session=<2Q9d/rtHx/FAPpzj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.222
country_id: 6252001
description:
Jan  6 23:33:49 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.222, lip=66.85.158.91, TLS handshaking: Connection closed, session=<L1dr/7tHWMVAPpze>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2026-01-06 23:35:07 dovecot_plain authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net (exper) [71.62.34.216]:45018: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 83.229.122.23
country_id: 1819730
description:
Jan  6 23:35:12 host2 sshd[2230304]: Disconnected from invalid user myuser 83.229.122.23 port 57612 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
country_id: 1880251
description:
2026-01-06 23:35:13 dovecot_login authenticator failed for H=(bb128-106-196-150.singnet.com.sg) [128.106.196.150]:33840: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.104.235.39
country_id: 1282988
description:
Jan  6 23:34:22 host2 sshd[2229270]: Disconnected from invalid user debian 103.104.235.39 port 57142 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.211.220.203
country_id: 2661886
description:
2026-01-06 23:35:31 dovecot_login authenticator failed for H=31-211-220-203.customers.ownit.se [31.211.220.203]:45901: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2026-01-06 23:40:13 dovecot_plain authenticator failed for H=c-98-227-25-115.hsd1.il.comcast.net (crimbrack) [98.227.25.115]:36726: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.84.54
country_id: 1269750
description:
2026-01-06 23:40:38 dovecot_login authenticator failed for H=([182.79.151.121]) [27.123.84.54]:39378: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.193.187.154
country_id: 1269750
description:
2026-01-06 23:40:52 dovecot_login authenticator failed for H=([113.193.187.154]) [113.193.187.154]:46518: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.198.73
country_id: 798544
description:
2026-01-06 23:44:21 dovecot_plain authenticator failed for H=5.185.198.73.ipv4.public.orange.pl (hadeace) [5.185.198.73]:43102: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.82.9.143
country_id: 6252001
description:
2026-01-06 23:44:23 dovecot_login authenticator failed for H=(lezzarotech.com) [206.82.9.143]:62285: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 23:50:13 host2 sshd[2245147]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.205
country_id: 3077311
description:
2026-01-06 23:49:36 dovecot_login authenticator failed for H=(ADMIN) [212.102.39.205]:52003: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  6 23:51:11 host2 sshd[2246018]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.227.87.112
country_id: 6252001
description:
Jan  6 23:55:04 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=165.227.87.112, lip=66.85.158.91, session=<eg1rS7xH+NWl41dw>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.227.87.112
country_id: 6252001
description:
Jan  6 23:55:23 host2 pure-ftpd[2250464]: (?@165.227.87.112) [INFO] New connection from 165.227.87.112


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.227.87.112
country_id: 6252001
description:
Jan  6 23:55:23 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=165.227.87.112, lip=66.85.158.92, TLS: Connection closed, session=<20N+TLxHup6l41dw>


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 165.227.87.112
country_id: 6252001
description:
Jan  6 23:55:26 host2 pure-ftpd[2250516]: (?@165.227.87.112) [INFO] New connection from 165.227.87.112


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.10.122
country_id: 226074
description:
Jan  6 23:58:03 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=196.0.10.122, lip=66.85.158.91, TLS, session=<xCatVLxHbevEAAp6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.220
country_id: 3865483
description:
Jan  6 23:57:35 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 29 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=179.0.250.220, lip=66.85.158.91, TLS, session=<eKitUrxHHISzAPrc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.90.235.157
country_id: 2921044
description:
Jan  6 23:58:37 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=164.90.235.157, lip=66.85.158.92, TLS handshaking: Connection closed, session=<CXkaWLxHhjekWuud>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.248
country_id: 2186224
description:
2026-01-07 00:02:10 dovecot_login authenticator failed for H=([121.73.162.248]) [121.73.162.248]:43848: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.144.255.167
country_id: 6252001
description:
2026-01-07 00:02:35 dovecot_login authenticator failed for H=([108.144.255.167]) [108.144.255.167]:38109: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 00:04:10 host2 sshd[2261057]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.251
country_id: 6252001
description:
Jan  7 00:03:59 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.251, lip=66.85.158.92, TLS, session=<H/NCa7xHuO/N0h/7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.108.231.55
country_id: 2077456
description:
Jan  7 00:07:10 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=103.108.231.55, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<v+urdrxHXAtnbOc3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.89.72
country_id: 660013
description:
2026-01-07 00:08:17 dovecot_login authenticator failed for H=(ADMIN) [188.126.89.72]:42501: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.60.143.30
country_id: 3175395
description:
2026-01-07 00:08:53 dovecot_login authenticator failed for H=([151.60.143.30]) [151.60.143.30]:44695: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.149.153.106
country_id: 3175395
description:
2026-01-07 00:10:11 dovecot_plain authenticator failed for H=(craceapt) [88.149.153.106]:37386: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.155.130
country_id: 6252001
description:
2026-01-07 00:09:24 dovecot_login authenticator failed for H=(c-50-187-155-130.unallocated.comcastbusiness.net) [50.187.155.130]:49160: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.108.231.55
country_id: 2077456
description:
Jan  7 00:09:57 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=103.108.231.55, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<G12fgLxHREdnbOc3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  7 00:11:13 host2 sshd[2267683]: Disconnected from invalid user user 2.57.121.25 port 48680 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.202.118.18
country_id: 6252001
description:
Jan  7 00:16:55 host2 pure-ftpd[2272794]: (?@172.202.118.18) [INFO] New connection from 172.202.118.18


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-07 00:17:18 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:63145: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.132
country_id: 6252001
description:
Jan  7 00:18:46 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.132, lip=66.85.158.92, TLS: Connection closed, session=<LaAkoLxHhiVChJmE>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.84
country_id: 6252001
description:
Jan  7 00:22:14 host2 pure-ftpd[2277202]: (?@147.185.132.84) [INFO] New connection from 147.185.132.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.202
country_id: 1269750
description:
2026-01-07 00:22:24 dovecot_login authenticator failed for H=([182.95.123.202]) [182.95.123.202]:49624: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.233
country_id: 1269750
description:
2026-01-07 00:24:24 dovecot_login authenticator failed for H=(nsg-corporate-233.228.187.122.airtel.in) [122.187.228.233]:44057: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.104.235.38
country_id: 1282988
description:
Jan  7 00:24:26 host2 sshd[2278862]: Disconnected from invalid user claude 103.104.235.38 port 37620 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.216.66
country_id: 1269750
description:
2026-01-07 00:24:48 dovecot_login authenticator failed for H=([182.66.234.193]) [125.19.216.66]:33528: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.50
country_id: 6252001
description:
Jan  7 00:27:31 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.50, lip=66.85.158.92, TLS: Connection closed, session=<U5Vrv7xHniWnXpIy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.101
country_id: 6251999
description:
2026-01-07 00:28:18 dovecot_login authenticator failed for H=([207.219.221.101]) [207.219.221.101]:43224: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.41.206.207
country_id: 6252001
description:
2026-01-07 00:31:30 dovecot_login authenticator failed for H=(ADMIN) [181.41.206.207]:9318: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.55
country_id: 6252001
description:
Jan  7 00:33:37 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.55, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<AmtE1bxHG9iTuYQ3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.183.110.215
country_id: 798544
description:
2026-01-07 00:33:53 dovecot_login authenticator failed for H=178.183.110.215.mobile.static.t-mobile.pl [178.183.110.215]:35282: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 00:38:55 host2 sshd[2292384]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.140.219
country_id: 298795
description:
2026-01-07 00:41:03 dovecot_plain authenticator failed for H=(sorrila) [5.11.140.219]:50102: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.68
country_id: 6252001
description:
Jan  7 00:46:55 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.20.68, lip=66.85.158.91, session=<yL7SBL1HiLxBMRRE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.66
country_id: 6252001
description:
Jan  7 00:47:01 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.20.66, lip=66.85.158.92, session=<14smBb1H7LJBMRRC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.66
country_id: 6252001
description:
Jan  7 00:47:13 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=65.49.20.66, lip=66.85.158.92, TLS: Connection closed, session=<LBneBb1HHg9BMRRC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.31.197.108
country_id: 6252001
description:
2026-01-07 00:47:16 dovecot_login authenticator failed for H=(173-31-197-108.client.mchsi.com) [173.31.197.108]:54112: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.68
country_id: 6252001
description:
Jan  7 00:47:09 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.20.68, lip=66.85.158.91, TLS: Connection closed, session=<XpSkBb1HlnhBMRRE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.104.235.37
country_id: 1282988
description:
Jan  7 00:48:55 host2 sshd[2303063]: Disconnected from invalid user ubuntu 103.104.235.37 port 41649 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.167
country_id: 2993457
description:
Jan  7 00:49:18 host2 pure-ftpd[2303511]: (?@194.165.16.167) [INFO] New connection from 194.165.16.167


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.89.35
country_id: 660013
description:
2026-01-07 00:52:46 dovecot_login authenticator failed for H=(ADMIN) [188.126.89.35]:64914: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 01:00:04 host2 sshd[2314836]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.202.113.3
country_id: 6252001
description:
Jan  7 00:59:58 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.202.113.3, lip=66.85.158.91, TLS, session=<8YiAM71H/KWsynED>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.107.70
country_id: 3469034
description:
2026-01-07 01:02:20 dovecot_login authenticator failed for H=(72-107-226-38.edgetelecom.com.br) [38.226.107.70]:49038: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.192.166
country_id: 1269750
description:
2026-01-07 01:02:38 dovecot_login authenticator failed for H=(aes-static-025.20.22.125.airtel.in) [128.185.192.166]:36010: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.122.128.235
country_id: 3865483
description:
Jan  7 01:05:07 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=190.122.128.235, lip=66.85.158.91, TLS, session=<oBi/RL1HNIW+eoDr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.152.21.156
country_id: 3469034
description:
Jan  7 01:04:45 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=177.152.21.156, lip=66.85.158.91, TLS, session=<1/6FQ71HJpixmBWc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2026-01-07 01:05:27 dovecot_plain authenticator failed for H=c-73-195-211-98.hsd1.nj.comcast.net (monidium) [73.195.211.98]:37394: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2026-01-07 01:06:33 dovecot_plain authenticator failed for H=c-73-213-237-28.hsd1.va.comcast.net (unbines) [73.213.237.28]:43728: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.192.123.12
country_id: 6252001
description:
2026-01-07 01:07:50 dovecot_plain authenticator failed for H=(potated) [199.192.123.12]:35030: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.15.200.1
country_id: 6252001
description:
Jan  7 01:08:12 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.15.200.1, lip=66.85.158.92, TLS, session=<rYD2UL1HqusUD8gB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.60.146
country_id: 1269750
description:
2026-01-07 01:10:01 dovecot_login authenticator failed for H=([182.95.60.146]) [182.95.60.146]:50904: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.197.168
country_id: 2661886
description:
2026-01-07 01:10:24 dovecot_login authenticator failed for H=h-176-10-197-168.a444.priv.bahnhof.se [176.10.197.168]:33904: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.209
country_id: 3996063
description:
2026-01-07 01:12:07 dovecot_login authenticator failed for H=([177.236.146.209]) [177.236.146.209]:50963: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.110.212.221
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 99.110.212.221 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-07 01:16:23 dovecot_login authenticator failed for H=(Upgk4iMPF) [158.94.208.110]:56271: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.218.54
country_id: 2802361
description:
2026-01-07 01:16:34 dovecot_login authenticator failed for H=(ADMIN) [181.214.218.54]:64023: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.19.200.63
country_id: 660013
description:
2026-01-07 01:16:43 dovecot_login authenticator failed for H=([146.19.200.63]) [146.19.200.63]:57386: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.149.220.7
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 71.149.220.7 - zz "GET /login/?login_only=1&user=zz&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user zz (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 139.138.11.239
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 139.138.11.239 - cloudtourssri "GET /login/?login_only=1&user=cloudtourssri&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssri (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.188.130
country_id: 3144096
description:
2026-01-07 01:17:36 dovecot_login authenticator failed for H=(cm-84.213.188.130.get.no) [84.213.188.130]:45381: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.176.159.170
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 69.176.159.170 - cloudtourssrilanka "GET /login/?login_only=1&user=cloudtourssrilanka&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilanka (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.16.13
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 172.56.16.13 - cloudtourssrilank "GET /login/?login_only=1&user=cloudtourssrilank&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilank (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.130.177.121
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 24.130.177.121 - cloudtourssrilan "GET /login/?login_only=1&user=cloudtourssrilan&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 40.142.132.220
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 40.142.132.220 - cloudtourssr "GET /login/?login_only=1&user=cloudtourssr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.188.239.33
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 70.188.239.33 - cloudtours "GET /login/?login_only=1&user=cloudtours&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtours (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.38.101.4
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 99.38.101.4 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.125.154.173
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 24.125.154.173 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.105.108.70
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 74.105.108.70 - cloudtourssril "GET /login/?login_only=1&user=cloudtourssril&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssril (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-07 01:17:10 dovecot_login authenticator failed for H=(i9VhR6) [158.94.208.110]:49781: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.111.1.175
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 74.111.1.175 - cloudtourssrilankacom "GET /login/?login_only=1&user=cloudtourssrilankacom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilankacom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.158.57.167
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 38.158.57.167 - cloudtourssrila "GET /login/?login_only=1&user=cloudtourssrila&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrila (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.223.212.241
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 47.223.212.241 - cloudtourss "GET /login/?login_only=1&user=cloudtourss&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourss (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 135.129.188.59
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 135.129.188.59 - cloudto2 "GET /login/?login_only=1&user=cloudto2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudto2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.62.176.216
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 75.62.176.216 - cloudtou "GET /login/?login_only=1&user=cloudtou&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtou (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 198.210.123.189
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 198.210.123.189 - cloud "GET /login/?login_only=1&user=cloud&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloud (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.93.254.222
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 99.93.254.222 - cloudt "GET /login/?login_only=1&user=cloudt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.1.142.38
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 104.1.142.38 - clou "GET /login/?login_only=1&user=clou&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user clou (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.173.188
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 172.59.173.188 - cl "GET /login/?login_only=1&user=cl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.49.52.180
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 72.49.52.180 - cloudto1 "GET /login/?login_only=1&user=cloudto1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudto1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.205.190.95
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 73.205.190.95 - cloudtour "GET /login/?login_only=1&user=cloudtour&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtour (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.117.99.207
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 99.117.99.207 - cloudto "GET /login/?login_only=1&user=cloudto&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudto (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.233.177.66
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 97.233.177.66 - clo "GET /login/?login_only=1&user=clo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user clo (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.123.118
country_id: 1269750
description:
2026-01-07 01:19:51 dovecot_login authenticator failed for H=([122.184.123.118]) [122.184.123.118]:53648: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 01:20:54 host2 sshd[2336337]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.158.145.31
country_id: 2510769
description:
2026-01-07 01:20:08 dovecot_login authenticator failed for H=31.145.158.146.dynamic.jazztel.es [146.158.145.31]:36007: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.178.229.240
country_id: 1880251
description:
Jan  7 01:22:43 host2 sshd[2337891]: Disconnected from invalid user gov 158.178.229.240 port 43278 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 158.178.229.240
country_id: 1880251
description:
Jan  7 01:22:50 host2 sshd[2338000]: Disconnected from invalid user gov 158.178.229.240 port 47438 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.194.231
country_id: 3144096
description:
2026-01-07 01:26:52 dovecot_login authenticator failed for H=(cm-178.232.194.231.get.no) [178.232.194.231]:40028: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.234
country_id: 2186224
description:
2026-01-07 01:26:19 dovecot_login authenticator failed for H=([121.73.168.234]) [121.73.168.234]:40382: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.178.224.92
country_id: 1880251
description:
Jan  7 01:29:11 host2 sshd[2344254]: Disconnected from invalid user epid 158.178.224.92 port 58750 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 158.178.224.92
country_id: 1880251
description:
Jan  7 01:29:26 host2 sshd[2344458]: Disconnected from invalid user epid 158.178.224.92 port 38518 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2026-01-07 01:30:01 dovecot_plain authenticator failed for H=c-24-23-125-83.hsd1.pa.comcast.net (boting) [24.23.125.83]:52402: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.140
country_id: 6252001
description:
Jan  7 01:32:56 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.140, lip=66.85.158.91, TLS: Connection closed, session=<R+Jhqb1HTjRChJmM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.53.254.168
country_id: 6252001
description:
2026-01-07 01:33:16 dovecot_plain authenticator failed for H=c-73-53-254-168.hsd1.fl.comcast.net (pantaga) [73.53.254.168]:41162: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.92.124.2
country_id: 1269750
description:
2026-01-07 01:36:25 dovecot_login authenticator failed for H=(static.bb.ill.59.92.124.2.bsnl.in) [59.92.124.2]:41689: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.224.242.137
country_id: 2635167
description:
2026-01-07 01:36:09 dovecot_login authenticator failed for H=([109.224.242.137]) [109.224.242.137]:37012: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 01:38:59 host2 sshd[2353393]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.6
country_id: 798549
description:
Jan  7 01:38:40 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.6, lip=66.85.158.91, session=<jMDlvb1H1L9V2ZUG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.122.88
country_id: 3144096
description:
2026-01-07 01:38:43 dovecot_login authenticator failed for H=(ADMIN) [46.246.122.88]:26803: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.118
country_id: 6252001
description:
Jan  7 01:42:03 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.118, lip=66.85.158.91, session=<hrv/yb1H9/5APsV2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.107
country_id: 6252001
description:
Jan  7 01:42:13 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.107, lip=66.85.158.91, TLS: Connection closed, session=<GrCTyr1H/PlAPsVr>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.249.55.106
country_id: 2017370
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 89.249.55.106 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.62.156.202
country_id: 6252001
description:
Jan  7 01:47:37 host2 pure-ftpd[2362438]: (?@64.62.156.202) [INFO] New connection from 64.62.156.202


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 01:52:03 host2 sshd[2366676]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.251.53.147
country_id: 6252001
description:
Jan  7 01:54:05 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=47.251.53.147, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<qtgC9b1HHFQv+zWT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.251.85.161
country_id: 6252001
description:
Jan  7 01:53:35 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=783) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=47.251.85.161, lip=66.85.158.92, TLS handshaking: read(size=783) failed: Connection reset by peer, session=<3/c3871HUmEv+1Wh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.251.53.147
country_id: 6252001
description:
Jan  7 01:54:09 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=47.251.53.147, lip=66.85.158.92, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<OWBB9b1HNlQv+zWT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.68.70.247
country_id: 2921044
description:
Jan  7 01:56:41 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=138.68.70.247, lip=66.85.158.92, TLS handshaking: Connection closed, session=<vQpN/r1HrOqKREb3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.126.52
country_id: 3703430
description:
2026-01-07 01:57:37 dovecot_login authenticator failed for H=(ADMIN) [91.90.126.52]:61147: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.101
country_id: 1880251
description:
Jan  7 02:00:26 host2 sshd[2375880]: Disconnected from invalid user claude 45.78.223.101 port 58804 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.51.22
country_id: 1880251
description:
Jan  7 02:00:51 host2 sshd[2376362]: Disconnected from invalid user safeuser 101.47.51.22 port 55788 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.208.99.137
country_id: 6252001
description:
Jan  7 02:01:52 host2 sshd[2377373]: Disconnected from invalid user portal 74.208.99.137 port 38372 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.208.99.137
country_id: 6252001
description:
Jan  7 02:03:12 host2 sshd[2378653]: Disconnected from invalid user smbguest 74.208.99.137 port 34548 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 74.208.99.137
country_id: 6252001
description:
Jan  7 02:03:46 host2 sshd[2379162]: Disconnected from invalid user jens 74.208.99.137 port 60738 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.208.99.137
country_id: 6252001
description:
Jan  7 02:04:22 host2 sshd[2379709]: Disconnected from invalid user claude 74.208.99.137 port 53370 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.101
country_id: 1880251
description:
Jan  7 02:04:53 host2 sshd[2380077]: Disconnected from invalid user track 45.78.223.101 port 54640 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.114.67.115
country_id: 3923057
description:
2026-01-07 02:07:05 dovecot_login authenticator failed for H=host-181-114-67-115.supernet.com.bo (static-200-58-83-79.supernet.com.bo) [181.114.67.115]:32904: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.101
country_id: 1880251
description:
Jan  7 02:07:25 host2 sshd[2382993]: Disconnected from invalid user claude 45.78.223.101 port 57434 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.70.26
country_id: 294640
description:
2026-01-07 02:07:48 dovecot_login authenticator failed for H=([2.55.70.26]) [2.55.70.26]:35888: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.51.22
country_id: 1880251
description:
Jan  7 02:08:26 host2 sshd[2383630]: Disconnected from invalid user track 101.47.51.22 port 43886 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.196
country_id: 6252001
description:
Jan  7 02:08:48 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.196, lip=66.85.158.92, session=<OX2tKb5HQdRBMQHE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.192
country_id: 6252001
description:
Jan  7 02:09:00 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=65.49.1.192, lip=66.85.158.92, TLS: Connection closed, session=<gt5XKr5HoI5BMQHA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.192
country_id: 6252001
description:
Jan  7 02:09:12 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=65.49.1.192, lip=66.85.158.92, session=<ansUK75H8IlBMQHA>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.51.22
country_id: 1880251
description:
Jan  7 02:10:06 host2 sshd[2385798]: Disconnected from invalid user julio 101.47.51.22 port 47438 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 161.118.238.65
country_id: 1880251
description:
Jan  7 02:19:30 host2 sshd[2395077]: Received disconnect from 161.118.238.65 port 51318:11: Bye Bye [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 02:20:49 host2 sshd[2396074]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 161.35.79.234
country_id: 2921044
description:
Jan  7 02:20:34 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=161.35.79.234, lip=66.85.158.91, session=<9IXCU75HvH6hI0/q>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 161.118.238.65
country_id: 1880251
description:
Jan  7 02:20:10 host2 sshd[2395755]: Received disconnect from 161.118.238.65 port 45072:11: Bye Bye [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.89.97.186
country_id: 2921044
description:
Jan  7 02:20:33 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=159.89.97.186, lip=66.85.158.91, session=<7xqmU75H3/mfWWG6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.241.123.140
country_id: 6252001
description:
2026-01-07 02:21:40 dovecot_login authenticator failed for H=(ADMIN) [151.241.123.140]:44076: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.20
country_id: 798549
description:
Jan  7 02:24:37 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=85.217.149.20, lip=66.85.158.92, TLS, session=<qNc6Yr5HPrZV2ZUU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.18
country_id: 1269750
description:
2026-01-07 02:29:32 dovecot_login authenticator failed for H=(dsl-ncr-dynamic-065.178.23.125.airtelbroadband.in) [182.78.64.18]:39634: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.201.237.208
country_id: 1269750
description:
2026-01-07 02:29:54 dovecot_login authenticator failed for H=(abts-west-static-208.237.201.106.airtelbroadband.in) [106.201.237.208]:33414: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.36.71
country_id: 6252001
description:
Jan  7 02:29:16 host2 sshd[2403940]: Disconnected from invalid user elly 165.154.36.71 port 52956 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.36.71
country_id: 6252001
description:
Jan  7 02:30:17 host2 sshd[2405205]: Disconnected from invalid user max 165.154.36.71 port 20766 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 139.99.133.77
country_id: 2077456
description:
Jan  7 02:33:56 host2 sshd[2408169]: Disconnected from invalid user adriano 139.99.133.77 port 41304 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 87.236.176.171
country_id: 2635167
description:
Jan  7 02:38:03 host2 pure-ftpd[2412247]: (?@87.236.176.171) [INFO] New connection from 87.236.176.171


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.248.45.124
country_id: 2921044
description:
Jan  7 02:37:10 host2 pure-ftpd[2411216]: (?@104.248.45.124) [INFO] New connection from 104.248.45.124


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.99.128.35
country_id: 2921044
description:
Jan  7 02:37:10 host2 pure-ftpd[2411224]: (?@167.99.128.35) [INFO] New connection from 167.99.128.35


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.8
country_id: 2186224
description:
2026-01-07 02:37:29 dovecot_login authenticator failed for H=([121.73.163.8]) [121.73.163.8]:45132: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.110.150
country_id: 660013
description:
2026-01-07 02:37:57 dovecot_login authenticator failed for H=([45.82.110.150]) [45.82.110.150]:58826: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-07 02:40:20 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (tescous) [87.103.126.54]:5051: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.193.43.167
country_id: 1819730
description:
Jan  7 02:41:58 host2 sshd[2416066]: Disconnected from invalid user ods 118.193.43.167 port 31636 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 02:43:03 host2 sshd[2417075]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.91.166.34
country_id: 1643084
description:
Jan  7 02:45:16 host2 sshd[2419444]: Disconnected from invalid user marina 36.91.166.34 port 42752 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.91.166.34
country_id: 1643084
description:
Jan  7 02:45:54 host2 sshd[2420347]: Disconnected from invalid user bogdan 36.91.166.34 port 54942 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.174.115.5
country_id: 1643084
description:
Jan  7 02:46:24 host2 sshd[2420805]: Disconnected from invalid user ods 103.174.115.5 port 42924 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.91.166.34
country_id: 1643084
description:
Jan  7 02:47:14 host2 sshd[2421397]: Disconnected from invalid user student3 36.91.166.34 port 51064 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.214.125.156
country_id: 1694008
description:
2026-01-07 02:47:21 dovecot_login authenticator failed for H=(ADMIN) [188.214.125.156]:56778: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.174.115.5
country_id: 1643084
description:
Jan  7 02:48:34 host2 sshd[2422245]: Disconnected from invalid user claude 103.174.115.5 port 42432 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.41
country_id: 3865483
description:
Jan  7 02:56:00 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=179.0.251.41, lip=66.85.158.91, TLS, session=<K3pT0b5HPIWzAPsp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.170.41
country_id: 3175395
description:
Jan  7 02:56:07 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<hr>, method=PLAIN, rip=185.15.170.41, lip=66.85.158.91, TLS, session=<SiXN0b5HgpC5D6op>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 159.255.144.35
country_id: 3175395
description:
Jan  7 02:55:47 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=159.255.144.35, lip=66.85.158.91, TLS, session=<qleg0L5HBZSf/5Aj>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 02:57:02 host2 sshd[2427270]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.6.200.52
country_id: 3469034
description:
Jan  7 02:56:22 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<hr>, method=PLAIN, rip=45.6.200.52, lip=66.85.158.91, TLS, session=<+TGe0r5Ho6UtBsg0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.24
country_id: 6252001
description:
Jan  7 02:58:28 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.24, lip=66.85.158.92, TLS handshaking: Connection closed, session=<dfBI275HFCBAPpwY>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.94.94.241
country_id: 286963
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 172.94.94.241 - env_eng@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2026-01-07 02:59:53 dovecot_plain authenticator failed for H=c-71-235-225-181.hsd1.ct.comcast.net (uncollebe) [71.235.225.181]:52782: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.122
country_id: 1269750
description:
2026-01-07 02:59:54 dovecot_login authenticator failed for H=([59.145.116.161]) [182.95.230.122]:39804: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.24.183.76
country_id: 6252001
description:
2026-01-07 03:00:09 dovecot_login authenticator failed for H=(173-24-183-76.client.mchsi.com) [173.24.183.76]:39148: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.20.97
country_id: 2750405
description:
2026-01-07 03:05:41 dovecot_login authenticator failed for H=(ADMIN) [158.173.20.97]:43225: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.54
country_id: 6252001
description:
Jan  7 03:06:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.54, lip=66.85.158.92, TLS: Connection closed, session=<tZd5+L5HxCinXpI2>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.189.71.205
country_id: 2802361
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 188.189.71.205 - - "POST /cpsess0130295740/3rdparty/roundcube/:2087/json-api/create_user_session HTTP/1.1" FAILED LOGIN webmaild: user name not provided or invalid user


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.129
country_id: 6252001
description:
Jan  7 03:11:10 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.129, lip=66.85.158.92, TLS: Connection closed, session=<Gs+wCL9HJNlChJmB>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 03:12:10 host2 sshd[2441179]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  7 03:12:08 host2 sshd[2441141]: Disconnected from invalid user user 2.57.121.25 port 7420 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.236
country_id: 6252001
description:
Jan  7 03:16:25 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.236, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<hqp/G79HoNTN0h/s>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 101.36.125.183
country_id: 1819730
description:
Jan  7 03:18:51 host2 pure-ftpd[2447456]: (?@101.36.125.183) [INFO] New connection from 101.36.125.183


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.53
country_id: 6252001
description:
Jan  7 03:22:26 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.53, lip=66.85.158.91, TLS: Connection closed, session=<D9gCMb9H3sunXpI1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-07 03:23:22 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (pheas) [87.103.126.54]:1072: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.59.242
country_id: 798544
description:
2026-01-07 03:24:42 dovecot_login authenticator failed for H=(ADMIN) [138.199.59.242]:53400: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 03:25:59 host2 sshd[2454247]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.247.23.131
country_id: 1269750
description:
Jan  7 03:25:13 host2 sshd[2453497]: Disconnected from invalid user sysadm 117.247.23.131 port 56112 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 117.247.23.131
country_id: 1269750
description:
Jan  7 03:26:27 host2 sshd[2454555]: Disconnected from invalid user servidor 117.247.23.131 port 57524 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.220.168
country_id: 337996
description:
2026-01-07 03:26:48 dovecot_login authenticator failed for H=([196.190.220.168]) [196.190.220.168]:39132: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.12
country_id: 1733045
description:
2026-01-07 03:27:17 dovecot_login authenticator failed for H=([49.124.152.12]) [49.124.152.12]:42314: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.117.97.0
country_id: 6252001
description:
Jan  7 03:30:37 host2 sshd[2458443]: Disconnected from invalid user financeiro 40.117.97.0 port 50982 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.156.34
country_id: 6252001
description:
Jan  7 03:31:41 host2 sshd[2459470]: Disconnected from invalid user user1 162.240.156.34 port 43954 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.240.156.34
country_id: 6252001
description:
Jan  7 03:33:34 host2 sshd[2461266]: Disconnected from invalid user spoj0 162.240.156.34 port 51702 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.156.34
country_id: 6252001
description:
Jan  7 03:34:39 host2 sshd[2462126]: Disconnected from invalid user geek 162.240.156.34 port 50562 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.106
country_id: 2635167
description:
Jan  7 03:35:41 host2 dovecot[1170291]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.106, lip=66.85.158.91, TLS, session=<5OJhYL9HLeG594lq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.117.97.0
country_id: 6252001
description:
Jan  7 03:36:29 host2 sshd[2463887]: Disconnected from invalid user claude 40.117.97.0 port 54702 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 57.128.237.234
country_id: 798544
description:
Jan  7 03:37:02 host2 sshd[2464516]: Disconnected from invalid user claude 57.128.237.234 port 44740 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.215.124
country_id: 732800
description:
Jan  7 03:37:15 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=185.255.215.124, lip=66.85.158.91, TLS, session=<FircZL9Hl8C5/9d8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.238.166.169
country_id: 798544
description:
Jan  7 03:37:32 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=91.238.166.169, lip=66.85.158.91, TLS, session=<jeMJZr9HGMZb7qap>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.117.97.0
country_id: 6252001
description:
Jan  7 03:37:35 host2 sshd[2467082]: Disconnected from invalid user user100 40.117.97.0 port 47244 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 03:38:53 host2 sshd[2478264]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-07 03:40:01 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:62685: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.231
country_id: 2635167
description:
Jan  7 03:42:58 host2 dovecot[1170291]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.231, lip=66.85.158.92, TLS, session=<pI1ser9HTaJX7LDn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.228.53.204
country_id: 6252001
description:
Jan  7 03:44:18 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=66.228.53.204, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<v6c0f79HsMxC5DXM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.228.53.4
country_id: 6252001
description:
Jan  7 03:44:18 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=66.228.53.4, lip=66.85.158.92, session=<q201f79HcmpC5DUE>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 161.118.238.65
country_id: 1880251
description:
Jan  7 03:45:52 host2 sshd[2485832]: Received disconnect from 161.118.238.65 port 46752:11: Bye Bye [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.216.172.131
country_id: 2658434
description:
Jan  7 03:45:45 host2 pure-ftpd[2485696]: (?@35.216.172.131) [INFO] New connection from 35.216.172.131


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 35.216.172.131
country_id: 2658434
description:
Jan  7 03:45:49 host2 pure-ftpd[2485781]: (?@35.216.172.131) [INFO] New connection from 35.216.172.131


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 161.118.238.65
country_id: 1880251
description:
Jan  7 03:46:26 host2 sshd[2487007]: Received disconnect from 161.118.238.65 port 32938:11: Bye Bye [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.74.22.253
country_id: 2017370
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 45.74.22.253 - washeera@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 03:48:02 host2 sshd[2487833]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 161.118.238.65
country_id: 1880251
description:
Jan  7 03:47:38 host2 sshd[2488707]: Received disconnect from 161.118.238.65 port 48344:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.243.64.226
country_id: 3686110
description:
Jan  7 03:48:28 host2 sshd[2489627]: Disconnected from invalid user tsbot 8.243.64.226 port 45896 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.242.217
country_id: 1269750
description:
Jan  7 03:48:40 host2 sshd[2489826]: Disconnected from invalid user bounce 143.110.242.217 port 35188 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.81.142.231
country_id: 3996063
description:
2026-01-07 03:49:44 dovecot_login authenticator failed for H=(ADMIN) [77.81.142.231]:54743: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.55.23
country_id: 1210997
description:
2026-01-07 03:51:59 dovecot_plain authenticator failed for H=(15WC133) [113.11.55.23]:59825: 535 Incorrect authentication data (set_id=charanaw@ksoft.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.114
country_id: 6252001
description:
Jan  7 03:52:45 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.114, lip=66.85.158.91, TLS: Connection closed, session=<WM1mnb9H/s5ChJly>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 8.243.64.226
country_id: 3686110
description:
Jan  7 03:53:25 host2 sshd[2494884]: Disconnected from invalid user vicente 8.243.64.226 port 48418 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.243.64.226
country_id: 3686110
description:
Jan  7 03:54:44 host2 sshd[2496791]: Disconnected from invalid user blog 8.243.64.226 port 49750 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 143.110.242.217
country_id: 1269750
description:
Jan  7 03:55:36 host2 sshd[2498023]: Disconnected from invalid user anil 143.110.242.217 port 52754 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 03:57:38 host2 sshd[2500405]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.242.226.33
country_id: 6252001
description:
Jan  7 03:58:04 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.242.226.33, lip=66.85.158.92, TLS, session=<+FBtsL9HiMe58uIh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.242.226.33
country_id: 6252001
description:
Jan  7 03:58:54 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.242.226.33, lip=66.85.158.91, TLS, session=<xbdms79H2N+58uIh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.24.121.125
country_id: 3175395
description:
2026-01-07 04:05:36 dovecot_plain authenticator failed for H=(cattel) [212.24.121.125]:36521: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.106.113
country_id: 1819730
description:
Jan  7 04:06:46 host2 sshd[2511608]: Disconnected from invalid user wildfly 101.36.106.113 port 34042 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.106.113
country_id: 1819730
description:
Jan  7 04:12:37 host2 sshd[2519068]: Disconnected from invalid user claude 101.36.106.113 port 38622 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.242.142
country_id: 1269750
description:
2026-01-07 04:14:26 dovecot_login authenticator failed for H=([125.19.172.137]) [182.78.242.142]:50730: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.103.27.217
country_id: 390903
description:
2026-01-07 04:14:49 dovecot_login authenticator failed for H=owniyj.static.otenet.gr (lime36.static.otenet.gr) [62.103.27.217]:8771: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.218
country_id: 337996
description:
2026-01-07 04:16:08 dovecot_login authenticator failed for H=([196.189.124.218]) [196.189.124.218]:44448: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.70.19.11
country_id: 3469034
description:
2026-01-07 04:15:33 dovecot_login authenticator failed for H=([45.70.19.11]) [45.70.19.11]:33718: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.25.33
country_id: 6252001
description:
2026-01-07 04:16:03 dovecot_login authenticator failed for H=(ADMIN) [158.173.25.33]:51936: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.183.0.24
country_id: 3996063
description:
Jan  7 04:19:06 host2 sshd[2525871]: Disconnected from invalid user admin 189.183.0.24 port 59748 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.245.201.162
country_id: 3686110
description:
Jan  7 04:20:22 host2 sshd[2527673]: Disconnected from invalid user hong 201.245.201.162 port 39655 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.245.201.162
country_id: 3686110
description:
Jan  7 04:21:10 host2 sshd[2528894]: Disconnected from invalid user claude 201.245.201.162 port 46608 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 04:24:06 host2 sshd[2531590]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.183.0.24
country_id: 3996063
description:
Jan  7 04:23:41 host2 sshd[2531309]: Disconnected from invalid user hong 189.183.0.24 port 33140 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.183.0.24
country_id: 3996063
description:
Jan  7 04:25:49 host2 sshd[2533572]: Disconnected from invalid user claude 189.183.0.24 port 41966 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.183.0.24
country_id: 3996063
description:
Jan  7 04:26:20 host2 sshd[2534389]: Disconnected from invalid user claude 189.183.0.24 port 48590 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.51
country_id: 6252001
description:
Jan  7 04:30:02 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.51, lip=66.85.158.91, TLS: Connection closed, session=<3CbCIsBHkuGnXpIz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.51
country_id: 6252001
description:
Jan  7 04:30:09 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low (no auth attempts in 0 secs): user=<>, rip=167.94.146.51, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<aGwoI8BHdOKnXpIz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.67.102
country_id: 6252001
description:
2026-01-07 04:38:09 dovecot_login authenticator failed for H=(ADMIN) [191.96.67.102]:3110: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.78.138.227
country_id: 2802361
description:
Jan  7 04:39:39 host2 pure-ftpd[2544080]: (?@34.78.138.227) [INFO] New connection from 34.78.138.227


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.248.243.181
country_id: 2542007
description:
2026-01-07 04:40:09 dovecot_plain authenticator failed for H=(prost) [41.248.243.181]:45188: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.195.241.97
country_id: 2802361
description:
Jan  7 04:43:28 host2 pure-ftpd[2547014]: (?@35.195.241.97) [INFO] New connection from 35.195.241.97


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.69.56.44
country_id: 1694008
description:
Jan  7 04:48:05 host2 sshd[2550878]: Disconnected from invalid user claude 58.69.56.44 port 36592 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.77.172.159
country_id: 3996063
description:
Jan  7 04:48:05 host2 sshd[2550902]: Disconnected from invalid user kontakt 200.77.172.159 port 41460 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 12.189.234.27
country_id: 6252001
description:
Jan  7 04:47:56 host2 sshd[2550760]: Disconnected from invalid user iksi 12.189.234.27 port 43587 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.77.172.159
country_id: 3996063
description:
Jan  7 04:49:08 host2 sshd[2551539]: Disconnected from invalid user mbp 200.77.172.159 port 36596 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.189.234.27
country_id: 6252001
description:
Jan  7 04:49:49 host2 sshd[2551816]: Disconnected from invalid user intern 12.189.234.27 port 38302 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.82
country_id: 1269750
description:
2026-01-07 04:50:07 dovecot_login authenticator failed for H=([128.185.144.1]) [182.95.226.82]:42124: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.94.66
country_id: 1269750
description:
2026-01-07 04:50:36 dovecot_login authenticator failed for H=([27.123.94.66]) [27.123.94.66]:46618: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.189.234.27
country_id: 6252001
description:
Jan  7 04:50:19 host2 sshd[2552362]: Disconnected from invalid user client 12.189.234.27 port 44041 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.69.56.44
country_id: 1694008
description:
Jan  7 04:50:26 host2 sshd[2552428]: Disconnected from invalid user sftpuser 58.69.56.44 port 54924 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 58.69.56.44
country_id: 1694008
description:
Jan  7 04:51:43 host2 sshd[2553190]: Disconnected from invalid user claude 58.69.56.44 port 49974 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.232
country_id: 6252001
description:
Jan  7 04:54:53 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.230.168.232, lip=66.85.158.91, session=<Ne6ae8BH+89b5qjo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.134
country_id: 6252001
description:
Jan  7 04:54:28 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.230.168.134, lip=66.85.158.91, session=<D3gfesBHm45b5qiG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.129
country_id: 6252001
description:
Jan  7 04:54:38 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.230.168.129, lip=66.85.158.91, session=<hka5esBHDZVb5qiB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.234
country_id: 6252001
description:
Jan  7 04:54:50 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=91.230.168.234, lip=66.85.158.91, session=<bglse8BHddhb5qjq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.51.166
country_id: 1269750
description:
2026-01-07 05:01:58 dovecot_login authenticator failed for H=([125.23.112.209]) [182.95.51.166]:53940: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.149
country_id: 3996063
description:
2026-01-07 05:02:33 dovecot_login authenticator failed for H=([177.236.146.149]) [177.236.146.149]:47699: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.43.109
country_id: 1819730
description:
2026-01-07 05:05:15 dovecot_login authenticator failed for H=109.43.246.220.static.netvigator.com [220.246.43.109]:60099: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.232.42
country_id: 2542007
description:
2026-01-07 05:05:20 dovecot_login authenticator failed for H=(ADMIN) [95.181.232.42]:5955: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.221.194
country_id: 3144096
description:
2026-01-07 05:04:56 dovecot_login authenticator failed for H=(cm-178.232.221.194.get.no) [178.232.221.194]:40976: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 05:06:19 host2 sshd[2562450]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  7 05:05:36 host2 sshd[2562064]: Disconnected from invalid user admin 2.57.121.112 port 22797 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2026-01-07 05:06:29 dovecot_login authenticator failed for H=([122.184.120.98]) [122.184.120.98]:39928: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
country_id: 1269750
description:
2026-01-07 05:07:58 dovecot_login authenticator failed for H=([128.185.12.179]) [128.185.12.179]:42692: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2026-01-07 05:08:02 dovecot_plain authenticator failed for H=c-98-204-134-124.hsd1.md.comcast.net (satong) [98.204.134.124]:36902: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.131.195
country_id: 1819730
description:
Jan  7 05:09:09 host2 sshd[2563418]: Disconnected from invalid user user 152.32.131.195 port 47160 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.131.195
country_id: 1819730
description:
Jan  7 05:08:33 host2 sshd[2563233]: Disconnected from invalid user miguel 152.32.131.195 port 33508 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.12.86.90
country_id: 1269750
description:
2026-01-07 05:08:39 dovecot_login authenticator failed for H=(mail.tataidc.com) [61.12.86.90]:48526: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.115.18.231
country_id: 2750405
description:
Jan  7 05:10:14 host2 sshd[2563952]: Disconnected from invalid user alex 40.115.18.231 port 35082 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.131.195
country_id: 1819730
description:
Jan  7 05:09:50 host2 sshd[2563581]: Disconnected from invalid user ftpuser 152.32.131.195 port 60824 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 05:12:30 host2 sshd[2565178]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 40.115.18.231
country_id: 2750405
description:
Jan  7 05:12:36 host2 sshd[2565342]: Disconnected from invalid user claude 40.115.18.231 port 33110 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 05:13:43 host2 sshd[2566127]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.210.95.88
country_id: 294640
description:
2026-01-07 05:15:02 dovecot_login authenticator failed for H=([46.210.95.88]) [46.210.95.88]:48161: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.243.68.66
country_id: 1861060
description:
2026-01-07 05:15:18 dovecot_login authenticator failed for H=66.68.243.35.bc.googleusercontent.com [35.243.68.66]:48906: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.124.174
country_id: 1269750
description:
2026-01-07 05:21:08 dovecot_login authenticator failed for H=([182.95.124.174]) [182.95.124.174]:38678: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.169.56.221
country_id: 1643084
description:
2026-01-07 05:21:19 dovecot_login authenticator failed for H=([202.169.56.221]) [202.169.56.221]:55225: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 05:25:20 host2 sshd[2571464]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.133.47.19
country_id: 1522867
description:
2026-01-07 05:28:15 dovecot_login authenticator failed for H=(ADMIN) [62.133.47.19]:43464: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 05:31:34 host2 sshd[2574900]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 168.194.154.167
country_id: 3469034
description:
Jan  7 05:35:56 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@jrdc.lk>, method=PLAIN, rip=168.194.154.167, lip=66.85.158.91, TLS, session=<sy1gDcFHk5mowpqn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.246.101
country_id: 1269750
description:
Jan  7 05:35:56 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@jrdc.lk>, method=PLAIN, rip=103.164.246.101, lip=66.85.158.91, TLS, session=<iOtiDcFHFOdnpPZl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.119.190
country_id: 226074
description:
Jan  7 05:35:58 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@jrdc.lk>, method=PLAIN, rip=196.0.119.190, lip=66.85.158.91, TLS, session=<mCtkDcFHnrLEAHe+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.173
country_id: 3865483
description:
Jan  7 05:36:20 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=179.0.250.173, lip=66.85.158.91, TLS, session=<cm2pDsFHb42zAPqt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.172
country_id: 3175395
description:
Jan  7 05:35:54 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@jrdc.lk>, method=PLAIN, rip=185.15.171.172, lip=66.85.158.91, TLS, session=<q2hTDcFHd9O5D6us>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.246.226
country_id: 1269750
description:
Jan  7 05:35:57 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@jrdc.lk>, method=PLAIN, rip=103.164.246.226, lip=66.85.158.91, TLS, session=<3j5fDcFHQJFnpPbi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.63.133.74
country_id: 3175395
description:
Jan  7 05:36:13 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.63.133.74, lip=66.85.158.91, TLS, session=<eQlsDsFHE965P4VK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 213.92.222.43
country_id: 798544
description:
Jan  7 05:36:14 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=213.92.222.43, lip=66.85.158.91, TLS, session=<xNZ/DsFHzg3VXN4r>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.130
country_id: 3865483
description:
Jan  7 05:36:20 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=179.0.251.130, lip=66.85.158.91, TLS, session=<SIefDsFHT6uzAPuC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.92
country_id: 3175395
description:
Jan  7 05:36:24 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.15.171.92, lip=66.85.158.91, TLS, session=<bO4cD8FHEaC5D6tc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.177.76.126
country_id: 357994
description:
2026-01-07 05:36:26 dovecot_plain authenticator failed for H=(ZZ7H17CIG) [154.177.76.126]:18810: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 138.68.105.139
country_id: 2921044
description:
Jan  7 05:37:01 host2 pure-ftpd[2578812]: (?@138.68.105.139) [INFO] New connection from 138.68.105.139


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 138.68.105.139
country_id: 2921044
description:
Jan  7 05:37:02 host2 pure-ftpd[2578889]: (?@138.68.105.139) [INFO] New connection from 138.68.105.139


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.131.159
country_id: 6252001
description:
Jan  7 05:47:06 host2 sshd[2589650]: Invalid user cloudtourssrilan_travel from 124.198.131.159 port 52058


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.103.231.213
country_id: 1168579
description:
2026-01-07 05:47:33 dovecot_plain authenticator failed for H=(P756S1ACH72QLPV) [59.103.231.213]:52872: 535 Incorrect authentication data (set_id=lasithar@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.119.50
country_id: 1819730
description:
Jan  7 05:49:22 host2 sshd[2591467]: Disconnected from invalid user support 101.36.119.50 port 57286 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.249.18.109
country_id: 3017382
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 173.249.18.109 - lezzarotech "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.72.76.123
country_id: 3469034
description:
Jan  7 05:51:44 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=177.72.76.123, lip=66.85.158.91, TLS, session=<Zh3fRcFHIMmxSEx7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.157.28
country_id: 2921044
description:
2026-01-07 05:51:56 dovecot_login authenticator failed for H=(ADMIN) [191.101.157.28]:1350: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.115
country_id: 3865483
description:
Jan  7 05:52:10 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=179.0.251.115, lip=66.85.158.91, TLS, session=<KN8rR8FH0JCzAPtz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.14.96.56
country_id: 2510769
description:
Jan  7 05:54:30 host2 sshd[2596658]: Disconnected from invalid user claude 62.14.96.56 port 54820 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.119.50
country_id: 1819730
description:
Jan  7 05:56:00 host2 sshd[2598156]: Disconnected from invalid user ali 101.36.119.50 port 39000 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2026-01-07 05:56:04 dovecot_plain authenticator failed for H=c-24-127-53-61.hsd1.mi.comcast.net (tabled) [24.127.53.61]:44024: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.189.235.93
country_id: 1643084
description:
Jan  7 05:55:31 host2 sshd[2597667]: Disconnected from invalid user temp 103.189.235.93 port 58842 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.155.194.190
country_id: 953987
description:
2026-01-07 05:55:57 dovecot_plain authenticator failed for H=156-155-194-190.ip.internet.co.za (1J0G627F) [156.155.194.190]:65418: 535 Incorrect authentication data (set_id=lasithar@ksoft.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.14.96.56
country_id: 2510769
description:
Jan  7 05:57:06 host2 sshd[2599120]: Disconnected from invalid user dana 62.14.96.56 port 48220 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.119.50
country_id: 1819730
description:
Jan  7 05:56:28 host2 sshd[2598656]: Disconnected from invalid user jimmy 101.36.119.50 port 58700 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.112.109.248
country_id: 6252001
description:
2026-01-07 05:57:35 dovecot_login authenticator failed for H=(host-24-112-109-248.vyvebroadband.net) [24.112.109.248]:52318: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.165.219
country_id: 1605651
description:
2026-01-07 05:57:23 dovecot_login authenticator failed for H=([106.0.165.219]) [106.0.165.219]:44827: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.146.144
country_id: 1819730
description:
2026-01-07 06:08:34 dovecot_login authenticator failed for H=(m121-202-146-144.smartone.com) [121.202.146.144]:51568: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.218.2
country_id: 1269750
description:
2026-01-07 06:09:02 dovecot_login authenticator failed for H=([61.246.205.1]) [125.19.218.2]:55074: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.22.95.67
country_id: 6251999
description:
2026-01-07 06:19:32 dovecot_login authenticator failed for H=(ADMIN) [149.22.95.67]:34235: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2026-01-07 06:23:37 dovecot_plain authenticator failed for H=c-24-15-216-41.hsd1.il.comcast.net (unated) [24.15.216.41]:45426: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.64.71.37
country_id: 3865483
description:
Jan  7 06:27:04 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=186.64.71.37, lip=66.85.158.91, TLS, session=<U+cNxMFHnJG6QEcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.25.7
country_id: 798544
description:
Jan  7 06:27:22 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=178.216.25.7, lip=66.85.158.91, TLS, session=<EF9cxcFHv4Oy2BkH>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 06:31:20 host2 sshd[2641387]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.213.34.110
country_id: 298795
description:
2026-01-07 06:41:26 dovecot_login authenticator failed for H=(ADMIN) [188.213.34.110]:9706: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 06:46:34 host2 sshd[2664915]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2026-01-07 06:47:23 dovecot_plain authenticator failed for H=c-73-183-74-177.hsd1.pa.comcast.net (sigic) [73.183.74.177]:33182: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.105.235.55
country_id: 3017382
description:
[2026-01-07 06:50:20 +0530] info [cpaneld] 46.105.235.55 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-07 06:53:45 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:62057: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  7 06:54:26 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: Connection closed, session=<vIskJ8JHELYDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  7 06:56:55 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<Ab0PMMJHousDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  7 06:57:28 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<Ur8JMsJHQrUDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  7 06:58:20 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=</qggNcJHCuUDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.104.30.66
country_id: 6252001
description:
Jan  7 06:58:52 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.104.30.66, lip=66.85.158.91, TLS handshaking: Connection closed, session=<22j/NsJH3tesaB5C>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  7 06:59:25 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: Connection closed, session=<OmL5OMJHiLIDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.94.82
country_id: 2623032
description:
2026-01-07 07:00:55 dovecot_login authenticator failed for H=(ADMIN) [188.126.94.82]:5288: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  7 07:01:02 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<hJq/PsJHZroDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  7 07:01:18 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: Connection closed, session=<of+4P8JH2rYDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.183.245.232
country_id: 1605651
description:
2026-01-07 07:02:48 dovecot_login authenticator failed for H=(mx-ll-180.183.245-232.dynamic.3bb.in.th) [180.183.245.232]:41402: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.113.185.14
country_id: 3469034
description:
2026-01-07 07:03:42 dovecot_login authenticator failed for H=([189.113.185.14]) [189.113.185.14]:36316: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.161.196.5
country_id: 99237
description:
2026-01-07 07:03:17 dovecot_login authenticator failed for H=([46.161.196.5]) [46.161.196.5]:53140: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.210.175
country_id: 2077456
description:
2026-01-07 07:23:40 dovecot_login authenticator failed for H=(ADMIN) [191.101.210.175]:40387: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.249.126
country_id: 3865483
description:
Jan  7 07:24:51 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 26 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=179.0.249.126, lip=66.85.158.91, TLS, session=<5fxhksJHla2zAPl+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.72.78.204
country_id: 3469034
description:
Jan  7 07:25:10 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=177.72.78.204, lip=66.85.158.91, TLS, session=<Vr8BlMJHr4SxSE7M>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.178.115.138
country_id: 6252001
description:
Jan  7 07:28:47 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.178.115.138, lip=66.85.158.92, session=<VTkGosJHEKussnOK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.174
country_id: 6252001
description:
Jan  7 07:30:53 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.174, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<vC6GqcJH6MnN0h+u>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.136
country_id: 6252001
description:
Jan  7 07:33:11 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.136, lip=66.85.158.91, session=<TZXEscJHubRAPsWI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.122
country_id: 6252001
description:
Jan  7 07:33:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.122, lip=66.85.158.91, TLS: Connection closed, session=<Z65wssJHZntAPsV6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.96.62.29
country_id: 1269750
description:
2026-01-07 07:36:17 dovecot_login authenticator failed for H=([59.96.62.29]) [59.96.62.29]:46806: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.37.223.58
country_id: 3175395
description:
2026-01-07 07:36:34 dovecot_login authenticator failed for H=net-2-37-223-58.cust.vodafonedsl.it [2.37.223.58]:60166: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2026-01-07 07:40:31 dovecot_plain authenticator failed for H=c-73-197-194-98.hsd1.nj.comcast.net (waysited) [73.197.194.98]:47022: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.126.119
country_id: 3703430
description:
2026-01-07 07:41:43 dovecot_login authenticator failed for H=(ADMIN) [91.90.126.119]:65258: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  7 07:45:10 host2 sshd[2731952]: Disconnected from invalid user admin 2.57.121.112 port 50958 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.248.111.238
country_id: 6252001
description:
2026-01-07 07:46:30 dovecot_plain authenticator failed for H=(gatte) [38.248.111.238]:52795: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.58
country_id: 6252001
description:
Jan  7 07:50:02 host2 pure-ftpd[2738406]: (?@147.185.132.58) [INFO] New connection from 147.185.132.58


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.105.230
country_id: 6252001
description:
Jan  7 07:51:04 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.64.105.230, lip=66.85.158.91, session=<t42u8cJHVogUQGnm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.109.56.73
country_id: 6252001
description:
2026-01-07 07:55:52 dovecot_login authenticator failed for H=(dfw-206-109-56-73.ip4.99.network) [206.109.56.73]:62424: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.144.20
country_id: 3996063
description:
2026-01-07 07:55:41 dovecot_login authenticator failed for H=([177.236.144.20]) [177.236.144.20]:37189: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.68
country_id: 2635167
description:
Jan  7 07:56:22 host2 dovecot[1170291]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.68, lip=66.85.158.92, TLS, session=<VmejBMNHLbhX7LBE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.232.250
country_id: 6252001
description:
2026-01-07 08:01:30 dovecot_login authenticator failed for H=(ADMIN) [102.129.232.250]:33704: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.180.145.27
country_id: 3469034
description:
Jan  7 08:02:29 host2 sshd[2751669]: Disconnected from invalid user claude 45.180.145.27 port 49002 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.180.145.27
country_id: 3469034
description:
Jan  7 08:03:17 host2 sshd[2752459]: Disconnected from invalid user claude 45.180.145.27 port 41084 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 59.97.205.137
country_id: 1269750
description:
Jan  7 08:06:02 host2 sshd[2755502]: Disconnected from invalid user zwj 59.97.205.137 port 32865 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.126
country_id: 6252001
description:
Jan  7 08:05:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.126, lip=66.85.158.91, TLS handshaking: Connection closed, session=<neDgJMNHrklChJl+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 59.97.205.137
country_id: 1269750
description:
Jan  7 08:06:38 host2 sshd[2756039]: Disconnected from invalid user hassan 59.97.205.137 port 50217 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 59.97.205.137
country_id: 1269750
description:
Jan  7 08:07:54 host2 sshd[2757240]: Disconnected from invalid user devuser 59.97.205.137 port 7805 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.159
country_id: 6252001
description:
Jan  7 08:09:01 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.132.159, lip=66.85.158.91, TLS, session=<MWLgMcNH1PGTuYSf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 143.58.211.64
country_id: 2635167
description:
Jan  7 08:11:33 host2 sshd[2761122]: Disconnected from invalid user claude 143.58.211.64 port 42024 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.255.147.244
country_id: 1269750
description:
Jan  7 08:11:50 host2 sshd[2761385]: Disconnected from invalid user k8s 103.255.147.244 port 59042 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 143.58.211.64
country_id: 2635167
description:
Jan  7 08:12:02 host2 sshd[2761557]: Received disconnect from 143.58.211.64 port 57456:11: Bye Bye [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.238.191.229
country_id: 6252001
description:
Jan  7 08:14:42 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.238.191.229, lip=66.85.158.91, TLS, session=<zRs3RsNHloQD7r/l>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.133.156.8
country_id: 1643084
description:
Jan  7 08:15:19 host2 sshd[2765788]: Disconnected from invalid user ftpuser 43.133.156.8 port 33758 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.46.50.43
country_id: 290557
description:
Jan  7 08:16:38 host2 sshd[2767233]: Disconnected from invalid user claude 20.46.50.43 port 48442 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.111.59
country_id: 2921044
description:
Jan  7 08:18:02 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=157.230.111.59, lip=66.85.158.91, TLS, session=<X28eUsNH9BOd5m87>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.133.156.8
country_id: 1643084
description:
Jan  7 08:17:41 host2 sshd[2768655]: Disconnected from invalid user ftp_user 43.133.156.8 port 39448 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.133.156.8
country_id: 1643084
description:
Jan  7 08:18:13 host2 sshd[2769350]: Disconnected from invalid user u 43.133.156.8 port 59980 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.124.202
country_id: 1269750
description:
2026-01-07 08:18:42 dovecot_login authenticator failed for H=([182.95.124.202]) [182.95.124.202]:33408: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.107.116.210
country_id: 798544
description:
2026-01-07 08:19:02 dovecot_login authenticator failed for H=(host-176.107.116-210.dynamic.mm.pl) [176.107.116.210]:35695: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.255.147.244
country_id: 1269750
description:
Jan  7 08:19:08 host2 sshd[2770527]: Disconnected from invalid user testtest 103.255.147.244 port 48784 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.46.50.43
country_id: 290557
description:
Jan  7 08:20:20 host2 sshd[2772224]: Disconnected from invalid user deployer 20.46.50.43 port 38436 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.46.50.43
country_id: 290557
description:
Jan  7 08:21:41 host2 sshd[2773795]: Disconnected from invalid user testtest 20.46.50.43 port 43002 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.154
country_id: 3144096
description:
2026-01-07 08:21:55 dovecot_login authenticator failed for H=(cm-84.213.189.154.get.no) [84.213.189.154]:60335: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.95.24.117
country_id: 2464461
description:
2026-01-07 08:21:32 dovecot_login authenticator failed for H=([193.95.21.147]) [193.95.24.117]:57304: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 08:23:44 host2 sshd[2776889]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2026-01-07 08:27:52 dovecot_login authenticator failed for H=([62.220.236.203]) [62.220.236.203]:33402: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2026-01-07 08:28:20 dovecot_login authenticator failed for H=([154.146.240.123]) [154.146.240.123]:58266: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.59.208
country_id: 798544
description:
2026-01-07 08:29:23 dovecot_login authenticator failed for H=(ADMIN) [138.199.59.208]:17956: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.82.40.34
country_id: 1694008
description:
2026-01-07 08:31:27 dovecot_login authenticator failed for H=([203.82.40.34]) [203.82.40.34]:47844: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.109.38.143
country_id: 6252001
description:
2026-01-07 08:31:40 dovecot_login authenticator failed for H=143.38.109.208.host.secureserver.net [208.109.38.143]:33488: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  7 08:35:15 host2 sshd[2791059]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.240.75
country_id: 2661886
description:
2026-01-07 08:42:04 dovecot_login authenticator failed for H=([188.126.240.75]) [188.126.240.75]:42974: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2026-01-07 08:41:53 dovecot_plain authenticator failed for H=(aurable) [91.73.195.150]:49158: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-01-07 08:41:57 dovecot_plain authenticator failed for H=(tarcingal) [102.53.15.17]:36082: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.249
country_id: 1168579
description:
2026-01-07 08:42:23 dovecot_login authenticator failed for H=(249.92.zcomnetworks.com.pk) [103.148.92.249]:45219: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 181.214.206.45
country_id: 2750405
description:
Jan  7 08:45:59 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=181.214.206.45, lip=66.85.158.91, session=<G34etsNHuNe11s4t>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.132.194.21
country_id: 597427
description:
Jan  7 08:45:59 host2 dovecot[1170291]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=45.132.194.21, lip=66.85.158.91, session=<L1wbtsNHxtcthMIV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.70
country_id: 6252001
description:
Jan  7 08:46:02 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.70, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<i+JCtsNH/NXG6xhG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  7 08:46:19 host2 sshd[2804083]: Disconnected from invalid user user 2.57.121.25 port 30542 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.232.223.113
country_id: 798544
description:
Jan  7 08:52:32 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=94.232.223.113, lip=66.85.158.91, TLS, session=<8DV/zMNHHule6N9x>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.238.119
country_id: 6252001
description:
2026-01-07 08:52:55 dovecot_login authenticator failed for H=(ADMIN) [95.181.238.119]:31644: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.90
country_id: 3865483
description:
Jan  7 08:52:14 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=179.0.250.90, lip=66.85.158.91, TLS, session=<lY5Gy8NH05azAPpa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.188.252.208
country_id: 6252001
description:
2026-01-07 08:55:25 dovecot_plain authenticator failed for H=c-73-188-252-208.hsd1.pa.comcast.net (rasth) [73.188.252.208]:54116: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2026-01-07 09:02:15 dovecot_plain authenticator failed for H=c-73-196-144-25.hsd1.nj.comcast.net (lousots) [73.196.144.25]:54232: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.201.62
country_id: 1269750
description:
2026-01-07 09:05:00 dovecot_login authenticator failed for H=([125.22.73.41]) [122.186.201.62]:44128: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.45.132.96
country_id: 3175395
description:
2026-01-07 09:05:17 dovecot_login authenticator failed for H=([151.45.132.96]) [151.45.132.96]:38780: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.111.6.121
country_id: 1269750
description:
2026-01-07 09:08:17 dovecot_login authenticator failed for H=([103.111.6.121]) [103.111.6.121]:34713: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.145.122.196
country_id: 3175395
description:
2026-01-07 09:08:36 dovecot_login authenticator failed for H=([82.145.122.196]) [82.145.122.196]:53282: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.73.108
country_id: 294640
description:
2026-01-07 09:10:50 dovecot_login authenticator failed for H=(2-55-73-108.orange.net.il) [2.55.73.108]:42144: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2026-01-07 09:10:21 dovecot_login authenticator failed for H=([83.136.176.12]) [83.136.176.12]:52769: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.64.16
country_id: 1269750
description:
Jan  7 09:10:36 host2 sshd[2831015]: Disconnected from invalid user claude 139.59.64.16 port 59908 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.136.207.202
country_id: 1605651
description:
2026-01-07 09:11:33 dovecot_login authenticator failed for H=([58.136.207.202]) [58.136.207.202]:44975: 535 Incorrect authentication data (set_id=smtp.zoho.com587hr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 114.10.47.6
country_id: 1643084
description:
Jan  7 09:14:09 host2 sshd[2834328]: Disconnected from invalid user ubuntu 114.10.47.6 port 10767 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.182
country_id: 1880251
description:
Jan  7 09:14:58 host2 sshd[2835046]: Disconnected from invalid user wilson 45.78.201.182 port 59754 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.133.172.6
country_id: 2635167
description:
2026-01-07 09:13:41 dovecot_login authenticator failed for H=(ADMIN) [45.133.172.6]:16171: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.83.145.39
country_id: 6252001
description:
Jan  7 09:16:50 host2 dovecot[1170291]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.83.145.39, lip=66.85.158.92, session=</epsJMRHerQDU5En>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.120
country_id: 2635167
description:
Jan  7 09:17:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 10 secs): user=<>, rip=35.203.211.120, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<+2VjJsRHjM8jy9N4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 114.10.47.6
country_id: 1643084
description:
Jan  7 09:17:39 host2 sshd[2837746]: Disconnected from invalid user claude 114.10.47.6 port 56613 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.201.182
country_id: 1880251
description:
Jan  7 09:17:11 host2 sshd[2837269]: Disconnected from invalid user claude 45.78.201.182 port 35140 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.64.16
country_id: 1269750
description:
Jan  7 09:17:14 host2 sshd[2837305]: Disconnected from invalid user servidor 139.59.64.16 port 35206 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.92.199.36
country_id: 732800
description:
Jan  7 09:17:25 host2 sshd[2837516]: Disconnected from invalid user claude 91.92.199.36 port 41334 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.120
country_id: 2635167
description:
Jan  7 09:18:23 host2 dovecot[1170291]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 8 secs): user=<>, rip=35.203.211.120, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<avXxKcRHtvAjy9N4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.8.201
country_id: 3175395
description:
Jan  7 09:18:38 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=185.197.8.201, lip=66.85.158.91, TLS, session=<leXkKcRHPoy5xQjJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.43.231.80
country_id: 798544
description:
Jan  7 09:18:56 host2 dovecot[1170291]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=193.43.231.80, lip=66.85.158.91, TLS, session=<0NLuKsRHXsfBK+dQ>


