# incident

plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.237.94.18
country_id: 6252001
description:
Jan  1 21:34:22 host2 sshd[3289338]: Disconnected from invalid user anonymous 35.237.94.18 port 38112 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 21:34:41 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<JDL5v1VHqMYv/AU1>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.237.94.18
country_id: 6252001
description:
Jan  1 21:35:02 host2 sshd[3289971]: Disconnected from invalid user op 35.237.94.18 port 51950 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.191.212.112
country_id: 337996
description:
Jan  1 21:35:46 host2 sshd[3290771]: Disconnected from invalid user ftpuser 196.191.212.112 port 17374 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.28.242.198
country_id: 2361809
description:
Jan  1 21:35:34 host2 sshd[3290637]: Disconnected from invalid user felipe 196.28.242.198 port 59788 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.237.94.18
country_id: 6252001
description:
Jan  1 21:35:44 host2 sshd[3290764]: Disconnected from invalid user ubuntu 35.237.94.18 port 37502 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.28.242.198
country_id: 2361809
description:
Jan  1 21:36:53 host2 sshd[3291864]: Disconnected from invalid user www 196.28.242.198 port 58606 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  1 21:37:04 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 8 secs): user=<sales@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<QN0uyFVHEp+eRdGr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.191.212.112
country_id: 337996
description:
Jan  1 21:37:52 host2 sshd[3292772]: Disconnected from invalid user sander 196.191.212.112 port 1167 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.208.24.217
country_id: 6252001
description:
Jan  1 21:38:20 host2 sshd[3293183]: Disconnected from invalid user olivier 172.208.24.217 port 32296 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.191.212.112
country_id: 337996
description:
Jan  1 21:38:30 host2 sshd[3293319]: Disconnected from invalid user deploy 196.191.212.112 port 17414 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  1 21:39:32 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<z8Jb0VVHHOwyBsPO>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.219.237.115
country_id: 6252001
description:
Jan  1 21:41:49 host2 pure-ftpd[3296700]: (?@104.219.237.115) [INFO] New connection from 104.219.237.115


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  1 21:42:53 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<phhD3VVHBAB100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  1 21:46:57 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<z8DN61VH7pVnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  1 21:49:55 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<OwWB9lVHfOai8GQy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  1 21:52:08 host2 sshd[3305901]: Disconnected from invalid user admin 2.57.121.112 port 34299 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  1 21:52:20 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<bhgU/1VH/RVniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 21:54:35 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<Q+kvB1ZHALQjupN+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 176.125.229.142
country_id: 3194884
description:
Jan  1 21:55:57 host2 pure-ftpd[3310004]: (?@176.125.229.142) [INFO] New connection from 176.125.229.142


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 173.244.49.49
country_id: 1668284
description:
Jan  1 21:55:57 host2 pure-ftpd[3310015]: (?@173.244.49.49) [INFO] New connection from 173.244.49.49


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.90.124.135
country_id: 3042225
description:
Jan  1 21:56:00 host2 dovecot[3122720]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=91.90.124.135, lip=66.85.158.91, session=<8HJhDFZHxtNbWnyH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.239.205.23
country_id: 3595528
description:
Jan  1 21:56:00 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=173.239.205.23, lip=66.85.158.91, TLS, session=<zWxjDFZHXpKt780X>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.80.150.222
country_id: 3190538
description:
Jan  1 21:56:00 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.80.150.222, lip=66.85.158.91, session=<4D1kDFZH7onDUJbe>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.34.242.250
country_id: 2963597
description:
Jan  1 21:56:00 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=149.34.242.250, lip=66.85.158.91, TLS, session=<Qh5kDFZHjLmVIvL6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.253.160.157
country_id: 174982
description:
Jan  1 21:56:00 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=185.253.160.157, lip=66.85.158.91, TLS handshaking: Connection closed, session=<1OJjDFZHGNG5/aCd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.213.175.140
country_id: 2510769
description:
Jan  1 21:55:39 host2 sshd[3309736]: Disconnected from invalid user db2admin 185.213.175.140 port 1688 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 21:56:18 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<zilSDVZHjogv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.213.175.140
country_id: 2510769
description:
Jan  1 21:56:51 host2 sshd[3311028]: Disconnected from invalid user tanvir 185.213.175.140 port 31596 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.213.175.140
country_id: 2510769
description:
Jan  1 21:57:21 host2 sshd[3311470]: Disconnected from invalid user bitrix 185.213.175.140 port 43488 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 22:00:13 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<JhZIG1ZH6q4zTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  1 22:00:26 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<OYzsG1ZHcNWeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  1 22:00:41 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<7Wn1HFZHaNxn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Jan  1 22:01:27 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<Zbm8H1ZHFMiYNcU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.188
country_id: 6252001
description:
Jan  1 22:01:47 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=65.49.1.188, lip=66.85.158.91, session=<QJEFIVZHKXVBMQG8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.182
country_id: 6252001
description:
Jan  1 22:01:58 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.182, lip=66.85.158.91, TLS: Connection closed, session=<Z7+3IVZHjldBMQG2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 22:03:55 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<brmPKFZH3tCeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  1 22:06:04 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<K7gSMFZHLg9o7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 22:05:22 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<zMPDLVZHRNIzTcpt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2026-01-01 22:06:24 dovecot_plain authenticator failed for H=c-73-197-236-163.hsd1.nj.comcast.net (helromult) [73.197.236.163]:33320: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  1 22:11:24 host2 sshd[3325300]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.187.58.165
country_id: 1269750
description:
2026-01-01 22:10:08 dovecot_plain authenticator failed for H=(P756S1ACH72QLPV) [115.187.58.165]:60451: 535 Incorrect authentication data (set_id=kasunp@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 22:10:19 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<UTJsP1ZHroYjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 59.98.83.57
country_id: 1269750
description:
Jan  1 22:12:07 host2 sshd[3325986]: Disconnected from invalid user postgres 59.98.83.57 port 44030 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 130.131.161.17
country_id: 6252001
description:
Jan  1 22:14:10 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=130.131.161.17, lip=66.85.158.91, TLS, session=<JzhZTVZHLqqCg6ER>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 59.98.83.57
country_id: 1269750
description:
Jan  1 22:14:16 host2 sshd[3329345]: Disconnected from invalid user odoo 59.98.83.57 port 43950 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  1 22:14:27 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<qQMwTlZHhF2i8Jp9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.76.120.30
country_id: 3469034
description:
Jan  1 22:15:06 host2 sshd[3332361]: Disconnected from invalid user userlog 201.76.120.30 port 34740 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  1 22:16:51 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<QhbDVlZHoItCdMzo>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.28.57.98
country_id: 1643084
description:
Jan  1 22:17:04 host2 sshd[3340487]: Disconnected from invalid user userlog 103.28.57.98 port 25089 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.28.57.98
country_id: 1643084
description:
Jan  1 22:16:21 host2 sshd[3336700]: Disconnected from invalid user test2 103.28.57.98 port 18185 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.76.120.30
country_id: 3469034
description:
Jan  1 22:16:38 host2 sshd[3337761]: Disconnected from invalid user postgres 201.76.120.30 port 34414 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.76.120.30
country_id: 3469034
description:
Jan  1 22:17:20 host2 sshd[3341993]: Disconnected from invalid user test 201.76.120.30 port 48364 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 158.69.223.34
country_id: 6251999
description:
Jan  1 22:17:21 host2 sshd[3342183]: Received disconnect from 158.69.223.34 port 32826:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.28.57.98
country_id: 1643084
description:
Jan  1 22:17:43 host2 sshd[3343203]: Disconnected from invalid user admin 103.28.57.98 port 31988 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 86.54.42.188
country_id: 241170
description:
Jan  1 22:17:51 host2 sshd[3343613]: Disconnected from invalid user admin 86.54.42.188 port 41846 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  1 22:18:53 host2 pure-ftpd[3344697]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.28.57.98
country_id: 1643084
description:
Jan  1 22:18:24 host2 sshd[3344234]: Disconnected from invalid user ansible 103.28.57.98 port 38889 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.223.34
country_id: 6251999
description:
Jan  1 22:18:40 host2 sshd[3344486]: Disconnected from invalid user milan 158.69.223.34 port 51574 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.223.34
country_id: 6251999
description:
Jan  1 22:19:20 host2 sshd[3345082]: Disconnected from invalid user roota 158.69.223.34 port 55474 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.76.120.30
country_id: 3469034
description:
Jan  1 22:21:08 host2 sshd[3346910]: Disconnected from invalid user frappe 201.76.120.30 port 33426 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 158.69.223.34
country_id: 6251999
description:
Jan  1 22:20:23 host2 sshd[3346265]: Disconnected from invalid user ubuntu 158.69.223.34 port 53786 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 86.54.42.188
country_id: 241170
description:
Jan  1 22:20:48 host2 sshd[3346634]: Disconnected from invalid user root2 86.54.42.188 port 57290 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 22:22:10 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<OdrTaVZHWsieRdY+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.248.139
country_id: 1880251
description:
Jan  1 22:21:17 host2 sshd[3347067]: Disconnected from invalid user ansible 188.166.248.139 port 35272 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 86.54.42.188
country_id: 241170
description:
Jan  1 22:21:46 host2 sshd[3347500]: Received disconnect from 86.54.42.188 port 49806:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 86.54.42.188
country_id: 241170
description:
Jan  1 22:21:46 host2 sshd[3347500]: Disconnected from invalid user testftp 86.54.42.188 port 49806 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.76.120.30
country_id: 3469034
description:
Jan  1 22:21:55 host2 sshd[3347666]: Disconnected from invalid user admin 201.76.120.30 port 47382 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.248.139
country_id: 1880251
description:
Jan  1 22:22:40 host2 sshd[3348413]: Disconnected from invalid user frappe 188.166.248.139 port 52548 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  1 22:23:50 host2 sshd[3349750]: Disconnected from invalid user admin 2.57.121.112 port 57201 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.248.139
country_id: 1880251
description:
Jan  1 22:24:50 host2 sshd[3350655]: Disconnected from invalid user sammy 188.166.248.139 port 49672 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 59.98.83.57
country_id: 1269750
description:
Jan  1 22:26:26 host2 sshd[3352193]: Disconnected from invalid user admin 59.98.83.57 port 53902 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 188.166.248.139
country_id: 1880251
description:
Jan  1 22:26:28 host2 sshd[3352272]: Disconnected from invalid user admin 188.166.248.139 port 39458 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  1 22:29:05 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<AFuUglZHMOUFhXlo>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 216.218.206.69
country_id: 6252001
description:
Jan  1 22:31:02 host2 pure-ftpd[3356570]: (?@216.218.206.69) [INFO] New connection from 216.218.206.69


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  1 22:31:00 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: Connection closed, session=<onaLiVZHfowDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  1 22:31:21 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: Connection closed, session=<WkPOilZHnOYDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  1 22:32:13 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<ANPpjVZHnpMDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.157.109.95
country_id: 453733
description:
Jan  1 22:33:45 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=185.157.109.95, lip=66.85.158.91, TLS, session=<DSpdklZH8L+5nW1f>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.207.35.196
country_id: 6290252
description:
Jan  1 22:34:03 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<charanaw>, method=PLAIN, rip=109.207.35.196, lip=66.85.158.91, TLS, session=<VxB0k1ZH+phtzyPE>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.38.106.200
country_id: 2802361
description:
Jan  1 22:34:14 host2 pure-ftpd[3359586]: (?@34.38.106.200) [INFO] New connection from 34.38.106.200


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  1 22:34:45 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<7Or5llZHUOwDhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.4.10.9
country_id: 3469034
description:
Jan  1 22:35:46 host2 sshd[3360930]: Disconnected from invalid user pokemon 189.4.10.9 port 44848 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  1 22:37:02 host2 dovecot[3122720]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<y4oXn1ZHDpgDhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.166.242.149
country_id: 6252001
description:
Jan  1 22:36:13 host2 sshd[3361345]: Disconnected from invalid user test01 43.166.242.149 port 40766 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  1 22:37:10 host2 dovecot[3122720]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<XtaTn1ZH7JEDhBfJ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.166.242.149
country_id: 6252001
description:
Jan  1 22:39:05 host2 sshd[3363807]: Disconnected from invalid user frappe 43.166.242.149 port 50160 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  1 22:39:09 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: Connection closed, session=<n4i1plZHHLADhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 22:39:13 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<61PPplZHPOgv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.166.242.149
country_id: 6252001
description:
Jan  1 22:40:09 host2 sshd[3364709]: Disconnected from invalid user misha 43.166.242.149 port 33784 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  1 22:41:09 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<oavSrVZHvOwDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  1 22:40:43 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<pkMlrFZH+aR100Db>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  1 22:41:17 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<o1pUrlZHOtgDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan  1 22:43:15 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<YuhQtVZHXpEDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  1 22:46:45 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<RjTBwVZHNx9niu0S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.240.54
country_id: 2921044
description:
Jan  1 22:47:29 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=46.101.240.54, lip=66.85.158.92, session=<0ReAxFZHrX4uZfA2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.193.56
country_id: 2921044
description:
Jan  1 22:47:38 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=46.101.193.56, lip=66.85.158.92, session=<vC4CxVZHcBEuZcE4>


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 207.90.244.14
country_id: 6252001
description:
Jan  1 22:49:25 host2 pure-ftpd[3373652]: (?@207.90.244.14) [INFO] New connection from 207.90.244.14


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  1 22:49:56 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<vwAgzVZHppOi8GQy>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 207.90.244.14
country_id: 6252001
description:
Jan  1 22:49:20 host2 pure-ftpd[3373568]: (?@207.90.244.14) [INFO] New connection from 207.90.244.14


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.27.27
country_id: 3923057
description:
Jan  1 22:49:46 host2 sshd[3373964]: Disconnected from invalid user test 190.181.27.27 port 49090 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.72.233.36
country_id: 2464461
description:
Jan  1 22:51:03 host2 sshd[3375266]: Disconnected from invalid user api_user 154.72.233.36 port 54596 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.4.10.9
country_id: 3469034
description:
Jan  1 22:50:25 host2 sshd[3374723]: Disconnected from invalid user tsbot 189.4.10.9 port 59986 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.72.233.36
country_id: 2464461
description:
Jan  1 22:51:41 host2 sshd[3375796]: Disconnected from invalid user sun 154.72.233.36 port 48874 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.255.157.62
country_id: 3469034
description:
Jan  1 22:52:10 host2 sshd[3376262]: Disconnected from invalid user ftproot 138.255.157.62 port 50514 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  1 22:52:21 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<d0zA1VZHlsAvWBNS>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.255.157.62
country_id: 3469034
description:
Jan  1 22:54:10 host2 sshd[3378114]: Disconnected from invalid user sftpuser 138.255.157.62 port 33346 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.124.127
country_id: 1819730
description:
Jan  1 22:53:28 host2 sshd[3377536]: Disconnected from invalid user sftpuser 101.36.124.127 port 32868 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  1 22:55:01 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<VDlN31ZHLO5nmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.224.170
country_id: 1880251
description:
Jan  1 22:54:46 host2 sshd[3379270]: Disconnected from invalid user user01 68.183.224.170 port 40392 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 22:54:48 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<yFSE3lZH4iwjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.59.55.50
country_id: 1269750
description:
Jan  1 22:55:19 host2 sshd[3379976]: Disconnected from invalid user uploader 137.59.55.50 port 40490 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.84.144.113
country_id: 6252001
description:
Jan  1 22:55:38 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.84.144.113, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<ja+f4VZHeOIUVJBx>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.59.55.50
country_id: 1269750
description:
Jan  1 22:57:04 host2 sshd[3382093]: Disconnected from invalid user pub 137.59.55.50 port 36964 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.183.224.170
country_id: 1880251
description:
Jan  1 22:56:50 host2 sshd[3381803]: Disconnected from invalid user dev 68.183.224.170 port 50492 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.27.27
country_id: 3923057
description:
Jan  1 22:57:36 host2 sshd[3382627]: Disconnected from invalid user nextcloud 190.181.27.27 port 46608 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.124.127
country_id: 1819730
description:
Jan  1 22:57:53 host2 sshd[3382840]: Disconnected from invalid user ftproot 101.36.124.127 port 47634 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 79.110.118.226
country_id: 732800
description:
Jan  1 22:58:43 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=79.110.118.226, lip=66.85.158.91, TLS, session=<Gh2w61ZHwMVPbnbi>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.124.127
country_id: 1819730
description:
Jan  1 22:59:05 host2 sshd[3383960]: Disconnected from invalid user ubuntu 101.36.124.127 port 36338 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.125.4.14
country_id: 798544
description:
Jan  1 22:58:25 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=185.125.4.14, lip=66.85.158.91, TLS, session=<yCGc6lZHzNS5fQQO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.124.127
country_id: 1819730
description:
Jan  1 22:58:32 host2 sshd[3383406]: Disconnected from invalid user mine 101.36.124.127 port 49726 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  1 22:58:30 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<qcG861ZHvo9n9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.27.27
country_id: 3923057
description:
Jan  1 22:58:17 host2 sshd[3383227]: Disconnected from invalid user test 190.181.27.27 port 41938 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.238.104
country_id: 1643084
description:
Jan  1 23:00:18 host2 sshd[3385296]: Disconnected from invalid user dev 103.49.238.104 port 42998 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 23:00:44 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<6XrC81ZHtLov/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2026-01-01 23:00:55 dovecot_login authenticator failed for H=(187-51-252-236.customer.tdatabrasil.net.br) [186.201.54.90]:54622: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.15
country_id: 1733045
description:
2026-01-01 23:01:14 dovecot_login authenticator failed for H=([49.124.151.15]) [49.124.151.15]:36352: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.173.160.152
country_id: 6252001
description:
Jan  1 23:01:31 host2 sshd[3386431]: Disconnected from invalid user chromeuser 107.173.160.152 port 37484 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.115.134
country_id: 6252001
description:
Jan  1 23:02:13 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 8 secs): user=<>, rip=45.79.115.134, lip=66.85.158.91, session=<Ybgt+VZH04UtT3OG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 23:02:28 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<bGHs+VZHGsSeRdY+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.160.152
country_id: 6252001
description:
Jan  1 23:02:48 host2 sshd[3387604]: Disconnected from invalid user filip 107.173.160.152 port 55978 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 23:10:42 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<APdlF1dH1GwjupN+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.65
country_id: 6252001
description:
Jan  1 23:12:51 host2 pure-ftpd[3397742]: (?@205.210.31.65) [INFO] New connection from 205.210.31.65


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  1 23:14:48 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<tNP8JVdHhLcyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 23:15:00 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<fQ7LJldHEOAzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  1 23:15:20 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<lh7uJ1dH2q+i8Jp9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.5
country_id: 6252001
description:
Jan  1 23:16:58 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=74.82.47.5, lip=66.85.158.91, TLS handshaking: Connection closed, session=<027sLVdHKtBKUi8F>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.5
country_id: 6252001
description:
Jan  1 23:17:19 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=74.82.47.5, lip=66.85.158.91, TLS handshaking: Connection closed, session=<fUMpL1dHCkxKUi8F>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 102.204.223.16
country_id: 2328926
description:
Jan  1 23:20:01 host2 pure-ftpd[3404047]: (?@102.204.223.16) [INFO] New connection from 102.204.223.16


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  1 23:20:49 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<fmGWO1dHmKqeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  1 23:20:12 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<Hx1aOVdHor8zTcpt>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  1 23:21:51 host2 pure-ftpd[3406081]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  1 23:25:44 host2 sshd[3409916]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.137.32.187
country_id: 3017382
description:
Jan  1 23:25:24 host2 sshd[3409659]: Disconnected from invalid user informix 79.137.32.187 port 46546 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 79.137.32.187
country_id: 3017382
description:
Jan  1 23:26:48 host2 sshd[3410784]: Disconnected from invalid user altibase 79.137.32.187 port 50634 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.137.32.187
country_id: 3017382
description:
Jan  1 23:26:18 host2 sshd[3410383]: Disconnected from invalid user m 79.137.32.187 port 40300 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.137.32.187
country_id: 3017382
description:
Jan  1 23:27:21 host2 sshd[3411212]: Disconnected from invalid user admin3 79.137.32.187 port 47642 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  1 23:32:10 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<A94jZFdH6IRo7MS0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  1 23:32:50 host2 sshd[3416478]: Disconnected from invalid user admin 2.57.121.112 port 32647 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.93.181.149
country_id: 6252001
description:
Jan  1 23:33:47 host2 pure-ftpd[3417511]: (?@172.93.181.149) [INFO] New connection from 172.93.181.149


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.99
country_id: 6252001
description:
Jan  1 23:37:35 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 45 secs): user=<>, rip=162.216.150.99, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<+6yod1dHDNWi2JZj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.99
country_id: 6252001
description:
Jan  1 23:38:10 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 13 secs): user=<>, rip=162.216.150.99, lip=66.85.158.91, TLS: read(size=429) failed: Connection reset by peer, session=<0/a/eVdH6POi2JZj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  1 23:38:20 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<948jeldHxft100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.169.185
country_id: 2635167
description:
Jan  1 23:40:19 host2 sshd[3424564]: Disconnected from invalid user odoo17 188.166.169.185 port 34212 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  1 23:40:35 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<M747gldHYUhniu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.50.142.82
country_id: 3469034
description:
Jan  1 23:41:30 host2 sshd[3425784]: Disconnected from invalid user dev02 189.50.142.82 port 38161 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.165.130.26
country_id: 1643084
description:
Jan  1 23:41:31 host2 sshd[3425801]: Disconnected from invalid user deployer 103.165.130.26 port 2667 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.164.221.138
country_id: 1643084
description:
Jan  1 23:42:30 host2 sshd[3426748]: Disconnected from invalid user abcd 103.164.221.138 port 2824 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  1 23:43:05 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<ei03i1dHuNov/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-01 23:42:15 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:50998: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 47.252.5.53
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[47.252.5.53] [Remote Port]=[55992] [Authentication Database]=[mail] [Username]=[info@lankaherbalsolutions.com] (10/10 failures) (blocked until [Fri Jan  2 18:13:03 2026 UTC/Fri Jan  2 23:43:03 2026 LOCAL])


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.165.130.26
country_id: 1643084
description:
Jan  1 23:43:12 host2 sshd[3427519]: Disconnected from invalid user user1 103.165.130.26 port 2668 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  1 23:43:36 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<ALwKjVdHbLZCdMzo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.95.12
country_id: 1643084
description:
Jan  1 23:43:11 host2 sshd[3427506]: Disconnected from invalid user xq 103.59.95.12 port 49852 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.248.36
country_id: 2921044
description:
Jan  1 23:44:58 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=46.101.248.36, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Rs8WkldHIKkuZfgk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 209.38.205.107
country_id: 2921044
description:
Jan  1 23:44:23 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=209.38.205.107, lip=66.85.158.92, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<shL5j1dHianRJs1r>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.165.130.26
country_id: 1643084
description:
Jan  1 23:44:29 host2 sshd[3428785]: Disconnected from invalid user admin 103.165.130.26 port 2669 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  1 23:46:09 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<7dcolldHMroFhXlo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.99
country_id: 6252001
description:
Jan  1 23:45:47 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.99, lip=66.85.158.91, TLS, session=<oMH8lFdHUPCi2JZj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.169.185
country_id: 2635167
description:
Jan  1 23:45:49 host2 sshd[3430400]: Disconnected from invalid user nagios 188.166.169.185 port 45162 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.241.187.66
country_id: 6252001
description:
Jan  1 23:45:51 host2 sshd[3430440]: Disconnected from invalid user bitrix 23.241.187.66 port 43652 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.95.12
country_id: 1643084
description:
Jan  1 23:46:39 host2 sshd[3431294]: Disconnected from invalid user linuxadmin 103.59.95.12 port 46542 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.99
country_id: 6252001
description:
Jan  1 23:46:40 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.99, lip=66.85.158.91, TLS, session=<NzEkmFdHKPmi2JZj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.50.142.82
country_id: 3469034
description:
Jan  1 23:47:07 host2 sshd[3431941]: Disconnected from invalid user bitrix 189.50.142.82 port 34113 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.109
country_id: 1819730
description:
Jan  1 23:46:15 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.142.154.109, lip=66.85.158.92, TLS, session=<rvetlldH1tgtjppt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.95.12
country_id: 1643084
description:
Jan  1 23:47:19 host2 sshd[3432252]: Disconnected from invalid user cctv 103.59.95.12 port 53698 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.165.130.26
country_id: 1643084
description:
Jan  1 23:47:48 host2 sshd[3433155]: Disconnected from invalid user bitrix 103.165.130.26 port 2673 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.227
country_id: 6252001
description:
Jan  1 23:48:08 host2 dovecot[3122720]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.227, lip=66.85.158.91, session=<xvVinVdHoMSs7OTj>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 188.166.169.185
country_id: 2635167
description:
Jan  1 23:47:12 host2 sshd[3432092]: Disconnected from invalid user ftpu 188.166.169.185 port 32946 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.95.12
country_id: 1643084
description:
Jan  1 23:48:34 host2 sshd[3434031]: Disconnected from invalid user user1 103.59.95.12 port 53586 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.241.187.66
country_id: 6252001
description:
Jan  1 23:48:13 host2 sshd[3433651]: Disconnected from invalid user cctv 23.241.187.66 port 51044 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 23.241.187.66
country_id: 6252001
description:
Jan  1 23:49:25 host2 sshd[3434890]: Disconnected from invalid user trial 23.241.187.66 port 40040 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  1 23:49:42 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<NinholdHoIei8GQy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.50.142.82
country_id: 3469034
description:
Jan  1 23:50:08 host2 sshd[3435689]: Disconnected from invalid user mika 189.50.142.82 port 55641 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.241.187.66
country_id: 6252001
description:
Jan  1 23:50:33 host2 sshd[3436183]: Disconnected from invalid user deployer 23.241.187.66 port 54470 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.50.142.82
country_id: 3469034
description:
Jan  1 23:51:35 host2 sshd[3437312]: Disconnected from invalid user ppuser 189.50.142.82 port 51603 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.203.179.48
country_id: 6252001
description:
2026-01-01 23:51:46 dovecot_plain authenticator failed for H=(U289EEWT) [154.203.179.48]:42930: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Jan  1 23:52:04 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<pf5Jq1dHlOWYNcU1>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.50.142.82
country_id: 3469034
description:
Jan  1 23:52:58 host2 sshd[3438749]: Disconnected from invalid user tunnel 189.50.142.82 port 41751 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.25.232.7
country_id: 953987
description:
Jan  1 23:53:10 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<amila@euroentertainmentlk.com>, method=PLAIN, rip=41.25.232.7, lip=66.85.158.91, session=<sFxJr1dH7sMpGegH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.21.17.225
country_id: 6252001
description:
2026-01-01 23:54:29 dovecot_login authenticator failed for H=h225.17.21.98.static.ip.windstream.net [98.21.17.225]:59694: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2026-01-01 23:54:42 dovecot_login authenticator failed for H=([41.216.169.12]) [41.216.169.12]:58064: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  1 23:55:29 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<2NWUt1dH9KIjupN+>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 35.186.147.126
country_id: 1880251
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[35.186.147.126] [Remote Port]=[41716] [Authentication Database]=[mail] [Username]=[webmaster@anandaobauae.org] (11/10 failures) (blocked until [Fri Jan  2 18:25:27 2026 UTC/Fri Jan  2 23:55:27 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  1 23:55:45 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<EKSEuFdH9uJn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  1 23:56:21 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<CrCfuldH9oOeRdGr>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  1 23:59:59 host2 sshd[3446311]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 00:01:28 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<UUTzzFdHtrCeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  2 00:03:18 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<support@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<7QRf01dH3JVnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 00:03:59 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<qx701VdH5oYv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  2 00:10:05 host2 sshd[3456618]: Disconnected from invalid user admin 2.57.121.112 port 39808 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 00:11:26 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<uB2S8FdHiJkjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  2 00:15:38 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<Dwqb/1dHXGGi8Jp9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.68.226.87
country_id: 3017382
description:
Jan  2 00:15:51 host2 sshd[3462540]: Disconnected from invalid user admin 51.68.226.87 port 59828 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.201.65
country_id: 2921044
description:
Jan  2 00:16:09 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=46.101.201.65, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<1sGQAVhHm/QuZclB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 209.38.220.48
country_id: 2921044
description:
Jan  2 00:16:45 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=209.38.220.48, lip=66.85.158.91, TLS handshaking: Connection closed, session=<VMiyA1hHNFbRJtww>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.174.199
country_id: 1819730
description:
Jan  2 00:18:07 host2 sshd[3464634]: Disconnected from invalid user myadmin 152.32.174.199 port 33708 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.68.226.87
country_id: 3017382
description:
Jan  2 00:18:14 host2 sshd[3464718]: Disconnected from invalid user arnaldo 51.68.226.87 port 33618 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 51.68.226.87
country_id: 3017382
description:
Jan  2 00:19:15 host2 sshd[3465605]: Received disconnect from 51.68.226.87 port 57024:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.174.199
country_id: 1819730
description:
Jan  2 00:19:25 host2 sshd[3465752]: Disconnected from invalid user satis 152.32.174.199 port 58578 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 00:19:50 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<f9mmDlhHMtueRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  2 00:20:08 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<inS4D1hH6IueRdGr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.68.226.87
country_id: 3017382
description:
Jan  2 00:20:43 host2 sshd[3467077]: Disconnected from invalid user ubuntu 51.68.226.87 port 35652 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  2 00:20:52 host2 sshd[3467227]: Disconnected from invalid user user 2.57.121.25 port 28302 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.174.199
country_id: 1819730
description:
Jan  2 00:20:38 host2 sshd[3466988]: Disconnected from invalid user cxy 152.32.174.199 port 49124 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  2 00:24:24 host2 pure-ftpd[3470872]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.238.2.7
country_id: 3469034
description:
2026-01-02 00:28:01 dovecot_login authenticator failed for H=45-238-2-7.netmaisfibra.net.br [45.238.2.7]:42358: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.130
country_id: 1269750
description:
2026-01-02 00:27:46 dovecot_login authenticator failed for H=([27.123.114.130]) [27.123.114.130]:49490: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.122.121.56
country_id: 6252001
description:
Jan  2 00:28:32 host2 sshd[3475039]: Disconnected from invalid user steam 134.122.121.56 port 38822 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  2 00:30:05 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<dbI/M1hHdMYzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  2 00:30:13 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<BrbCM1hHOuovWBNS>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 134.122.121.56
country_id: 6252001
description:
Jan  2 00:31:33 host2 sshd[3478471]: Disconnected from invalid user cxy 134.122.121.56 port 35312 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.197
country_id: 6252001
description:
Jan  2 00:31:44 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.197, lip=66.85.158.92, session=<OMVUOVhHmq5APsXF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.122.121.56
country_id: 6252001
description:
Jan  2 00:32:19 host2 sshd[3479435]: Disconnected from invalid user minecraft 134.122.121.56 port 41474 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-01-02 00:34:17 dovecot_plain authenticator failed for H=(paric) [24.187.213.29]:60934: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  2 00:34:25 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<tFDBQlhHtylniu0S>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 51.77.202.109
country_id: 3017382
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[51.77.202.109] [Remote Port]=[38420] [Authentication Database]=[mail] [Username]=[no-reply@dataesite.lk] (10/10 failures) (blocked until [Fri Jan  2 19:05:12 2026 UTC/Sat Jan  3 00:35:12 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.202.109
country_id: 3017382
description:
Jan  2 00:35:14 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=51.77.202.109, lip=66.85.158.91, session=<imuuRVhHFJYzTcpt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  2 00:35:35 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<Tr76RlhH1gZ100Db>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.105
country_id: 6252001
description:
Jan  2 00:37:09 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.105, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<rVW2TFhHHd+TuYRp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 98.159.41.12
country_id: 1327865
description:
Jan  2 00:39:49 host2 dovecot[3122720]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=98.159.41.12, lip=66.85.158.91, session=<4Kw+VlhH7IZinykM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 154.47.20.218
country_id: 1861060
description:
Jan  2 00:39:49 host2 dovecot[3122720]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=154.47.20.218, lip=66.85.158.91, session=<9XQ/VlhHaI6aLxTa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 84.17.56.175
country_id: 1819730
description:
Jan  2 00:39:50 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=84.17.56.175, lip=66.85.158.91, session=<ceFDVlhHPpNUETiv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 84.17.56.149
country_id: 1819730
description:
Jan  2 00:39:50 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=84.17.56.149, lip=66.85.158.91, session=<KhJFVlhHKKlUETiV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 181.214.206.9
country_id: 2750405
description:
Jan  2 00:39:52 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=181.214.206.9, lip=66.85.158.91, TLS, session=<tLBsVlhHerW11s4J>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 181.214.173.76
country_id: 2921044
description:
Jan  2 00:39:52 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=181.214.173.76, lip=66.85.158.91, TLS handshaking: Connection closed, session=<9eNsVlhHeLW11q1M>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.70.10.49
country_id: 3624060
description:
Jan  2 00:40:16 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=146.70.10.49, lip=66.85.158.91, TLS, session=<C5XRV1hHZNeSRgox>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.80.150.217
country_id: 3190538
description:
Jan  2 00:40:16 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.80.150.217, lip=66.85.158.91, TLS handshaking: Connection closed, session=<tabRV1hHVtfDUJbZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 181.214.173.76
country_id: 2921044
description:
Jan  2 00:40:17 host2 dovecot[3122720]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=181.214.173.76, lip=66.85.158.91, session=<6iXcV1hHbry11q1M>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.70.10.45
country_id: 3624060
description:
Jan  2 00:40:17 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=146.70.10.45, lip=66.85.158.91, TLS handshaking: Connection closed, session=<LXjfV1hH6r+SRgot>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 156.146.55.165
country_id: 732800
description:
Jan  2 00:40:14 host2 pure-ftpd[3488309]: (?@156.146.55.165) [INFO] New connection from 156.146.55.165


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 178.175.141.232
country_id: 617790
description:
Jan  2 00:40:16 host2 dovecot[3122720]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=178.175.141.232, lip=66.85.158.91, session=<ApLYV1hHjiKyr43o>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.239.217.11
country_id: 3041565
description:
Jan  2 00:40:16 host2 dovecot[3122720]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=173.239.217.11, lip=66.85.158.91, session=<yITWV1hHnqGt79kL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.253.99.199
country_id: 2510769
description:
Jan  2 00:40:16 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=185.253.99.199, lip=66.85.158.91, session=<P9zYV1hHeKG5/WPH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.234.132
country_id: 289688
description:
Jan  2 00:40:17 host2 dovecot[3122720]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=95.181.234.132, lip=66.85.158.91, TLS, session=<AZbhV1hH+r9fteqE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 203.188.182.122
country_id: 2635167
description:
Jan  2 00:40:16 host2 dovecot[3122720]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=203.188.182.122, lip=66.85.158.91, session=<4DfVV1hHgLzLvLZ6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 00:46:43 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<BabFblhHWqEv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  2 00:49:30 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<58i/eFhHFOyi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  2 00:50:10 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<hUYde1hHiLAyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  2 00:53:09 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<lVDBhVhHVJhn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 00:56:29 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<lTmtkVhHAHEjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  2 00:58:21 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<hk1jmFhH8FNo7MS0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.132
country_id: 6252001
description:
Jan  2 01:00:11 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (no auth attempts in 16 secs): user=<>, rip=66.132.153.132, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ZIAJn1hH1AlChJmE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 01:00:42 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<e1DHoFhHmoOeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  2 01:03:45 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<hT+sq1hHdqAFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 01:08:26 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<OT90vFhHGtov/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 39.109.104.252
country_id: 1819730
description:
Jan  2 01:09:51 host2 sshd[3517762]: Disconnected from invalid user administrator 39.109.104.252 port 59404 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  2 01:10:10 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<WAabwlhH6KhCdMzo>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 39.109.104.252
country_id: 1819730
description:
Jan  2 01:11:37 host2 sshd[3519604]: Disconnected from invalid user centos 39.109.104.252 port 59040 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  2 01:12:25 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<CiWsylhHaNNnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 01:12:42 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<kSC4y1hHhGEjupN+>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  2 01:14:04 host2 sshd[3521958]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 39.109.104.252
country_id: 1819730
description:
Jan  2 01:13:14 host2 sshd[3521278]: Disconnected from invalid user user1 39.109.104.252 port 58674 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  2 01:16:04 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<rWS/11hH4Lui8Jp9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 37.19.223.215
country_id: 2782113
description:
Jan  2 01:17:34 host2 dovecot[3488397]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=37.19.223.215, lip=66.85.158.91, session=<SVgy3VhH8IElE9/X>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.126
country_id: 6252001
description:
Jan  2 01:17:57 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.126, lip=66.85.158.91, TLS: Connection closed, session=<fFad3lhHCDxChJl+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 39.109.104.252
country_id: 1819730
description:
Jan  2 01:17:16 host2 sshd[3524834]: Disconnected from invalid user steam1 39.109.104.252 port 43638 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 98.159.40.159
country_id: 1210997
description:
Jan  2 01:17:33 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=98.159.40.159, lip=66.85.158.91, TLS handshaking: Connection closed, session=<s+Ul3VhHVr1inyif>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.199.59.140
country_id: 798544
description:
Jan  2 01:17:33 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=138.199.59.140, lip=66.85.158.91, TLS, session=<3eck3VhHyp2KxzuM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.234.132
country_id: 289688
description:
Jan  2 01:17:34 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=95.181.234.132, lip=66.85.158.91, session=<oio33VhHzpRfteqE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  2 01:18:40 host2 sshd[3526459]: Disconnected from invalid user admin 2.57.121.112 port 55591 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 01:19:26 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<rSvM41hH2OGeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.178.103
country_id: 3175395
description:
Jan  2 01:20:20 host2 dovecot[3488397]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=217.26.178.103, lip=66.85.158.91, TLS, session=<SOok5lhHreDZGrJn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 41.223.251.9
country_id: 2395170
description:
Jan  2 01:20:57 host2 dovecot[3488397]: imap-login: Disconnected: Connection closed (client didn't finish SASL auth, waited 0 secs): user=<>, method=PLAIN, rip=41.223.251.9, lip=66.85.158.91, session=<5Q1S6VhHz6Mp3/sJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.210
country_id: 6252001
description:
Jan  2 01:21:08 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.210, lip=66.85.158.91, TLS handshaking: Connection closed, session=<mRr26VhHjeRAPsXS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.18.23
country_id: 2300660
description:
Jan  2 01:21:13 host2 dovecot[3488397]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<charanaw>, method=PLAIN, rip=41.139.18.23, lip=66.85.158.91, TLS, session=<oVfd6FhHc5IpixIX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.197
country_id: 6252001
description:
Jan  2 01:21:24 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.197, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Xpj06lhHVixAPsXF>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  2 01:27:03 host2 pure-ftpd[3534982]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  2 01:28:27 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<oOMGBFlHOgpniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  2 01:33:07 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<A229FFlHKkF100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.142.247.48
country_id: 6252001
description:
2026-01-02 01:32:30 dovecot_login authenticator failed for H=(rljjjCwQc) [98.142.247.48]:65487: 535 Incorrect authentication data (set_id=inquire@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.142.247.48
country_id: 6252001
description:
2026-01-02 01:33:14 dovecot_login authenticator failed for H=(XjEgsQpVZ) [98.142.247.48]:65055: 535 Incorrect authentication data (set_id=inquire@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.142.247.48
country_id: 6252001
description:
2026-01-02 01:36:00 dovecot_login authenticator failed for H=(Ozxirx5u9) [98.142.247.48]:51878: 535 Incorrect authentication data (set_id=inquire@lezzarotech.com)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 98.142.247.48
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Remote IP Address]=[98.142.247.48] [Authentication Database]=[mail] [Username]=[inquire@lezzarotech.com] (5/5 failures) (blocked until [Thu Jan  1 20:20:58 2026 UTC/Fri Jan  2 01:50:58 2026 LOCAL])


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.165
country_id: 6252001
description:
Jan  2 01:36:37 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=205.210.31.165, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<rQ1gIVlHFMHN0h+l>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.65.193.113
country_id: 6252001
description:
Jan  2 01:37:32 host2 pure-ftpd[3547024]: (?@20.65.193.113) [INFO] New connection from 20.65.193.113


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.192.78.112
country_id: 1168579
description:
2026-01-02 01:40:02 dovecot_plain authenticator failed for H=(P756S1ACH72QLPV) [154.192.78.112]:6940: 535 Incorrect authentication data (set_id=kasunp@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.192.78.112
country_id: 1168579
description:
2026-01-02 01:40:09 dovecot_login authenticator failed for H=(P756S1ACH72QLPV) [154.192.78.112]:6940: 535 Incorrect authentication data (set_id=kasunp@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Jan  2 01:43:56 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<1mhrO1lHqMeYNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.183.185.225
country_id: 2510769
description:
Jan  2 01:44:39 host2 dovecot[3488397]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=5.183.185.225, lip=66.85.158.91, TLS, session=<dwYHPVlHVMMFt7nh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.150.73.26
country_id: 3057568
description:
Jan  2 01:45:25 host2 dovecot[3488397]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 26 secs): user=<env_eng>, method=PLAIN, rip=193.150.73.26, lip=66.85.158.91, TLS, session=<xNlCP1lHpAnBlkka>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.163
country_id: 2993457
description:
Jan  2 01:46:41 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.163, lip=66.85.158.91, session=<5xRZRVlHgP/CpRCj>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  2 01:48:16 host2 sshd[3557714]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  2 01:49:41 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<NY/8T1lHiK6i8GQy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  2 01:49:58 host2 sshd[3559315]: Disconnected from invalid user admin 2.57.121.112 port 65424 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  2 01:50:51 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<OZ0jVFlHQOBn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 01:51:38 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<qinxVllHqMMv/AU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.169.4.104
country_id: 2635167
description:
Jan  2 01:57:27 host2 dovecot[3488397]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.169.4.104, lip=66.85.158.91, session=<6n7ca1lHgva5qQRo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 01:58:18 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<4ELDbllHJpIjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 02:01:12 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<PtsleVlHYMKeRdY+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.108
country_id: 6252001
description:
Jan  2 02:03:35 host2 dovecot[3488397]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.108, lip=66.85.158.92, session=<l6XNgVlHRv/N0h9s>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  2 02:07:45 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<tv6VkFlHhpMvWBNS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.213.26.23
country_id: 6252001
description:
Jan  2 02:09:19 host2 sshd[3579397]: Disconnected from invalid user jack 209.213.26.23 port 58646 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.92.109.196
country_id: 1819730
description:
Jan  2 02:10:46 host2 sshd[3580919]: Disconnected from invalid user user01 154.92.109.196 port 6916 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.92.109.196
country_id: 1819730
description:
Jan  2 02:11:23 host2 sshd[3581462]: Disconnected from invalid user ubuntu 154.92.109.196 port 44637 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 02:14:25 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<RU1xqFlHnscjupN+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.213.26.23
country_id: 6252001
description:
Jan  2 02:15:57 host2 sshd[3586056]: Disconnected from invalid user mob 209.213.26.23 port 49980 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.214.126.1
country_id: 6252001
description:
Jan  2 02:16:46 host2 sshd[3587096]: Disconnected from invalid user ansible 162.214.126.1 port 56584 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  2 02:16:51 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<eSEUsVlHOoKi8Jp9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.40
country_id: 6252001
description:
Jan  2 02:16:08 host2 dovecot[3488397]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.40, lip=66.85.158.91, TLS, session=<WGemrllHmPfG6xgo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.214.126.1
country_id: 6252001
description:
Jan  2 02:17:24 host2 sshd[3587669]: Disconnected from invalid user sistemas 162.214.126.1 port 40630 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.133.156.119
country_id: 294640
description:
2026-01-02 02:17:47 dovecot_plain authenticator failed for H=(appos) [195.133.156.119]:40834: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.214.126.1
country_id: 6252001
description:
Jan  2 02:17:55 host2 sshd[3588221]: Disconnected from invalid user red5 162.214.126.1 port 52228 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.214.126.1
country_id: 6252001
description:
Jan  2 02:18:25 host2 sshd[3588698]: Disconnected from invalid user celia 162.214.126.1 port 35606 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 02:20:00 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<LLVivFlHiJieRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  2 02:21:15 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<5GzTwFlHEL+eRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  2 02:22:46 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<+jZKxllHBDNniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  2 02:22:16 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<zXx/xFlHTJMFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  2 02:22:22 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<7wTOxFlHroJnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2026-01-02 02:23:43 dovecot_login authenticator failed for H=([185.134.179.106]) [185.101.16.250]:60079: 535 Incorrect authentication data (set_id=test@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  2 02:24:40 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<1nQXzVlH+FRo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  2 02:25:29 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<xZv/z1lHIJoyBsPO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.67
country_id: 6252001
description:
Jan  2 02:25:58 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.139.67, lip=66.85.158.92, TLS handshaking: Connection closed, session=<VSzV0VlHmnO4aYtD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.67
country_id: 6252001
description:
Jan  2 02:26:17 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.139.67, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Aa7+0llH8mu4aYtD>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  2 02:29:43 host2 pure-ftpd[3599994]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 98.80.4.4
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 98.80.4.4: 250 connections per 30 seconds to 8443 port.


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  2 02:37:19 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<1cpI+llHosJCdMzo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.229
country_id: 6252001
description:
Jan  2 02:38:32 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.229, lip=66.85.158.92, session=<BlbC/llHNRNAPsXl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.227
country_id: 6252001
description:
Jan  2 02:38:44 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.227, lip=66.85.158.92, TLS: Connection closed, session=<AgJ+/1lHxMRAPsXj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.1.18
country_id: 1819730
description:
Jan  2 02:44:18 host2 sshd[3614350]: Disconnected from invalid user ana 165.154.1.18 port 44470 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.80.18.158
country_id: 3686110
description:
Jan  2 02:44:22 host2 sshd[3614423]: Disconnected from invalid user admin1 186.80.18.158 port 34230 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.161
country_id: 2993457
description:
Jan  2 02:45:28 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.161, lip=66.85.158.92, session=<yxKcF1pHOv7CpRCh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  2 02:45:54 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<tSsBGVpHoKueRdGr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.62.43.176
country_id: 2635167
description:
Jan  2 02:47:14 host2 sshd[3618287]: Disconnected from invalid user bounce 178.62.43.176 port 43348 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 178.62.43.176
country_id: 2635167
description:
Jan  2 02:47:47 host2 sshd[3618835]: Disconnected from invalid user francois 178.62.43.176 port 33322 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.62.43.176
country_id: 2635167
description:
Jan  2 02:48:18 host2 sshd[3619565]: Disconnected from invalid user vagrant 178.62.43.176 port 41146 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  2 02:48:47 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<Y2NKI1pHyJpn9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.1.18
country_id: 1819730
description:
Jan  2 02:49:13 host2 sshd[3620399]: Disconnected from invalid user fiscal 165.154.1.18 port 41548 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  2 02:49:50 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<pQwYJ1pHEtyi8GQy>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.1.18
country_id: 1819730
description:
Jan  2 02:50:42 host2 sshd[3622290]: Disconnected from invalid user elias 165.154.1.18 port 59620 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.67
country_id: 6252001
description:
Jan  2 02:51:25 host2 dovecot[3488397]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.20.67, lip=66.85.158.92, TLS handshaking: Connection closed, session=<qyvjLFpH9NdBMRRD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 02:57:11 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<jQNZQVpHnNwv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 03:00:22 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<N025TFpHzEcjupN+>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  2 03:01:34 host2 sshd[3634562]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 03:01:14 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<0rnST1pHYMGeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.110.115.146
country_id: 3865483
description:
Jan  2 03:01:17 host2 dovecot[3488397]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=190.110.115.146, lip=66.85.158.91, TLS, session=<6C3+TlpHr8O+bnOS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.208.106.50
country_id: 3175395
description:
Jan  2 03:01:35 host2 dovecot[3488397]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.208.106.50, lip=66.85.158.91, TLS, session=<5Lo8UFpHatK50Goy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.95
country_id: 6252001
description:
Jan  2 03:02:17 host2 dovecot[3488397]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.95, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ds+9U1pH4cnG6xhf>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  2 03:07:53 host2 sshd[3641221]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.195.210.47
country_id: 6252001
description:
Jan  2 03:08:11 host2 dovecot[3488397]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=194.195.210.47, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<6tvQaFpHLd3Cw9Iv>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.140.160
country_id: 2921044
description:
Jan  2 03:12:28 host2 sshd[3645792]: Disconnected from invalid user sysadmin 164.92.140.160 port 44910 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.123.109.114
country_id: 732800
description:
Jan  2 03:12:14 host2 sshd[3645612]: Invalid user sivagnanamfoundation from 93.123.109.114 port 43318


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.202.8.218
country_id: 1269750
description:
Jan  2 03:13:12 host2 sshd[3646446]: Disconnected from invalid user cctv 160.202.8.218 port 43412 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  2 03:13:16 host2 sshd[3646515]: Disconnected from invalid user user 2.57.121.25 port 38062 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 160.202.8.218
country_id: 1269750
description:
Jan  2 03:13:49 host2 sshd[3647058]: Disconnected from invalid user trial 160.202.8.218 port 51168 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.202.8.218
country_id: 1269750
description:
Jan  2 03:14:25 host2 sshd[3647605]: Disconnected from invalid user cmm 160.202.8.218 port 58924 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 9.223.176.221
country_id: 2661886
description:
Jan  2 03:15:26 host2 sshd[3648855]: Disconnected from invalid user deployhq 9.223.176.221 port 36248 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.202.8.218
country_id: 1269750
description:
Jan  2 03:15:35 host2 sshd[3649103]: Disconnected from invalid user remoto 160.202.8.218 port 46202 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.140.160
country_id: 2921044
description:
Jan  2 03:15:41 host2 sshd[3649226]: Disconnected from invalid user testing 164.92.140.160 port 57006 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 03:16:35 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<5N22hlpHmEQjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 216.155.93.75
country_id: 3895114
description:
Jan  2 03:17:06 host2 sshd[3650820]: Disconnected from invalid user steam 216.155.93.75 port 49825 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.206
country_id: 1269750
description:
2026-01-02 03:16:40 dovecot_login authenticator failed for H=([182.95.176.206]) [182.95.176.206]:53926: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 164.92.140.160
country_id: 2921044
description:
Jan  2 03:16:48 host2 sshd[3650463]: Disconnected from invalid user frappe 164.92.140.160 port 45082 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.82.214.8
country_id: 2077456
description:
Jan  2 03:16:57 host2 sshd[3650630]: Disconnected from invalid user max 40.82.214.8 port 57596 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.140.160
country_id: 2921044
description:
Jan  2 03:16:15 host2 sshd[3649828]: Disconnected from invalid user web 164.92.140.160 port 56734 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.176.131
country_id: 1643084
description:
Jan  2 03:16:25 host2 sshd[3650011]: Disconnected from invalid user admin 103.193.176.131 port 45940 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.176.131
country_id: 1643084
description:
Jan  2 03:17:40 host2 sshd[3651442]: Disconnected from invalid user lee 103.193.176.131 port 46046 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.182.83.231
country_id: 2510769
description:
Jan  2 03:17:14 host2 sshd[3650980]: Disconnected from invalid user dell 5.182.83.231 port 47858 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  2 03:17:15 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<PXsdiVpHKxRniu0S>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.42
country_id: 1269750
description:
2026-01-02 03:17:29 dovecot_login authenticator failed for H=([27.123.104.42]) [27.123.104.42]:59606: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.188.120.232
country_id: 337996
description:
Jan  2 03:17:29 host2 sshd[3651252]: Disconnected from invalid user riccardo 196.188.120.232 port 54160 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  2 03:18:16 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<jn+/jFpHOnyi8Jp9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.140.160
country_id: 2921044
description:
Jan  2 03:18:54 host2 sshd[3652838]: Disconnected from invalid user ftpupload 164.92.140.160 port 33944 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.82.214.8
country_id: 2077456
description:
Jan  2 03:18:22 host2 sshd[3652310]: Disconnected from invalid user mina 40.82.214.8 port 50640 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.124.158.147
country_id: 99237
description:
Jan  2 03:18:27 host2 sshd[3652375]: Disconnected from invalid user xq 138.124.158.147 port 60812 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.145.104
country_id: 1643084
description:
Jan  2 03:19:52 host2 sshd[3653738]: Disconnected from invalid user test 103.217.145.104 port 47304 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 03:19:57 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<g+/GklpHVt6eRdY+>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 158.69.214.62
country_id: 6251999
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[158.69.214.62] [Remote Port]=[56918] [Authentication Database]=[mail] [Username]=[test@anandaobauae.org] (12/10 failures) (blocked until [Fri Jan  2 21:49:55 2026 UTC/Sat Jan  3 03:19:55 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 03:19:12 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<3TEWkFpH2MQv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.176.131
country_id: 1643084
description:
Jan  2 03:19:30 host2 sshd[3653381]: Disconnected from invalid user trial 103.193.176.131 port 46204 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.82.214.8
country_id: 2077456
description:
Jan  2 03:19:50 host2 sshd[3653723]: Disconnected from invalid user ubuntu 40.82.214.8 port 49560 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 89.126.208.241
country_id: 1512440
description:
Jan  2 03:20:15 host2 sshd[3654397]: Disconnected from invalid user sinusbot 89.126.208.241 port 47474 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.82.214.8
country_id: 2077456
description:
Jan  2 03:20:33 host2 sshd[3654737]: Disconnected from invalid user username 40.82.214.8 port 34362 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-02 03:20:44 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:50351: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 211.24.41.44
country_id: 1733045
description:
Jan  2 03:21:10 host2 sshd[3655657]: Disconnected from invalid user vlad 211.24.41.44 port 43902 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 216.155.93.75
country_id: 3895114
description:
Jan  2 03:21:44 host2 sshd[3656425]: Disconnected from invalid user web 216.155.93.75 port 32793 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.182.83.231
country_id: 2510769
description:
Jan  2 03:22:18 host2 sshd[3657324]: Disconnected from invalid user cctv 5.182.83.231 port 53490 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.188.120.232
country_id: 337996
description:
Jan  2 03:22:29 host2 sshd[3657547]: Disconnected from invalid user git 196.188.120.232 port 39836 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.189
country_id: 6252001
description:
Jan  2 03:22:56 host2 dovecot[3488397]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 3 secs): user=<>, rip=147.185.132.189, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<luGKnVpHK9yTuYS9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.98.45.238
country_id: 6252001
description:
2026-01-02 03:23:01 dovecot_plain authenticator failed for H=c-24-98-45-238.hsd1.ga.comcast.net (dochion) [24.98.45.238]:51608: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.45.237.132
country_id: 6252001
description:
Jan  2 03:22:14 host2 sshd[3657209]: Disconnected from invalid user diego 45.45.237.132 port 41738 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.188.120.232
country_id: 337996
description:
Jan  2 03:23:34 host2 sshd[3659313]: Disconnected from invalid user erpnext 196.188.120.232 port 46538 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 216.155.93.75
country_id: 3895114
description:
Jan  2 03:23:42 host2 sshd[3659549]: Disconnected from invalid user test001 216.155.93.75 port 53144 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.182.83.231
country_id: 2510769
description:
Jan  2 03:23:16 host2 sshd[3658862]: Disconnected from invalid user bitrix 5.182.83.231 port 34170 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.145.104
country_id: 1643084
description:
Jan  2 03:23:22 host2 sshd[3659045]: Disconnected from invalid user user15 103.217.145.104 port 33220 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 211.24.41.44
country_id: 1733045
description:
Jan  2 03:24:43 host2 sshd[3661175]: Disconnected from invalid user test_user 211.24.41.44 port 47398 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.145.104
country_id: 1643084
description:
Jan  2 03:24:56 host2 sshd[3661519]: Disconnected from invalid user minecraft 103.217.145.104 port 56234 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.182.83.231
country_id: 2510769
description:
Jan  2 03:24:12 host2 sshd[3660420]: Disconnected from invalid user visitor 5.182.83.231 port 39610 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.45.237.132
country_id: 6252001
description:
Jan  2 03:24:22 host2 sshd[3660701]: Disconnected from invalid user git 45.45.237.132 port 50228 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.45.237.132
country_id: 6252001
description:
Jan  2 03:25:28 host2 sshd[3662657]: Disconnected from invalid user teamspeak3 45.45.237.132 port 39256 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.145.104
country_id: 1643084
description:
Jan  2 03:25:41 host2 sshd[3662993]: Disconnected from invalid user ftpuser 103.217.145.104 port 44788 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.188.120.232
country_id: 337996
description:
Jan  2 03:25:47 host2 sshd[3663158]: Disconnected from invalid user odoo13 196.188.120.232 port 52770 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.45.237.132
country_id: 6252001
description:
Jan  2 03:26:00 host2 sshd[3663720]: Disconnected from invalid user testuser 45.45.237.132 port 39474 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.182.83.231
country_id: 2510769
description:
Jan  2 03:25:10 host2 sshd[3662038]: Disconnected from invalid user admin 5.182.83.231 port 45822 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 211.24.41.44
country_id: 1733045
description:
Jan  2 03:25:19 host2 sshd[3662371]: Disconnected from invalid user ubuntu 211.24.41.44 port 55936 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 211.24.41.44
country_id: 1733045
description:
Jan  2 03:27:37 host2 sshd[3665720]: Disconnected from invalid user test 211.24.41.44 port 45144 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  2 03:28:12 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<LsFNsFpHdZ5100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.145.104
country_id: 1643084
description:
Jan  2 03:28:48 host2 sshd[3666966]: Disconnected from invalid user admin 103.217.145.104 port 35964 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Jan  2 03:30:18 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<3wjRt1pHcucFhH+s>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  2 03:31:56 host2 pure-ftpd[3671035]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  2 03:32:44 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<ptNywFpHpKRnmud6>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  2 03:35:34 host2 sshd[3675382]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Jan  2 03:37:50 host2 dovecot[3488397]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<w/+20lpH8OGYNcU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 84.17.56.175
country_id: 1819730
description:
Jan  2 03:39:57 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=84.17.56.175, lip=66.85.158.91, session=<lY9z2lpHSthUETiv>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.90.124.136
country_id: 3042225
description:
Jan  2 03:39:53 host2 pure-ftpd[3681682]: (?@91.90.124.136) [INFO] New connection from 91.90.124.136


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 138.199.59.140
country_id: 798544
description:
Jan  2 03:39:52 host2 pure-ftpd[3681674]: (?@138.199.59.140) [INFO] New connection from 138.199.59.140


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.215.235.51
country_id: 1831722
description:
Jan  2 03:39:56 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=188.215.235.51, lip=66.85.158.91, session=<dnhY2lpHFua81+sz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.234.135
country_id: 289688
description:
Jan  2 03:39:56 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=95.181.234.135, lip=66.85.158.91, TLS, session=<0bJY2lpH9sFfteqH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.234.133
country_id: 289688
description:
Jan  2 03:39:55 host2 dovecot[3680762]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=95.181.234.133, lip=66.85.158.91, session=<ztJS2lpHIOZfteqF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.154.155.12
country_id: 3932488
description:
Jan  2 03:39:55 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=45.154.155.12, lip=66.85.158.91, TLS handshaking: Connection closed, session=<DolW2lpH8sEtmpsM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.154.155.11
country_id: 3932488
description:
Jan  2 03:39:56 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=45.154.155.11, lip=66.85.158.91, TLS handshaking: Connection closed, session=<3M1d2lpHcKYtmpsL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 98.159.41.5
country_id: 1327865
description:
Jan  2 03:39:56 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=98.159.41.5, lip=66.85.158.91, TLS, session=<Xl1f2lpHtppinykF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  2 03:41:59 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<t6SN4VpHNq8FhXlo>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.220.188.136
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.220.188.136: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  2 03:45:50 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<Jo1X71pHEpYvWBNS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  2 03:46:49 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<14Lf8lpHBJVn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  2 03:49:36 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<a7PF/FpHmgRo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  2 03:50:23 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<inea/1pHsqyi8GQy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.66.72.251
country_id: 6252001
description:
Jan  2 03:53:36 host2 sshd[3700645]: Disconnected from invalid user administrator 34.66.72.251 port 34340 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 38.148.242.232
country_id: 6252001
description:
Jan  2 03:55:45 host2 pure-ftpd[3703178]: (?@38.148.242.232) [INFO] New connection from 38.148.242.232


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.75.78.99
country_id: 3469034
description:
Jan  2 03:57:21 host2 sshd[3704565]: Disconnected from invalid user hydra 168.75.78.99 port 53818 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.38.224.114
country_id: 3017382
description:
Jan  2 03:58:27 host2 sshd[3705837]: Disconnected from invalid user user 51.38.224.114 port 56184 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.38.224.114
country_id: 3017382
description:
Jan  2 03:59:55 host2 sshd[3707246]: Disconnected from invalid user luis 51.38.224.114 port 57686 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.75.78.99
country_id: 3469034
description:
Jan  2 03:59:28 host2 sshd[3706857]: Disconnected from invalid user luis 168.75.78.99 port 34632 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.66.72.251
country_id: 6252001
description:
Jan  2 03:59:44 host2 sshd[3707044]: Disconnected from invalid user ftpuser 34.66.72.251 port 41926 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.43.242
country_id: 1269750
description:
Jan  2 03:59:49 host2 sshd[3707121]: Disconnected from invalid user david 139.59.43.242 port 43732 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.66.72.251
country_id: 6252001
description:
Jan  2 04:00:41 host2 sshd[3708178]: Disconnected from invalid user ubuntu 34.66.72.251 port 38634 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 04:01:14 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<SWRJJltHWqieRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  2 04:01:32 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<huOAJ1tHAugyBsPO>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 139.59.43.242
country_id: 1269750
description:
Jan  2 04:01:42 host2 sshd[3709067]: Disconnected from invalid user grid 139.59.43.242 port 40598 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 04:02:35 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<oNdEK1tH8FwjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 04:03:02 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<SJLgLFtHJIYv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  2 04:03:27 host2 sshd[3710642]: Disconnected from invalid user admin 2.57.121.112 port 34318 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  2 04:04:50 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<O8IvM1tH4odCdMzo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.102.40.218
country_id: 6252001
description:
Jan  2 04:08:23 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=212.102.40.218, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<N2oWQFtHIH3UZija>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.75.78.99
country_id: 3469034
description:
Jan  2 04:08:28 host2 sshd[3715241]: Disconnected from invalid user dara 168.75.78.99 port 52700 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  2 04:11:30 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<DikiS1tH8h1niu0S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.228.53.4
country_id: 6252001
description:
Jan  2 04:14:16 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=66.228.53.4, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<WIYrVVtHsHxC5DUE>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 38.148.242.242
country_id: 6252001
description:
Jan  2 04:14:16 host2 pure-ftpd[3722205]: (?@38.148.242.242) [INFO] New connection from 38.148.242.242


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 168.75.78.99
country_id: 3469034
description:
Jan  2 04:18:51 host2 sshd[3727293]: Disconnected from invalid user david 168.75.78.99 port 45924 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 04:18:57 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<jiLKZVtHSFQjupN+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.231.89.185
country_id: 3017382
description:
Jan  2 04:20:19 host2 pure-ftpd[3728789]: (?@91.231.89.185) [INFO] New connection from 91.231.89.185


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  2 04:19:35 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<Ny8EaFtHsDSi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 04:19:58 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<i4VraVtH2saeRdY+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.199.224.52
country_id: 357994
description:
Jan  2 04:21:13 host2 sshd[3729743]: Disconnected from invalid user glassfish 197.199.224.52 port 48632 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.6.215.53
country_id: 3469034
description:
Jan  2 04:22:18 host2 sshd[3730784]: Disconnected from invalid user downloader 69.6.215.53 port 48488 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.199.224.52
country_id: 357994
description:
Jan  2 04:22:45 host2 sshd[3731379]: Disconnected from invalid user g 197.199.224.52 port 44464 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.199.224.52
country_id: 357994
description:
Jan  2 04:23:26 host2 sshd[3732098]: Disconnected from invalid user fred 197.199.224.52 port 58066 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 13.73.111.251
country_id: 2077456
description:
Jan  2 04:24:13 host2 sshd[3732866]: Disconnected from invalid user user 13.73.111.251 port 58460 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.5.108.45
country_id: 2186224
description:
Jan  2 04:23:40 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=103.5.108.45, lip=66.85.158.91, TLS, session=<ODOQdVtH76BnBWwt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 136.228.161.66
country_id: 1327865
description:
Jan  2 04:23:51 host2 sshd[3732496]: Disconnected from invalid user flora 136.228.161.66 port 59096 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.1.162
country_id: 690791
description:
Jan  2 04:23:58 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<charanaw>, method=PLAIN, rip=176.103.1.162, lip=66.85.158.91, TLS, session=<2jfhdltHspSwZwGi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.80
country_id: 2328926
description:
Jan  2 04:25:07 host2 sshd[3734317]: Disconnected from invalid user flora 102.88.137.80 port 33717 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 04:25:08 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<AT7pe1tHpOMv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.199.224.52
country_id: 357994
description:
Jan  2 04:24:44 host2 sshd[3733528]: Disconnected from invalid user david 197.199.224.52 port 57042 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 136.228.161.66
country_id: 1327865
description:
Jan  2 04:25:05 host2 sshd[3734269]: Disconnected from invalid user webadm 136.228.161.66 port 51640 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  2 04:26:17 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<23f1f1tH9pR100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.22.203
country_id: 1819730
description:
Jan  2 04:26:31 host2 sshd[3736706]: Disconnected from invalid user carlos 154.221.22.203 port 58474 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 136.228.161.66
country_id: 1327865
description:
Jan  2 04:25:42 host2 sshd[3735423]: Disconnected from invalid user apagar 136.228.161.66 port 33806 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.44.190.194
country_id: 3625428
description:
Jan  2 04:25:48 host2 sshd[3735667]: Disconnected from invalid user ftptest 200.44.190.194 port 47036 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.123.109.114
country_id: 732800
description:
Jan  2 04:26:12 host2 sshd[3736311]: Invalid user sivagnanamfoundation from 93.123.109.114 port 48992


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.80
country_id: 2328926
description:
Jan  2 04:27:04 host2 sshd[3737303]: Disconnected from invalid user apagar 102.88.137.80 port 1343 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.6.215.53
country_id: 3469034
description:
Jan  2 04:26:41 host2 sshd[3736892]: Disconnected from invalid user dasusr1 69.6.215.53 port 46638 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 13.73.111.251
country_id: 2077456
description:
Jan  2 04:26:46 host2 sshd[3737002]: Disconnected from invalid user sysadmin 13.73.111.251 port 43092 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.44.190.194
country_id: 3625428
description:
Jan  2 04:26:55 host2 sshd[3737120]: Disconnected from invalid user glassfish 200.44.190.194 port 35728 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 13.73.111.251
country_id: 2077456
description:
Jan  2 04:27:38 host2 sshd[3738092]: Disconnected from invalid user steamcmd 13.73.111.251 port 36730 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.80
country_id: 2328926
description:
Jan  2 04:27:44 host2 sshd[3738192]: Disconnected from invalid user zimbra 102.88.137.80 port 1223 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.88.137.80
country_id: 2328926
description:
Jan  2 04:28:26 host2 sshd[3739181]: Disconnected from invalid user cc 102.88.137.80 port 1219 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.6.215.53
country_id: 3469034
description:
Jan  2 04:28:35 host2 sshd[3739496]: Disconnected from invalid user dave 69.6.215.53 port 37526 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.22.203
country_id: 1819730
description:
Jan  2 04:29:03 host2 sshd[3739948]: Disconnected from invalid user timemachine 154.221.22.203 port 43348 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  2 04:34:28 host2 pure-ftpd[3747865]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.57.220
country_id: 953987
description:
Jan  2 04:37:16 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=102.129.57.220, lip=66.85.158.91, TLS, session=<OlQfpltHiZtmgTnc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.137.25
country_id: 690791
description:
Jan  2 04:37:35 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=37.221.137.25, lip=66.85.158.91, TLS, session=<dpB1p1tHesol3YkZ>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 206.189.50.107
country_id: 2921044
description:
Jan  2 04:40:20 host2 pure-ftpd[3756230]: (?@206.189.50.107) [INFO] New connection from 206.189.50.107


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 46.101.199.14
country_id: 2921044
description:
Jan  2 04:40:22 host2 pure-ftpd[3756267]: (?@46.101.199.14) [INFO] New connection from 46.101.199.14


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  2 04:44:11 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<cdIDwFtHtp1nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  2 04:44:38 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<VqabwVtHHqln9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  2 04:47:25 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<tpeNy1tH2rWeRdGr>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  2 04:48:33 host2 sshd[3769000]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  2 04:49:11 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<ahHe0VtHxOOi8GQy>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 45.87.212.182
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 45.87.212.182: 250 connections per 30 seconds to 80 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 45.87.212.182
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 45.87.212.182: 480 connections per 30 seconds to 80 port.


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.123.109.114
country_id: 732800
description:
Jan  2 04:55:33 host2 sshd[3779214]: Invalid user sivagnanamfoundation from 93.123.109.114 port 37836


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.127
country_id: 6252001
description:
Jan  2 05:00:22 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.127, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Bs0C+ltHTONChJl/>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 168.138.173.243
country_id: 1880251
description:
Jan  2 05:00:37 host2 pure-ftpd[3785729]: (?@168.138.173.243) [INFO] New connection from 168.138.173.243


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 168.138.173.243
country_id: 1880251
description:
Jan  2 05:00:43 host2 pure-ftpd[3785806]: (?@168.138.173.243) [INFO] New connection from 168.138.173.243


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 168.138.173.243
country_id: 1880251
description:
Jan  2 05:00:42 host2 pure-ftpd[3785797]: (?@168.138.173.243) [INFO] New connection from 168.138.173.243


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 05:01:26 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<M82n/VtHutSeRdY+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 168.138.173.243
country_id: 1880251
description:
Jan  2 05:01:43 host2 pure-ftpd[3787044]: (?@168.138.173.243) [INFO] New connection from 168.138.173.243


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 168.138.173.243
country_id: 1880251
description:
Jan  2 05:01:42 host2 pure-ftpd[3787031]: (?@168.138.173.243) [INFO] New connection from 168.138.173.243


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  2 05:02:01 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<V9LD/1tHSLoFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 05:05:09 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<IBAEC1xHxmsjupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  2 05:05:52 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<2QltDVxHPUhniu0S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.153.56.174
country_id: 6252001
description:
Jan  2 05:07:35 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=148.153.56.174, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<DhXWE1xHVIyUmTiu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 05:09:23 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<1nUfGlxHMq4v/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  2 05:12:32 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<O+teJVxH0sieRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  2 05:14:58 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<eFcVLlxHPGZo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 05:20:18 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<tK4qQVxHSJKeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  2 05:21:33 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<WkalRVxHxhei8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 05:21:35 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<6tHKRVxHNJcjupN+>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  2 05:22:34 host2 sshd[3810828]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-02 05:21:56 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (causlaiker) [87.103.126.54]:42161: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 109.105.209.19
country_id: 2264397
description:
Jan  2 05:25:36 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=109.105.209.19, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ellFVFxHfZ9tadET>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  2 05:24:52 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<uE6HUVxH2uB100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  2 05:25:24 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<jlhoU1xHmp0vWBNS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 109.105.209.18
country_id: 2264397
description:
Jan  2 05:25:35 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low (no auth attempts in 0 secs): user=<>, rip=109.105.209.18, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<EtUyVFxH/4xtadES>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 109.105.209.19
country_id: 2264397
description:
Jan  2 05:25:33 host2 dovecot[3680762]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=109.105.209.19, lip=66.85.158.91, TLS, session=<sVAZVFxHNZxtadET>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 109.105.209.20
country_id: 2264397
description:
Jan  2 05:25:36 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=109.105.209.20, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<jq87VFxHLYVtadEU>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 89.218.69.66
country_id: 1522867
description:
Jan  2 05:25:41 host2 sshd[3814169]: Disconnected from invalid user agent 89.218.69.66 port 39817 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.74.199
country_id: 1819730
description:
Jan  2 05:24:46 host2 sshd[3813156]: Disconnected from invalid user clouduser 156.236.74.199 port 45122 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 109.105.209.17
country_id: 2264397
description:
Jan  2 05:25:34 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed: SSL_read failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=109.105.209.17, lip=66.85.158.91, TLS: SSL_read failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<KEsfVFxHtLltadER>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.218.69.66
country_id: 1522867
description:
Jan  2 05:27:23 host2 sshd[3815911]: Disconnected from invalid user devops 89.218.69.66 port 50848 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.27.36.4
country_id: 1643084
description:
Jan  2 05:28:22 host2 sshd[3816815]: Disconnected from invalid user ubuntu 103.27.36.4 port 35420 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.218.69.66
country_id: 1522867
description:
Jan  2 05:27:55 host2 sshd[3816334]: Disconnected from invalid user ftb 89.218.69.66 port 48540 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.27.36.4
country_id: 1643084
description:
Jan  2 05:29:37 host2 sshd[3818003]: Disconnected from invalid user alpha 103.27.36.4 port 38728 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.74.199
country_id: 1819730
description:
Jan  2 05:30:09 host2 sshd[3818561]: Disconnected from invalid user samuel 156.236.74.199 port 41504 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 05:31:34 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<8J+BaVxHLskv/AU1>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.236.74.199
country_id: 1819730
description:
Jan  2 05:32:26 host2 sshd[3820799]: Disconnected from invalid user fastuser 156.236.74.199 port 56820 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.185.86.25
country_id: 1880251
description:
Jan  2 05:32:30 host2 pure-ftpd[3820859]: (?@134.185.86.25) [INFO] New connection from 134.185.86.25


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 134.185.86.25
country_id: 1880251
description:
Jan  2 05:32:34 host2 pure-ftpd[3820934]: (?@134.185.86.25) [INFO] New connection from 134.185.86.25


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.74.199
country_id: 1819730
description:
Jan  2 05:31:51 host2 sshd[3820222]: Disconnected from invalid user dashuai 156.236.74.199 port 48670 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.183.74.130
country_id: 1643084
description:
Jan  2 05:31:56 host2 sshd[3820269]: Disconnected from invalid user user1 103.183.74.130 port 41094 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  2 05:33:31 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<TIdtcFxHmsxCdMzo>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.185.86.25
country_id: 1880251
description:
Jan  2 05:32:44 host2 pure-ftpd[3821077]: (?@134.185.86.25) [INFO] New connection from 134.185.86.25


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 134.185.86.25
country_id: 1880251
description:
Jan  2 05:32:46 host2 pure-ftpd[3821118]: (?@134.185.86.25) [INFO] New connection from 134.185.86.25


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 134.185.86.25
country_id: 1880251
description:
Jan  2 05:33:47 host2 pure-ftpd[3822422]: (?@134.185.86.25) [INFO] New connection from 134.185.86.25


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.185.86.25
country_id: 1880251
description:
Jan  2 05:33:44 host2 pure-ftpd[3822364]: (?@134.185.86.25) [INFO] New connection from 134.185.86.25


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Jan  2 05:35:14 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<PY2adlxHSIaYNcU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.115
country_id: 6252001
description:
Jan  2 05:36:52 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.236.228.115, lip=66.85.158.92, TLS, session=<wWGRfFxHkEys7ORz>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  2 05:36:59 host2 pure-ftpd[3825673]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  2 05:39:47 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<eIzdhlxHos0yBsPO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  2 05:43:08 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<DELPklxH/q1n9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  2 05:48:17 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<g/VDpVxHkM+i8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2026-01-02 05:49:31 dovecot_login authenticator failed for H=([24.105.248.218]) [24.105.248.218]:41614: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.10.138
country_id: 1168579
description:
2026-01-02 05:49:52 dovecot_login authenticator failed for H=(203-128-10-138.braintel.net.pk) [203.128.10.138]:40050: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  2 05:56:24 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<tONCwlxHyNRnmud6>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 209.38.249.77
country_id: 2921044
description:
Jan  2 05:56:35 host2 pure-ftpd[3847988]: (?@209.38.249.77) [INFO] New connection from 209.38.249.77


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 209.38.222.129
country_id: 2921044
description:
Jan  2 05:56:37 host2 pure-ftpd[3848025]: (?@209.38.222.129) [INFO] New connection from 209.38.222.129


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.142.110.144
country_id: 2635167
description:
Jan  2 05:58:08 host2 sshd[3849595]: Disconnected from invalid user newuser 34.142.110.144 port 44190 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  2 06:00:25 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<LHOe0FxHMihniu0S>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.142.110.144
country_id: 2635167
description:
Jan  2 06:01:06 host2 sshd[3852706]: Disconnected from invalid user qwe 34.142.110.144 port 36400 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.142.110.144
country_id: 2635167
description:
Jan  2 06:00:36 host2 sshd[3852234]: Disconnected from invalid user satya 34.142.110.144 port 53342 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.142.110.144
country_id: 2635167
description:
Jan  2 06:01:36 host2 sshd[3853190]: Disconnected from invalid user mysftp 34.142.110.144 port 47686 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 06:02:05 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<t7qW1lxHUsyeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.232.165.183
country_id: 798544
description:
Jan  2 06:02:21 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=91.232.165.183, lip=66.85.158.91, TLS, session=<Fri61lxHAdxb6KW3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.34.224.247
country_id: 3175395
description:
Jan  2 06:03:25 host2 sshd[3855187]: Disconnected from invalid user runner 151.34.224.247 port 33219 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.186.40.250
country_id: 3895114
description:
Jan  2 06:02:30 host2 sshd[3854081]: Disconnected from invalid user user 201.186.40.250 port 53786 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.67.155.150
country_id: 298795
description:
Jan  2 06:02:40 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<charanaw>, method=PLAIN, rip=45.67.155.150, lip=66.85.158.91, TLS, session=<p+3M11xHBbwtQ5uW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.26.79
country_id: 1269750
description:
Jan  2 06:03:54 host2 sshd[3855663]: Disconnected from invalid user ubuntu 139.59.26.79 port 44410 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.186.40.250
country_id: 3895114
description:
Jan  2 06:04:03 host2 sshd[3855866]: Disconnected from invalid user 2 201.186.40.250 port 53532 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.213
country_id: 2328926
description:
Jan  2 06:04:21 host2 sshd[3856206]: Disconnected from invalid user es 102.88.137.213 port 49838 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.165.26
country_id: 1643084
description:
Jan  2 06:03:38 host2 sshd[3855390]: Disconnected from invalid user satya 103.187.165.26 port 44830 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.165.26
country_id: 1643084
description:
Jan  2 06:05:06 host2 sshd[3857074]: Disconnected from invalid user mata 103.187.165.26 port 46042 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.186.40.250
country_id: 3895114
description:
Jan  2 06:04:46 host2 sshd[3856602]: Disconnected from invalid user website 201.186.40.250 port 39280 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.88.137.213
country_id: 2328926
description:
Jan  2 06:05:41 host2 sshd[3857918]: Disconnected from invalid user raghu 102.88.137.213 port 49758 [preauth]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 159.203.117.74
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 159.203.117.74: 250 connections per 30 seconds to 80 port.


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.3
country_id: 798549
description:
Jan  2 06:05:50 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.3, lip=66.85.158.92, session=<zlci5FxHEMZV2ZUD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.145.122.196
country_id: 3175395
description:
2026-01-02 06:07:02 dovecot_login authenticator failed for H=([82.145.122.196]) [82.145.122.196]:52946: 535 Incorrect authentication data (set_id=contact@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.238.252.46
country_id: 241170
description:
2026-01-02 06:07:15 dovecot_login authenticator failed for H=([156.238.252.46]) [156.238.252.46]:60928: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.213
country_id: 2328926
description:
Jan  2 06:06:59 host2 sshd[3859188]: Disconnected from invalid user ubuntu 102.88.137.213 port 49712 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.34.224.247
country_id: 3175395
description:
Jan  2 06:07:37 host2 sshd[3859997]: Disconnected from invalid user botuser 151.34.224.247 port 33902 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 06:08:22 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<aXMX7VxH0KsjupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.120
country_id: 6252001
description:
Jan  2 06:08:31 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.120, lip=66.85.158.92, TLS, session=<7Cu77VxHeOSTuYR4>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.34.224.247
country_id: 3175395
description:
Jan  2 06:09:31 host2 sshd[3861934]: Disconnected from invalid user bot 151.34.224.247 port 33043 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.118.183.156
country_id: 3865483
description:
Jan  2 06:09:32 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=181.118.183.156, lip=66.85.158.91, TLS, session=<FVFH8FxHSdK1drec>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.12.73.231
country_id: 690791
description:
Jan  2 06:09:50 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=194.12.73.231, lip=66.85.158.91, TLS, session=<SmJ58VxHus3CDEnn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.123.109.114
country_id: 732800
description:
Jan  2 06:09:54 host2 sshd[3862311]: Invalid user sivagnanamfoundation from 93.123.109.114 port 35324


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.14
country_id: 241170
description:
Jan  2 06:11:29 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.14, lip=66.85.158.91, session=<dEs1+FxHFNzE+2YO>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 31.171.152.138
country_id: 783754
description:
Jan  2 06:10:50 host2 pure-ftpd[3863523]: (?@31.171.152.138) [INFO] New connection from 31.171.152.138


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 154.47.16.244
country_id: 3686110
description:
Jan  2 06:10:53 host2 dovecot[3680762]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=154.47.16.244, lip=66.85.158.91, session=<qpcv9lxHxJiaLxD0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.132.194.26
country_id: 597427
description:
Jan  2 06:10:53 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=45.132.194.26, lip=66.85.158.91, session=<ypEz9lxHuJgthMIa>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 154.47.23.3
country_id: 1861060
description:
Jan  2 06:15:41 host2 dovecot[3680762]: imap-login: Disconnected: Input buffer full (disconnected before auth was ready, waited 0 secs): user=<>, rip=154.47.23.3, lip=66.85.158.91, session=<S2dcB11HkraaLxcD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 98.159.41.5
country_id: 1327865
description:
Jan  2 06:15:41 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=98.159.41.5, lip=66.85.158.91, session=<YKlhB11HirZinykF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 06:16:25 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<+hjgCV1HerQv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 06:21:09 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<On3LGl1HPpqeRdY+>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 167.172.239.37
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 167.172.239.37: 250 connections per 30 seconds to 80 port.


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.90.126.158
country_id: 3703430
description:
Jan  2 06:22:41 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.90.126.158, lip=66.85.158.91, session=<7fxmIF1HUJhbWn6e>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.233.163
country_id: 2993457
description:
Jan  2 06:22:41 host2 dovecot[3680762]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=95.181.233.163, lip=66.85.158.91, session=<hwVkIF1HWJhftemj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  2 06:23:20 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<cEGSIl1HoPui8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  2 06:23:50 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<7jtlJF1HNLEFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  2 06:24:09 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=</vOMJV1HtsZ100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.34.224.247
country_id: 3175395
description:
Jan  2 06:24:18 host2 sshd[3878777]: Disconnected from invalid user bitwarden 151.34.224.247 port 33147 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.123.109.114
country_id: 732800
description:
Jan  2 06:24:35 host2 sshd[3879055]: Invalid user sivagnanamfoundation from 93.123.109.114 port 48224


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 06:25:03 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<Fdy+KF1HBlQjupN+>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.70.244.98
country_id: 2782113
description:
[2026-01-02 06:27:39 +0530] info [cpaneld] 146.70.244.98 - kamechot "POST /login?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2026-01-02 06:29:09 dovecot_plain authenticator failed for H=c-71-235-225-181.hsd1.ct.comcast.net (mencisted) [71.235.225.181]:41232: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.8.127.134
country_id: 1269750
description:
Jan  2 06:30:30 host2 sshd[3885884]: Disconnected from invalid user admin 202.8.127.134 port 53926 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.144
country_id: 6252001
description:
Jan  2 06:31:46 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.144, lip=66.85.158.92, TLS, session=<YofpQF1HmvzN0h+Q>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2026-01-02 06:32:23 dovecot_plain authenticator failed for H=(relly) [65.20.129.28]:40945: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.203.0
country_id: 1880251
description:
Jan  2 06:32:25 host2 sshd[3888197]: Disconnected from invalid user crawl 152.42.203.0 port 48152 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.167.90.67
country_id: 3508796
description:
Jan  2 06:32:36 host2 sshd[3888408]: Disconnected from invalid user ahmed 190.167.90.67 port 52971 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.154.2.19
country_id: 1814991
description:
Jan  2 06:32:31 host2 sshd[3888283]: Disconnected from invalid user wy 8.154.2.19 port 33664 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-02 06:34:17 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:49724: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.8.127.134
country_id: 1269750
description:
Jan  2 06:33:34 host2 sshd[3889645]: Disconnected from invalid user david 202.8.127.134 port 56240 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2026-01-02 06:34:03 dovecot_plain authenticator failed for H=c-73-168-136-150.hsd1.il.comcast.net (subale) [73.168.136.150]:49742: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.93.42.149
country_id: 1269750
description:
2026-01-02 06:34:02 dovecot_login authenticator failed for H=149.42.93.34.bc.googleusercontent.com (10.160.0.2) [34.93.42.149]:51705: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 8.154.2.19
country_id: 1814991
description:
Jan  2 06:35:00 host2 sshd[3891505]: Disconnected from invalid user testusr 8.154.2.19 port 50268 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.203.0
country_id: 1880251
description:
Jan  2 06:35:08 host2 sshd[3891873]: Disconnected from invalid user sdc 152.42.203.0 port 54570 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  2 06:35:58 host2 sshd[3892959]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.154.2.19
country_id: 1814991
description:
Jan  2 06:36:09 host2 sshd[3893170]: Disconnected from invalid user linus 8.154.2.19 port 48484 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.8.127.134
country_id: 1269750
description:
Jan  2 06:36:15 host2 sshd[3893270]: Disconnected from invalid user teamspeak 202.8.127.134 port 46820 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.10.98
country_id: 6252001
description:
Jan  2 06:35:57 host2 sshd[3892923]: Disconnected from invalid user lisi 107.173.10.98 port 52032 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.167.90.67
country_id: 3508796
description:
Jan  2 06:37:10 host2 sshd[3894424]: Disconnected from invalid user ss 190.167.90.67 port 38049 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.104.89
country_id: 6252001
description:
Jan  2 06:37:11 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.64.104.89, lip=66.85.158.91, session=<qQs9VF1HlNcUQGhZ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.203.0
country_id: 1880251
description:
Jan  2 06:37:12 host2 sshd[3894463]: Disconnected from invalid user teamspeak 152.42.203.0 port 53696 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.21.178
country_id: 1880251
description:
Jan  2 06:36:37 host2 sshd[3893735]: Disconnected from invalid user denis 103.210.21.178 port 50748 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 86.54.42.252
country_id: 241170
description:
Jan  2 06:37:36 host2 sshd[3894907]: Disconnected from invalid user crawl 86.54.42.252 port 49186 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.247.111.70
country_id: 1269750
description:
Jan  2 06:37:33 host2 sshd[3894821]: Disconnected from invalid user vpn 117.247.111.70 port 12418 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.42.203.0
country_id: 1880251
description:
Jan  2 06:37:53 host2 sshd[3895172]: Disconnected from invalid user user 152.42.203.0 port 41330 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.167.90.67
country_id: 3508796
description:
Jan  2 06:38:11 host2 sshd[3895534]: Disconnected from invalid user testuser 190.167.90.67 port 51370 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.130.227.106
country_id: 1512440
description:
Jan  2 06:38:46 host2 sshd[3896123]: Disconnected from invalid user team1 95.130.227.106 port 40204 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.21.178
country_id: 1880251
description:
Jan  2 06:38:52 host2 sshd[3896269]: Disconnected from invalid user orca 103.210.21.178 port 47568 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.203.0
country_id: 1880251
description:
Jan  2 06:39:09 host2 sshd[3896578]: Disconnected from invalid user ali 152.42.203.0 port 35352 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.123.109.114
country_id: 732800
description:
Jan  2 06:39:18 host2 sshd[3896792]: Invalid user sivagnanamfoundation from 93.123.109.114 port 46132


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.247.111.70
country_id: 1269750
description:
Jan  2 06:39:24 host2 sshd[3896876]: Disconnected from invalid user openkm 117.247.111.70 port 63728 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 86.54.42.252
country_id: 241170
description:
Jan  2 06:38:37 host2 sshd[3896013]: Disconnected from invalid user smart 86.54.42.252 port 34226 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 06:38:53 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<nis3Wl1HhKsv/AU1>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 86.54.42.252
country_id: 241170
description:
Jan  2 06:39:06 host2 sshd[3896543]: Received disconnect from 86.54.42.252 port 45738:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.167.90.67
country_id: 3508796
description:
Jan  2 06:39:09 host2 sshd[3896607]: Disconnected from invalid user vpn 190.167.90.67 port 37967 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  2 06:39:29 host2 pure-ftpd[3896962]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.210.21.178
country_id: 1880251
description:
Jan  2 06:40:00 host2 sshd[3897510]: Disconnected from invalid user admin 103.210.21.178 port 39312 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.167.90.67
country_id: 3508796
description:
Jan  2 06:40:06 host2 sshd[3897781]: Disconnected from invalid user develop 190.167.90.67 port 52343 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.250.188
country_id: 1562822
description:
Jan  2 06:39:29 host2 sshd[3896927]: Disconnected from invalid user jules 152.32.250.188 port 60020 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  2 06:41:20 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<AkXvYl1Hhtlo7MS0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.247.111.70
country_id: 1269750
description:
Jan  2 06:40:38 host2 sshd[3898367]: Disconnected from invalid user ahmed 117.247.111.70 port 22361 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.10.98
country_id: 6252001
description:
Jan  2 06:41:56 host2 sshd[3899732]: Disconnected from invalid user sanjay 107.173.10.98 port 3418 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.130.227.106
country_id: 1512440
description:
Jan  2 06:42:20 host2 sshd[3900345]: Disconnected from invalid user uploader 95.130.227.106 port 60282 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  2 06:41:52 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<7yLYZF1HMM1n9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.10.98
country_id: 6252001
description:
Jan  2 06:43:56 host2 sshd[3901943]: Disconnected from invalid user sistema 107.173.10.98 port 7800 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.173.10.98
country_id: 6252001
description:
Jan  2 06:46:45 host2 sshd[3905351]: Disconnected from invalid user soporte 107.173.10.98 port 38486 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.10.98
country_id: 6252001
description:
Jan  2 06:47:51 host2 sshd[3906847]: Disconnected from invalid user vikas 107.173.10.98 port 4012 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  2 06:47:32 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<jNAqeV1HTtii8GQy>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.49
country_id: 6252001
description:
Jan  2 06:51:07 host2 pure-ftpd[3910521]: (?@205.210.31.49) [INFO] New connection from 205.210.31.49


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.123.109.114
country_id: 732800
description:
Jan  2 06:54:21 host2 sshd[3913998]: Invalid user sivagnanamfoundation from 93.123.109.114 port 59154


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  2 06:55:15 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<pgnBlF1Hswlniu0S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.36
country_id: 6252001
description:
Jan  2 06:55:14 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.36, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<USTVlF1Hns7G6xgk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.12
country_id: 241170
description:
Jan  2 06:58:53 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.12, lip=66.85.158.91, session=<7MK7oV1H5pzE+2YM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 07:03:18 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<5hyNsV1H7IWeRdY+>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.70.244.90
country_id: 2782113
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 146.70.244.90 - kamechot "POST /login?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  2 07:03:32 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<hRhksl1HpslCdMzo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  2 07:06:08 host2 sshd[3926953]: Disconnected from invalid user admin 2.57.121.112 port 58376 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  2 07:06:48 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<ZBAUvl1HQKUvWBNS>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  2 07:10:19 host2 sshd[3931542]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  2 07:09:53 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<IJELyV1H7MFnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 07:11:54 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<qllT0F1HqG0jupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.3.43.242
country_id: 1269750
description:
Jan  2 07:12:32 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<marketing@lezzarotech.com>, method=PLAIN, rip=103.3.43.242, lip=66.85.158.91, TLS, session=<8YVs0V1HhtFnAyvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 73.128.151.92
country_id: 6252001
description:
Jan  2 07:12:50 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<marketing>, method=PLAIN, rip=73.128.151.92, lip=66.85.158.91, TLS, session=<rYm90l1H1olJgJdc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.191
country_id: 3996063
description:
2026-01-02 07:17:03 dovecot_login authenticator failed for H=([177.236.146.191]) [177.236.146.191]:35121: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 218.190.8.165
country_id: 1819730
description:
Jan  2 07:17:55 host2 sshd[3940019]: Disconnected from invalid user hasan 218.190.8.165 port 60116 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  2 07:19:13 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<test@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<EPJO6l1HOI+eRdGr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 218.190.8.165
country_id: 1819730
description:
Jan  2 07:19:55 host2 sshd[3942433]: Disconnected from invalid user ubuntu 218.190.8.165 port 58318 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  2 07:20:13 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<L0EC7l1HVK4yBsPO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.223.91.130
country_id: 6252001
description:
Jan  2 07:20:39 host2 sshd[3943446]: Disconnected from invalid user newuser 162.223.91.130 port 37308 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 218.190.8.165
country_id: 1819730
description:
Jan  2 07:21:13 host2 sshd[3944072]: Disconnected from invalid user grid 218.190.8.165 port 53924 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.31.197.108
country_id: 6252001
description:
2026-01-02 07:22:26 dovecot_login authenticator failed for H=(173-31-197-108.client.mchsi.com) [173.31.197.108]:43666: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.223.91.130
country_id: 6252001
description:
Jan  2 07:21:46 host2 sshd[3944641]: Disconnected from invalid user username 162.223.91.130 port 33930 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 218.190.8.165
country_id: 1819730
description:
Jan  2 07:21:49 host2 sshd[3944673]: Disconnected from invalid user wg 218.190.8.165 port 37610 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.223.91.130
country_id: 6252001
description:
Jan  2 07:22:46 host2 sshd[3945669]: Disconnected from invalid user low 162.223.91.130 port 58786 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 07:22:33 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<z9lg9l1HxuyeRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
country_id: 6252001
description:
2026-01-02 07:22:38 dovecot_login authenticator failed for H=([67.213.230.122]) [67.213.230.122]:47304: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  2 07:23:30 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<99PC+V1HnbN100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 07:23:42 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<yFd0+l1Hrtgv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.253.205
country_id: 1819730
description:
Jan  2 07:24:46 host2 sshd[3947532]: Disconnected from invalid user python 152.32.253.205 port 59834 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  2 07:25:58 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<9XGYAl5Hsuui8Jp9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.212.247
country_id: 6252001
description:
Jan  2 07:26:03 host2 sshd[3948924]: Disconnected from invalid user user01 162.240.212.247 port 35404 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  2 07:25:29 host2 sshd[3948338]: Disconnected from invalid user user 2.57.121.25 port 34608 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.212.247
country_id: 6252001
description:
Jan  2 07:26:47 host2 sshd[3949653]: Disconnected from invalid user devops 162.240.212.247 port 50114 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.240.212.247
country_id: 6252001
description:
Jan  2 07:27:25 host2 sshd[3950283]: Disconnected from invalid user ftb 162.240.212.247 port 35704 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 07:28:32 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<sVvOC15H+q4jupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 70.54.182.130
country_id: 6251999
description:
Jan  2 07:29:18 host2 sshd[3952245]: Disconnected from invalid user devops 70.54.182.130 port 54104 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.101.216.74
country_id: 1643084
description:
Jan  2 07:30:34 host2 sshd[3953541]: Disconnected from invalid user owner 103.101.216.74 port 57434 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.249.55.106
country_id: 2017370
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 89.249.55.106 - greentar "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user greentar (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.101.216.74
country_id: 1643084
description:
Jan  2 07:31:53 host2 sshd[3954740]: Disconnected from invalid user user 103.101.216.74 port 52308 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.196
country_id: 6252001
description:
Jan  2 07:33:04 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=184.105.247.196, lip=66.85.158.91, session=<qeIWHF5HxJS4affE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.196
country_id: 6252001
description:
Jan  2 07:33:32 host2 dovecot[3680762]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=184.105.247.196, lip=66.85.158.91, session=<lIPDHV5HLia4affE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 70.54.182.130
country_id: 6251999
description:
Jan  2 07:34:40 host2 sshd[3957819]: Disconnected from invalid user user1 70.54.182.130 port 54504 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.195.138.37
country_id: 3017382
description:
Jan  2 07:35:37 host2 sshd[3958923]: Disconnected from invalid user comfort 51.195.138.37 port 60184 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Jan  2 07:35:50 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<KjbYJV5HHKeYNcU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-01-02 07:36:26 dovecot_plain authenticator failed for H=(gragic) [24.187.213.29]:43484: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.156.243.35
country_id: 1605651
description:
Jan  2 07:36:37 host2 sshd[3960062]: Disconnected from invalid user sk 124.156.243.35 port 53750 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 70.54.182.130
country_id: 6251999
description:
Jan  2 07:37:20 host2 sshd[3961204]: Disconnected from invalid user es 70.54.182.130 port 55596 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.119
country_id: 3017382
description:
Jan  2 07:38:11 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.231.89.119, lip=66.85.158.91, TLS handshaking: Connection closed, session=<NLpuLl5HX8Vb51l3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.115
country_id: 3017382
description:
Jan  2 07:38:22 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.231.89.115, lip=66.85.158.91, TLS: Connection closed, session=</eEQL15HfaBb51lz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.201
country_id: 3017382
description:
Jan  2 07:38:36 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.231.89.201, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<cETvL15HLaRb51nJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.113
country_id: 3017382
description:
Jan  2 07:38:40 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.231.89.113, lip=66.85.158.91, TLS: Connection closed, session=<u14fMF5HWe1b51lx>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 70.54.182.130
country_id: 6251999
description:
Jan  2 07:39:49 host2 sshd[3963667]: Disconnected from invalid user proxyuser 70.54.182.130 port 48818 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  2 07:40:16 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<+gy6NV5HqsJn9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.156.243.35
country_id: 1605651
description:
Jan  2 07:39:43 host2 sshd[3963572]: Disconnected from invalid user james 124.156.243.35 port 48744 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.226.27.227
country_id: 294640
description:
2026-01-02 07:40:41 dovecot_plain authenticator failed for H=(clized) [109.226.27.227]:46415: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.195.138.37
country_id: 3017382
description:
Jan  2 07:40:50 host2 sshd[3964732]: Disconnected from invalid user ron 51.195.138.37 port 42808 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.156.243.35
country_id: 1605651
description:
Jan  2 07:41:05 host2 sshd[3964968]: Disconnected from invalid user downloader 124.156.243.35 port 56832 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  2 07:42:10 host2 pure-ftpd[3966075]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.156.243.35
country_id: 1605651
description:
Jan  2 07:42:20 host2 sshd[3966251]: Disconnected from invalid user luser 124.156.243.35 port 48316 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.208
country_id: 6252001
description:
Jan  2 07:41:44 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.208, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<NtkjO15HL8fG6xjQ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.195.138.37
country_id: 3017382
description:
Jan  2 07:41:52 host2 sshd[3965747]: Disconnected from invalid user db 51.195.138.37 port 53098 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.156.243.35
country_id: 1605651
description:
Jan  2 07:43:33 host2 sshd[3967760]: Disconnected from invalid user ftp_user 124.156.243.35 port 34634 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.171.85.124
country_id: 1643084
description:
Jan  2 07:44:06 host2 sshd[3968393]: Disconnected from invalid user ftp_user 103.171.85.124 port 59518 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.124
country_id: 1643084
description:
Jan  2 07:44:51 host2 sshd[3969138]: Disconnected from invalid user mobiquity 103.171.85.124 port 52724 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.47.10.77
country_id: 3469034
description:
Jan  2 07:45:11 host2 sshd[3969713]: Disconnected from invalid user ftb 189.47.10.77 port 46588 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  2 07:45:17 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<j4KfR15HusKeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 07:46:27 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<JirfS15HtoMv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  2 07:47:03 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<CdT+TV5HMoMFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  2 07:47:10 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<iXJgTl5HKLai8GQy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.126
country_id: 3017382
description:
Jan  2 07:47:12 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=91.196.152.126, lip=66.85.158.91, TLS handshaking: Connection closed, session=<r2+iTl5HSZBbxJh+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.38
country_id: 3017382
description:
Jan  2 07:47:22 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.196.152.38, lip=66.85.158.91, TLS: Connection closed, session=<PDFGT15HH95bxJgm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.32
country_id: 3017382
description:
Jan  2 07:47:35 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.196.152.32, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<jZoGUF5Hi5xbxJgg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.122
country_id: 3017382
description:
Jan  2 07:47:38 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.122, lip=66.85.158.91, TLS: Connection closed, session=<R5c2UF5HWeFbxJh6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.194.117
country_id: 6252001
description:
Jan  2 07:49:21 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.65.194.117, lip=66.85.158.92, session=</H9ZVl5H9N8UQcJ1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  2 07:49:54 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<KIYxWF5HgzNniu0S>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.47.10.77
country_id: 3469034
description:
Jan  2 07:50:54 host2 sshd[3977402]: Disconnected from invalid user adminuser 189.47.10.77 port 59588 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.47.10.77
country_id: 3469034
description:
Jan  2 07:52:32 host2 sshd[3979155]: Disconnected from invalid user artem 189.47.10.77 port 50856 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.132.127.172
country_id: 2750405
description:
Jan  2 08:04:35 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=5.132.127.172, lip=66.85.158.91, session=<k1+ZjF5HBIYFhH+s>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 08:05:06 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<aHSPjl5HYN6eRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-02 08:06:34 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (nonater) [87.103.126.54]:4782: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  2 08:09:46 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<FvNBn15HXJNo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.214.20.142
country_id: 2077456
description:
2026-01-02 08:10:59 dovecot_plain authenticator failed for H=([192.168.1.5]) [103.214.20.142]:50963: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 08:15:42 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<EWp+tF5HVmMjupN+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.185.86.25
country_id: 1880251
description:
Jan  2 08:16:39 host2 pure-ftpd[4006811]: (?@134.185.86.25) [INFO] New connection from 134.185.86.25


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 134.185.86.25
country_id: 1880251
description:
Jan  2 08:16:43 host2 pure-ftpd[4006897]: (?@134.185.86.25) [INFO] New connection from 134.185.86.25


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.185.86.25
country_id: 1880251
description:
Jan  2 08:17:30 host2 pure-ftpd[4007973]: (?@134.185.86.25) [INFO] New connection from 134.185.86.25


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 134.185.86.25
country_id: 1880251
description:
Jan  2 08:17:32 host2 pure-ftpd[4008010]: (?@134.185.86.25) [INFO] New connection from 134.185.86.25


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  2 08:22:18 host2 sshd[4013396]: Disconnected from invalid user admin 2.57.121.112 port 65329 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  2 08:23:00 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<G+KLzl5HXLFnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  2 08:23:33 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<biiL0F5HjTt100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 08:24:26 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<8Cqx015HotKeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  2 08:28:01 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<KL2A4F5HGBii8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 08:31:24 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<SLKg7F5HTs8v/AU1>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 213.176.19.20
country_id: 2017370
description:
Jan  2 08:30:35 host2 pure-ftpd[4022321]: (?@213.176.19.20) [INFO] New connection from 213.176.19.20


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 08:32:24 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<MGEq8F5HOIIjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  2 08:34:24 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<GSBX915HFJJCdMzo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.187
country_id: 6252001
description:
Jan  2 08:36:27 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=147.185.133.187, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<CRHL/l5Ho8+TuYW7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.187
country_id: 6252001
description:
Jan  2 08:37:04 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 23 secs): user=<>, rip=147.185.133.187, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=</YYCAV9HdPGTuYW7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.187
country_id: 6252001
description:
Jan  2 08:37:51 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 17 secs): user=<>, rip=147.185.133.187, lip=66.85.158.91, TLS: read(size=429) failed: Connection reset by peer, session=<01DSA19HuPSTuYW7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  2 08:37:55 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<ZevnA19Hospn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  2 08:44:09 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<WXY1Gl9HsBVniu0S>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  2 08:44:52 host2 pure-ftpd[4037608]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.187
country_id: 6252001
description:
Jan  2 08:45:00 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.187, lip=66.85.158.91, TLS, session=<nUllHV9HNPiTuYW7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.187
country_id: 6252001
description:
Jan  2 08:45:36 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.133.187, lip=66.85.158.91, TLS, session=<WSeBH19HquiTuYW7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  2 08:47:04 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<ksGYJF9HJMCi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  2 08:49:35 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<NmCeLV9HTK8vWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 08:53:59 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<ftpcPV9HtLcv/AU1>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.11.89.19
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 45.11.89.19 - kamechot "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  2 08:54:34 host2 sshd[4050140]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  2 09:00:05 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<YMEzU19H6rMyBsPO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.250.11.116
country_id: 1643084
description:
Jan  2 09:00:12 host2 sshd[4056312]: Disconnected from invalid user admin 103.250.11.116 port 57264 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.65.172.46
country_id: 6252001
description:
[2026-01-02 09:03:42 +0530] info [cpaneld] 159.65.172.46 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.250.11.116
country_id: 1643084
description:
Jan  2 09:04:38 host2 sshd[4060950]: Disconnected from invalid user ubuntu 103.250.11.116 port 44612 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.250.11.116
country_id: 1643084
description:
Jan  2 09:06:05 host2 sshd[4062662]: Disconnected from invalid user root2 103.250.11.116 port 60928 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 34.27.42.6
country_id: 6252001
description:
[2026-01-02 09:06:35 +0530] info [cpaneld] 34.27.42.6 - vdeployc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vdeployc (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.250.11.116
country_id: 1643084
description:
Jan  2 09:06:49 host2 sshd[4063349]: Disconnected from invalid user testftp 103.250.11.116 port 46442 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 09:07:16 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<N6fhbF9H/NieRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.246.151
country_id: 1269750
description:
Jan  2 09:08:31 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=103.164.246.151, lip=66.85.158.91, TLS, session=<emghcF9H76lnpPaX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.199.195
country_id: 3469034
description:
Jan  2 09:08:52 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=179.189.199.195, lip=66.85.158.91, TLS, session=<lzOhcV9HINKzvcfD>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.225.112
country_id: 1880251
description:
Jan  2 09:11:11 host2 sshd[4068175]: Disconnected from invalid user jerry 139.59.225.112 port 41404 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  2 09:11:47 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<et8BfV9H8JYFhXlo>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 95.38.101.192
country_id: 130758
description:
Jan  2 09:15:08 host2 sshd[4072422]: Disconnected from invalid user teamspeak 95.38.101.192 port 56106 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.143
country_id: 6252001
description:
Jan  2 09:16:55 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.143, lip=66.85.158.92, TLS: Connection closed, session=<S5KHj19HyNFChJmP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.76.82.176
country_id: 2750405
description:
Jan  2 09:17:26 host2 sshd[4074768]: Disconnected from invalid user ts 20.76.82.176 port 12288 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.38.101.192
country_id: 130758
description:
Jan  2 09:16:43 host2 sshd[4074045]: Disconnected from invalid user ts3server 95.38.101.192 port 56228 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.76.82.176
country_id: 2750405
description:
Jan  2 09:18:03 host2 sshd[4075413]: Disconnected from invalid user michael 20.76.82.176 port 12289 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.89.143.86
country_id: 6252001
description:
Jan  2 09:18:27 host2 sshd[4075956]: Disconnected from invalid user asep 159.89.143.86 port 50432 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.76.82.176
country_id: 2750405
description:
Jan  2 09:19:21 host2 sshd[4076900]: Disconnected from invalid user git 20.76.82.176 port 12288 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 159.89.143.86
country_id: 6252001
description:
Jan  2 09:19:29 host2 sshd[4077007]: Disconnected from invalid user jon 159.89.143.86 port 41512 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 159.89.143.86
country_id: 6252001
description:
Jan  2 09:18:58 host2 sshd[4076455]: Received disconnect from 159.89.143.86 port 57276:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.89.143.86
country_id: 6252001
description:
Jan  2 09:18:58 host2 sshd[4076455]: Disconnected from invalid user jerry 159.89.143.86 port 57276 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.225.112
country_id: 1880251
description:
Jan  2 09:20:18 host2 sshd[4077996]: Disconnected from invalid user asep 139.59.225.112 port 42114 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.23.218.198
country_id: 2921044
description:
Jan  2 09:19:30 host2 sshd[4077035]: Disconnected from invalid user orange 193.23.218.198 port 51006 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 09:19:50 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<z+vZmV9HhH0jupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.51.227
country_id: 6252001
description:
Jan  2 09:22:10 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=157.230.51.227, lip=66.85.158.92, session=<yRtGol9HKh+d5jPj>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 157.230.51.227
country_id: 6252001
description:
Jan  2 09:22:10 host2 pure-ftpd[4079881]: (?@157.230.51.227) [INFO] New connection from 157.230.51.227


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.51.227
country_id: 6252001
description:
Jan  2 09:22:30 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=157.230.51.227, lip=66.85.158.92, TLS handshaking: Connection closed, session=<FAZ5o19H3MSd5jPj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.23.218.198
country_id: 2921044
description:
Jan  2 09:23:48 host2 sshd[4081767]: Disconnected from invalid user mumbleserver 193.23.218.198 port 34234 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  2 09:24:04 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<cPDrqF9HCbR100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.160.102.30
country_id: 3489940
description:
2026-01-02 09:24:19 dovecot_plain authenticator failed for H=(8HRKD1AKEBBNP) [69.160.102.30]:18050: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 193.23.218.198
country_id: 2921044
description:
Jan  2 09:24:22 host2 sshd[4082428]: Disconnected from invalid user test01 193.23.218.198 port 58262 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 170.64.227.24
country_id: 2077456
description:
Jan  2 09:24:48 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=170.64.227.24, lip=66.85.158.91, session=<t1i5q19H/haqQOMY>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 170.64.227.24
country_id: 2077456
description:
Jan  2 09:24:48 host2 pure-ftpd[4082887]: (?@170.64.227.24) [INFO] New connection from 170.64.227.24


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 170.64.227.24
country_id: 2077456
description:
Jan  2 09:25:30 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=170.64.227.24, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<lIs8rl9HbF6qQOMY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 09:26:41 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<Tv9Ssl9HGqWeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  2 09:30:39 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<oZOCwF9HQLqi8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-02 09:30:48 dovecot_login authenticator failed for H=(QnC8Cz) [69.5.189.21]:51374: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.51.227
country_id: 6252001
description:
Jan  2 09:30:54 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=157.230.51.227, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<g+iIwV9HOQOd5jPj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2026-01-02 09:31:44 dovecot_login authenticator failed for H=(CAeeFEeW) [69.5.189.21]:60018: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 170.64.227.24
country_id: 2077456
description:
Jan  2 09:33:42 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=170.64.227.24, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<wZ+Fy19HngOqQOMY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  2 09:36:16 host2 sshd[4097362]: Disconnected from invalid user admin 2.57.121.112 port 32074 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  2 09:36:27 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<z1k/1V9HFtdn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.161.96.107
country_id: 6252001
description:
2026-01-02 09:37:18 dovecot_plain authenticator failed for H=c-73-161-96-107.hsd1.mi.comcast.net (cemer) [73.161.96.107]:57370: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.98.45.238
country_id: 6252001
description:
2026-01-02 09:37:22 dovecot_plain authenticator failed for H=c-24-98-45-238.hsd1.ga.comcast.net (clatic) [24.98.45.238]:41734: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 09:36:32 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<s0mT1V9HbIcjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  2 09:36:43 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<bHov1l9Hjqxnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Jan  2 09:39:01 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<vLdx3l9HtL2YNcU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  2 09:39:17 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<eb5m319HAh1niu0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.227.236.175
country_id: 1861060
description:
Jan  2 09:39:19 host2 sshd[4100601]: Disconnected from invalid user anes 156.227.236.175 port 36708 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 09:39:22 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<s0us319Hmpcv/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.140.204.135
country_id: 3996063
description:
Jan  2 09:39:37 host2 sshd[4100899]: Disconnected from invalid user ubuntu 187.140.204.135 port 53318 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.30
country_id: 1819730
description:
Jan  2 09:39:43 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=45.142.154.30, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<ffgJ4V9Hgpotjpoe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  2 09:39:55 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<GoSp4V9Hqhto7MS0>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.140.204.135
country_id: 3996063
description:
Jan  2 09:40:55 host2 sshd[4102427]: Disconnected from invalid user ubuntu 187.140.204.135 port 52882 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.28.214
country_id: 1819730
description:
Jan  2 09:41:12 host2 sshd[4102765]: Disconnected from invalid user test 154.221.28.214 port 55950 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.140.204.135
country_id: 3996063
description:
Jan  2 09:41:31 host2 sshd[4103124]: Disconnected from invalid user sftpuser 187.140.204.135 port 38532 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.140.204.135
country_id: 3996063
description:
Jan  2 09:42:44 host2 sshd[4104384]: Disconnected from invalid user ubuntu 187.140.204.135 port 38058 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.227.236.175
country_id: 1861060
description:
Jan  2 09:44:30 host2 sshd[4106132]: Disconnected from invalid user odoo 156.227.236.175 port 51418 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.90.59.75
country_id: 1880251
description:
Jan  2 09:43:33 host2 sshd[4105220]: Disconnected from invalid user ubuntu 154.90.59.75 port 43962 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.188.192
country_id: 1269750
description:
Jan  2 09:43:37 host2 sshd[4105316]: Disconnected from invalid user miguel 64.227.188.192 port 57804 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.111.162.34
country_id: 2589581
description:
Jan  2 09:43:47 host2 sshd[4105457]: Disconnected from invalid user django 41.111.162.34 port 5256 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.227.188.192
country_id: 1269750
description:
Jan  2 09:45:29 host2 sshd[4107430]: Disconnected from invalid user minh 64.227.188.192 port 42738 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.188.192
country_id: 1269750
description:
Jan  2 09:44:51 host2 sshd[4106464]: Disconnected from invalid user sshuser 64.227.188.192 port 35246 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.111.162.34
country_id: 2589581
description:
Jan  2 09:45:52 host2 sshd[4107896]: Disconnected from invalid user dino 41.111.162.34 port 21148 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.28.214
country_id: 1819730
description:
Jan  2 09:46:22 host2 sshd[4108530]: Disconnected from invalid user chen 154.221.28.214 port 58344 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.111.162.34
country_id: 2589581
description:
Jan  2 09:46:57 host2 sshd[4109378]: Disconnected from invalid user www 41.111.162.34 port 50484 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.188.192
country_id: 1269750
description:
Jan  2 09:47:19 host2 sshd[4109838]: Disconnected from invalid user ubuntu 64.227.188.192 port 44188 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.90.59.75
country_id: 1880251
description:
Jan  2 09:46:40 host2 sshd[4109035]: Disconnected from invalid user minh 154.90.59.75 port 53054 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.227.236.175
country_id: 1861060
description:
Jan  2 09:46:54 host2 sshd[4109341]: Disconnected from invalid user admin 156.227.236.175 port 60534 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  2 09:47:33 host2 pure-ftpd[4110124]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-02 09:47:38 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:65456: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  2 09:47:42 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<py1+/V9Hfsei8GQy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.28.214
country_id: 1819730
description:
Jan  2 09:47:46 host2 sshd[4110364]: Disconnected from invalid user ftp01 154.221.28.214 port 38344 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.28.214
country_id: 1819730
description:
Jan  2 09:49:11 host2 sshd[4111804]: Disconnected from invalid user server1 154.221.28.214 port 50644 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.18
country_id: 2186224
description:
2026-01-02 09:50:53 dovecot_login authenticator failed for H=([121.73.163.18]) [121.73.163.18]:54886: 535 Incorrect authentication data (set_id=office@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.214.212
country_id: 3144096
description:
2026-01-02 09:51:03 dovecot_login authenticator failed for H=(cm-84.210.214.212.get.no) [84.210.214.212]:37040: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.221.28.214
country_id: 1819730
description:
Jan  2 09:51:12 host2 sshd[4114342]: Disconnected from invalid user jimmy 154.221.28.214 port 48780 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.88.196.91
country_id: 6252001
description:
2026-01-02 09:53:05 dovecot_plain authenticator failed for H=c-73-88-196-91.hsd1.ky.comcast.net (amiscer) [73.88.196.91]:59810: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  2 09:55:47 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<csthGmBHLOKeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 10:02:31 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<Rk16MmBHUKkv/AU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  2 10:03:33 host2 dovecot[3680762]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<JzlLNmBHAIYDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  2 10:06:25 host2 dovecot[3680762]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<ZyyGQGBHcLADjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  2 10:06:38 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<1t0sQWBHnrZCdMzo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  2 10:08:53 host2 dovecot[3680762]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<bPJZSWBH3uYDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 10:09:31 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<jHuCS2BH/uueRdY+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  2 10:10:57 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<ds+7UGBHDrwDjyE/>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.143.33.63
country_id: 6252001
description:
Jan  2 10:11:49 host2 dovecot[3680762]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<MIzWU2BH7LUDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.122.43.59
country_id: 3469034
description:
Jan  2 10:13:17 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=138.122.43.59, lip=66.85.158.91, TLS, session=<u8v1V2BHKrOKeis7>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.178.229.240
country_id: 1880251
description:
Jan  2 10:19:30 host2 pure-ftpd[4145787]: (?@158.178.229.240) [INFO] New connection from 158.178.229.240


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.202
country_id: 1269750
description:
2026-01-02 10:19:30 dovecot_login authenticator failed for H=(dsl-ncr-static-137.78.16.125.airtelbroadband.in) [182.95.123.202]:58026: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 158.178.229.240
country_id: 1880251
description:
Jan  2 10:19:34 host2 pure-ftpd[4145862]: (?@158.178.229.240) [INFO] New connection from 158.178.229.240


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.114
country_id: 1269750
description:
2026-01-02 10:19:44 dovecot_login authenticator failed for H=([182.95.25.142]) [182.95.61.114]:58356: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.178.229.240
country_id: 1880251
description:
Jan  2 10:19:57 host2 pure-ftpd[4146294]: (?@158.178.229.240) [INFO] New connection from 158.178.229.240


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 158.178.229.240
country_id: 1880251
description:
Jan  2 10:19:59 host2 pure-ftpd[4146372]: (?@158.178.229.240) [INFO] New connection from 158.178.229.240


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.248
country_id: 1733045
description:
2026-01-02 10:20:06 dovecot_login authenticator failed for H=([49.124.152.248]) [49.124.152.248]:54778: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.89.120.125
country_id: 3469034
description:
2026-01-02 10:20:22 dovecot_login authenticator failed for H=(190.89.120.125-fo-dyn.redeultranet.com.br) [190.89.120.125]:57222: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.178.229.240
country_id: 1880251
description:
Jan  2 10:20:57 host2 pure-ftpd[4147609]: (?@158.178.229.240) [INFO] New connection from 158.178.229.240


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 158.178.229.240
country_id: 1880251
description:
Jan  2 10:20:59 host2 pure-ftpd[4147653]: (?@158.178.229.240) [INFO] New connection from 158.178.229.240


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  2 10:22:46 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<Ae/WemBH0u2eRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 10:24:10 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<jQjkf2BH0GkjupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  2 10:25:17 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<tmzZg2BHnUJ100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 10:29:01 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<Y5U6kWBHupSeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  2 10:34:54 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=</2hHpmBHw0lniu0S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  2 10:34:05 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<Lo9To2BH2uSi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  2 10:34:32 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<K0n1pGBHRLwvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  2 10:35:43 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<9mowqWBHFu5n9M4G>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Jan  2 10:36:47 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.92, TLS: Connection closed, session=<4IklrWBHIpeLonHU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  2 10:38:02 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<XP5lsWBH1JkFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 10:41:04 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<MABSvGBH1okjupN+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.59.119.141
country_id: 3017382
description:
Jan  2 10:43:08 host2 sshd[4172829]: Disconnected from invalid user vboxuser 37.59.119.141 port 38022 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  2 10:43:36 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<ieRpxWBHco0yBsPO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.124.23.196
country_id: 3996063
description:
Jan  2 10:42:57 host2 sshd[4172651]: Disconnected from invalid user test 201.124.23.196 port 36553 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.227.147.163
country_id: 6252001
description:
Jan  2 10:45:06 host2 sshd[4175135]: Disconnected from invalid user ftptest 23.227.147.163 port 34934 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.12.41.6
country_id: 6252001
description:
Jan  2 10:45:20 host2 sshd[4175572]: Disconnected from invalid user lighthouse 20.12.41.6 port 44772 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.248.104.31
country_id: 192950
description:
Jan  2 10:45:25 host2 sshd[4175629]: Disconnected from invalid user demo 197.248.104.31 port 46770 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 23.227.147.163
country_id: 6252001
description:
Jan  2 10:47:33 host2 sshd[4178140]: Disconnected from invalid user dmdba 23.227.147.163 port 37300 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  2 10:47:58 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<omD41GBH7pKi8GQy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.227.147.163
country_id: 6252001
description:
Jan  2 10:48:04 host2 sshd[4178770]: Disconnected from invalid user master 23.227.147.163 port 43722 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.12.41.6
country_id: 6252001
description:
Jan  2 10:48:11 host2 sshd[4178928]: Disconnected from invalid user milos 20.12.41.6 port 45420 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 10:48:41 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<ejKU12BH5owv/AU1>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 23.227.147.163
country_id: 6252001
description:
Jan  2 10:49:05 host2 sshd[4180078]: Received disconnect from 23.227.147.163 port 39582:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 37.59.119.141
country_id: 3017382
description:
Jan  2 10:49:03 host2 sshd[4179984]: Disconnected from invalid user fedora 37.59.119.141 port 40420 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  2 10:49:56 host2 pure-ftpd[4181094]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.12.41.6
country_id: 6252001
description:
Jan  2 10:51:04 host2 sshd[4182494]: Disconnected from invalid user server 20.12.41.6 port 48322 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.248.104.31
country_id: 192950
description:
Jan  2 10:51:27 host2 sshd[4183014]: Disconnected from invalid user bitwarden 197.248.104.31 port 35076 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.10.252.119
country_id: 1643084
description:
Jan  2 10:51:33 host2 sshd[4183160]: Disconnected from invalid user bitwarden 157.10.252.119 port 38284 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  2 10:50:59 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<ndLJ32BHYKFnmud6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.44
country_id: 6252001
description:
Jan  2 10:51:24 host2 dovecot[3680762]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=162.216.150.44, lip=66.85.158.92, session=<+1xj4WBHMvGi2JYs>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.12.41.6
country_id: 6252001
description:
Jan  2 10:52:14 host2 sshd[4184160]: Disconnected from invalid user debian 20.12.41.6 port 37176 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.124.23.196
country_id: 3996063
description:
Jan  2 10:52:29 host2 sshd[4184483]: Disconnected from invalid user postgres 201.124.23.196 port 34830 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.10.252.119
country_id: 1643084
description:
Jan  2 10:53:03 host2 sshd[4185130]: Disconnected from invalid user factorio 157.10.252.119 port 50562 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.12.41.6
country_id: 6252001
description:
Jan  2 10:55:42 host2 sshd[4188616]: Disconnected from invalid user devops 20.12.41.6 port 40566 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.124.23.196
country_id: 3996063
description:
Jan  2 10:55:24 host2 sshd[4188341]: Disconnected from invalid user ts3server 201.124.23.196 port 59966 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.16
country_id: 241170
description:
Jan  2 11:00:23 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.16, lip=66.85.158.91, session=<yZxTAWFHVNzE+2YQ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.48.78.29
country_id: 3469034
description:
Jan  2 11:09:48 host2 sshd[11575]: Disconnected from invalid user admin1 201.48.78.29 port 55002 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.48.78.29
country_id: 3469034
description:
Jan  2 11:10:10 host2 sshd[12123]: Disconnected from invalid user noaccess 201.48.78.29 port 58878 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.48.78.29
country_id: 3469034
description:
Jan  2 11:10:24 host2 sshd[12474]: Disconnected from invalid user pepper 201.48.78.29 port 33098 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  2 11:10:53 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<Ekr6JmFH9GBo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 11:11:48 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<MmdAKmFHHNov/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.145.163
country_id: 6252001
description:
Jan  2 11:11:59 host2 sshd[14172]: Disconnected from invalid user ftp_user 137.184.145.163 port 44314 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 11:12:16 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<ocPqK2FH4OqeRdY+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 137.184.145.163
country_id: 6252001
description:
Jan  2 11:12:55 host2 sshd[15197]: Disconnected from invalid user user33 137.184.145.163 port 35728 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.156.67.18
country_id: 6252001
description:
Jan  2 11:14:28 host2 sshd[17157]: Disconnected from invalid user ubuntu 12.156.67.18 port 52784 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 12.156.67.18
country_id: 6252001
description:
Jan  2 11:16:33 host2 sshd[19623]: Received disconnect from 12.156.67.18 port 38506:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 12.156.67.18
country_id: 6252001
description:
Jan  2 11:16:01 host2 sshd[19109]: Disconnected from invalid user ubuntu 12.156.67.18 port 59306 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.18.161.165
country_id: 1269750
description:
Jan  2 11:17:39 host2 sshd[20687]: Disconnected from invalid user cisco 182.18.161.165 port 50306 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.3.179.41
country_id: 6252001
description:
Jan  2 11:18:13 host2 sshd[21442]: Disconnected from invalid user ansible 192.3.179.41 port 46078 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.3.179.41
country_id: 6252001
description:
Jan  2 11:19:18 host2 sshd[22673]: Disconnected from invalid user user2 192.3.179.41 port 54840 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 192.3.179.41
country_id: 6252001
description:
Jan  2 11:20:24 host2 sshd[23904]: Disconnected from invalid user user33 192.3.179.41 port 37528 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.95
country_id: 6252001
description:
Jan  2 11:20:29 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 10 secs): user=<>, rip=162.216.150.95, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<IiVtSWFHXc+i2JZf>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 192.3.179.41
country_id: 6252001
description:
Jan  2 11:21:32 host2 sshd[25058]: Received disconnect from 192.3.179.41 port 60064:11: Bye Bye [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.95
country_id: 6252001
description:
Jan  2 11:21:49 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 24 secs): user=<>, rip=162.216.150.95, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<v9UvTmFHZP+i2JZf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.3.179.41
country_id: 6252001
description:
Jan  2 11:22:05 host2 sshd[25610]: Disconnected from invalid user ubuntu 192.3.179.41 port 50324 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.95
country_id: 6252001
description:
Jan  2 11:21:56 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 29 secs): user=<>, rip=162.216.150.95, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<SeCcTmFHivOi2JZf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.3.179.41
country_id: 6252001
description:
Jan  2 11:23:11 host2 sshd[26761]: Disconnected from invalid user ubuntu 192.3.179.41 port 36098 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.59.5.36
country_id: 1269750
description:
2026-01-02 11:25:49 dovecot_plain authenticator failed for H=(LE7AQH53ZALJ4) [152.59.5.36]:57610: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2026-01-02 11:25:59 dovecot_login authenticator failed for H=bb121-6-81-59.singnet.com.sg [121.6.81.59]:42379: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.38.0.39
country_id: 6252001
description:
2026-01-02 11:26:08 dovecot_login authenticator failed for H=([45.38.0.39]) [45.38.0.39]:2151: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.208.171
country_id: 798544
description:
Jan  2 11:27:20 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<charanaw>, method=PLAIN, rip=109.125.208.171, lip=66.85.158.91, TLS, session=<2bXtYGFHPrRtfdCr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  2 11:27:28 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<1NAnYmFHnIp100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.75.167.248
country_id: 3077311
description:
Jan  2 11:27:02 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=188.75.167.248, lip=66.85.158.91, TLS, session=<Zz/hX2FHZ6S8S6f4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  2 11:27:08 host2 dovecot[3680762]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<q+kwYWFHBuQDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  2 11:28:35 host2 dovecot[3680762]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<Vf1mZmFHgNsDhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 11:29:10 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<81JSaGFHmMkjupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.95
country_id: 6252001
description:
Jan  2 11:29:12 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.95, lip=66.85.158.92, TLS, session=<ARidaGFHxu+i2JZf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  2 11:29:46 host2 dovecot[3680762]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<FYujamFHss0DhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.95
country_id: 6252001
description:
Jan  2 11:30:28 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=162.216.150.95, lip=66.85.158.92, TLS, session=<1MEYbWFHVu6i2JZf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  2 11:31:01 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<X28cb2FHPMoDhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  2 11:31:25 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<F9ZYcGFHfCtniu0S>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  2 11:31:25 host2 dovecot[3680762]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<q+V/cGFHYN4DhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 11:32:00 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<qkR+cmFHPJWeRdY+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  2 11:32:12 host2 dovecot[3680762]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<pHlYc2FHwpQDhpQ7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.195.221.26
country_id: 934292
description:
Jan  2 11:33:55 host2 sshd[36840]: Disconnected from invalid user user1 45.195.221.26 port 64790 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  2 11:35:49 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<u4kfgGFHrLNn9M4G>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.195.221.26
country_id: 934292
description:
Jan  2 11:35:53 host2 sshd[39108]: Disconnected from invalid user git 45.195.221.26 port 19444 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.76.120.69
country_id: 1643084
description:
Jan  2 11:37:19 host2 sshd[40707]: Disconnected from invalid user dev 103.76.120.69 port 44440 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  2 11:38:22 host2 sshd[42101]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.76.120.69
country_id: 1643084
description:
Jan  2 11:38:01 host2 sshd[41634]: Disconnected from invalid user git 103.76.120.69 port 58014 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  2 11:38:14 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<fKLGiGFHlI2i8Jp9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.195.221.26
country_id: 934292
description:
Jan  2 11:38:29 host2 sshd[42185]: Disconnected from invalid user ubuntu 45.195.221.26 port 19640 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.195.221.26
country_id: 934292
description:
Jan  2 11:39:23 host2 sshd[43599]: Disconnected from invalid user max 45.195.221.26 port 55772 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.39.159
country_id: 953987
description:
Jan  2 11:40:24 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=102.64.39.159, lip=66.85.158.91, TLS, session=<Dwxjj2FHnpRmQCef>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.236.85.34
country_id: 3469034
description:
Jan  2 11:40:44 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=45.236.85.34, lip=66.85.158.91, TLS, session=<OWnAkGFH0bMt7FUi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.76.120.69
country_id: 1643084
description:
Jan  2 11:40:13 host2 sshd[44682]: Disconnected from invalid user paulo 103.76.120.69 port 51964 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  2 11:40:20 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<iPM9kGFHbulCdMzo>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.225
country_id: 6252001
description:
Jan  2 11:41:45 host2 pure-ftpd[46847]: (?@198.235.24.225) [INFO] New connection from 198.235.24.225


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Jan  2 11:45:21 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<NywvomFHgL2YNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 11:46:19 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<sVGppWFHGk8jupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  2 11:48:28 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<N2FXrWFH5IOi8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2026-01-02 11:48:55 dovecot_login authenticator failed for H=([210.177.143.61]) [210.177.143.61]:53168: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.144.14.204
country_id: 1210997
description:
2026-01-02 11:49:21 dovecot_login authenticator failed for H=(14.204.bol-online.com) [122.144.14.204]:59072: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  2 11:51:36 host2 sshd[58869]: Disconnected from invalid user user 2.57.121.25 port 30727 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  2 11:53:00 host2 pure-ftpd[60582]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 11:58:24 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<GaPe0GFHHIIv/AU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.64.98.14
country_id: 1655842
description:
Jan  2 12:01:15 host2 dovecot[3680762]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=64.64.98.14, lip=66.85.158.91, session=<oEcz22FHYMJAQGIO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 43.250.207.105
country_id: 2186224
description:
Jan  2 12:01:15 host2 dovecot[3680762]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=43.250.207.105, lip=66.85.158.91, session=<LRU222FHYNor+s9p>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.90.122.132
country_id: 3042058
description:
Jan  2 12:01:15 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.90.122.132, lip=66.85.158.91, session=<RbY222FHWMJbWnqE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.244.58.12
country_id: 2029969
description:
Jan  2 12:01:15 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=173.244.58.12, lip=66.85.158.91, session=<2B8922FHUtqt9DoM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.187.30
country_id: 1269750
description:
2026-01-02 12:03:47 dovecot_login authenticator failed for H=(nsg-corporate-81.166.185.122.airtel.in) [122.185.187.30]:50970: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.243.234.23
country_id: 6252001
description:
2026-01-02 12:03:59 dovecot_login authenticator failed for H=c-73-243-234-23.hsd1.co.comcast.net [73.243.234.23]:58476: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  2 12:05:53 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<cAmg62FH7Nhnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  2 12:05:23 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<lJTY6WFHpNIFhXlo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.26.25
country_id: 6252001
description:
Jan  2 12:10:38 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=18.97.26.25, lip=66.85.158.91, TLS handshaking: Connection closed, session=<9UnC/GFHZs4SYRoZ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  2 12:12:43 host2 sshd[82889]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 12:15:50 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<ptNBD2JH4MaeRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.149
country_id: 3996063
description:
2026-01-02 12:17:42 dovecot_login authenticator failed for H=([177.236.146.149]) [177.236.146.149]:46697: 535 Incorrect authentication data (set_id=postmaster@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.199.118.234
country_id: 1880251
description:
2026-01-02 12:18:00 dovecot_login authenticator failed for H=(448990.cloudwaysapps.com) [128.199.118.234]:58920: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.248.30.205
country_id: 1269750
description:
2026-01-02 12:20:58 dovecot_login authenticator failed for H=([103.248.30.205]) [103.248.30.205]:57039: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.98.28.43
country_id: 1269750
description:
2026-01-02 12:20:41 dovecot_login authenticator failed for H=([14.98.28.43]) [14.98.28.43]:57960: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 12:21:59 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<bHRBJWJHHJ0v/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  2 12:22:15 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<XfcrJmJHRs0vWBNS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.70.12.9
country_id: 1168579
description:
Jan  2 12:22:52 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=146.70.12.9, lip=66.85.158.91, session=<YyaKKGJHoomSRgwJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.225.28.9
country_id: 718075
description:
Jan  2 12:22:52 host2 dovecot[3680762]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=185.225.28.9, lip=66.85.158.91, session=<4U6FKGJHhOG54RwJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  2 12:29:00 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<Y4dWPmJHzQ1niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  2 12:30:13 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<zea2QmJHro4yBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  2 12:30:14 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<hki5QmJHCZp100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  2 12:34:08 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<test@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<UE5/UGJHkNmeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 12:35:14 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<dnqcVGJHkL4jupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.146
country_id: 6252001
description:
Jan  2 12:35:47 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.146, lip=66.85.158.91, session=<M6O3VmJHiu7N0h+S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 12:35:52 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<v97mVmJHkIKeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.128.110
country_id: 690791
description:
Jan  2 12:37:00 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 25 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=37.221.128.110, lip=66.85.158.91, TLS, session=<AmCaWWJH7aol3YBu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  2 12:37:08 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<L8JjW2JHdK5n9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.54.150
country_id: 953987
description:
Jan  2 12:37:50 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 25 secs): user=<env_eng>, method=PLAIN, rip=102.129.54.150, lip=66.85.158.91, TLS, session=<cGSWXGJHrLJmgTaW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.178.191.5
country_id: 2661886
description:
Jan  2 12:42:28 host2 sshd[113722]: Disconnected from invalid user lars 195.178.191.5 port 47538 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  2 12:43:40 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<nHfCcmJHlkto7MS0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  2 12:43:53 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<2uSRc2JHCjCi8Jp9>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 195.178.191.5
country_id: 2661886
description:
Jan  2 12:44:03 host2 sshd[115085]: Disconnected from invalid user public 195.178.191.5 port 53978 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.178.191.5
country_id: 2661886
description:
Jan  2 12:46:17 host2 sshd[117823]: Disconnected from invalid user justin 195.178.191.5 port 54298 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 194.164.107.5
country_id: 6252001
description:
Jan  2 12:47:13 host2 dovecot[114824]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=194.164.107.5, lip=66.85.158.92, TLS, session=<mMubf2JHqJDCpGsF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.204.219
country_id: 1643084
description:
Jan  2 12:47:35 host2 sshd[119103]: Disconnected from invalid user userftp 103.172.204.219 port 33064 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.68.9.182
country_id: 6252001
description:
Jan  2 12:48:29 host2 sshd[120077]: Disconnected from invalid user xudong 138.68.9.182 port 54928 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.172.204.219
country_id: 1643084
description:
Jan  2 12:48:34 host2 sshd[120124]: Disconnected from invalid user library 103.172.204.219 port 52568 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.17
country_id: 241170
description:
Jan  2 12:47:50 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.17, lip=66.85.158.91, session=<cx6sgWJHyu3E+2YR>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.68.9.182
country_id: 6252001
description:
Jan  2 12:48:58 host2 sshd[120526]: Disconnected from invalid user test123 138.68.9.182 port 34674 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.69
country_id: 3865483
description:
Jan  2 12:49:01 host2 dovecot[114824]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=179.0.250.69, lip=66.85.158.91, TLS, session=<JW/dhGJH0rSzAPpF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.59.125
country_id: 953987
description:
Jan  2 12:49:22 host2 dovecot[114824]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<charanaw>, method=PLAIN, rip=102.129.59.125, lip=66.85.158.91, TLS, session=<aBcphmJHZexmgTt9>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.68.9.182
country_id: 6252001
description:
Jan  2 12:49:57 host2 sshd[121737]: Disconnected from invalid user ubuntu 138.68.9.182 port 48364 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.190.155.43
country_id: 6252001
description:
2026-01-02 12:49:43 dovecot_plain authenticator failed for H=(vatmelized) [76.190.155.43]:48765: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  2 12:49:51 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<VkrliGJHRJOi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 12:52:46 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<EsRMk2JHltEjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.91.186.116
country_id: 6252001
description:
2026-01-02 12:53:59 dovecot_login authenticator failed for H=([107.91.186.116]) [107.91.186.116]:7440: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.98
country_id: 6252001
description:
2026-01-02 12:54:19 dovecot_login authenticator failed for H=syn-035-130-111-098.biz.spectrum.com [35.130.111.98]:47296: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.65.172.46
country_id: 6252001
description:
[2026-01-02 12:55:17 +0530] info [cpaneld] 159.65.172.46 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  2 12:55:53 host2 pure-ftpd[129355]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
country_id: 2510769
description:
2026-01-02 12:58:19 dovecot_login authenticator failed for H=(90.pool90-173-78.static.orange.es) [90.173.78.90]:46889: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.158.51.102
country_id: 1694008
description:
2026-01-02 12:58:40 dovecot_plain authenticator failed for H=(LF21D45A3WC8) [136.158.51.102]:26185: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.158.51.102
country_id: 1694008
description:
2026-01-02 12:58:47 dovecot_login authenticator failed for H=(LF21D45A3WC8) [136.158.51.102]:26185: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.71
country_id: 2635167
description:
Jan  2 13:00:09 host2 dovecot[114824]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.71, lip=66.85.158.92, TLS, session=<o0XZrWJH9di594lH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.234
country_id: 2635167
description:
Jan  2 13:00:10 host2 dovecot[114824]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.234, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<e1/krWJHW7lX7LDq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  2 13:00:37 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<AzlZr2JHBISeRdGr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-02 13:00:54 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:64843: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.212.194
country_id: 1269750
description:
2026-01-02 13:01:12 dovecot_login authenticator failed for H=([61.2.212.194]) [61.2.212.194]:59803: 535 Incorrect authentication data


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.239
country_id: 2635167
description:
Jan  2 13:01:16 host2 dovecot[114824]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.239, lip=66.85.158.92, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<nTvbsWJHp45X7LDv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.238
country_id: 2635167
description:
Jan  2 13:00:43 host2 dovecot[114824]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.238, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<4brfr2JHneRX7LDu>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  2 13:02:36 host2 sshd[136215]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.251
country_id: 2635167
description:
Jan  2 13:01:49 host2 dovecot[114824]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.251, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<83zWs2JHO+tX7LD7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.66
country_id: 1733045
description:
2026-01-02 13:02:00 dovecot_login authenticator failed for H=([49.124.151.66]) [49.124.151.66]:37560: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.226
country_id: 2635167
description:
Jan  2 13:02:23 host2 dovecot[114824]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.226, lip=66.85.158.92, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<rODRtWJHw+a594ni>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.242
country_id: 2635167
description:
Jan  2 13:02:56 host2 dovecot[114824]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.242, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<c0zLt2JHk+ZX7LDy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.210.73.33
country_id: 3469034
description:
2026-01-02 13:03:18 dovecot_login authenticator failed for H=(189-108-224-67.customer.tdatabrasil.net.br) [191.210.73.33]:33953: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.230
country_id: 2635167
description:
Jan  2 13:03:29 host2 dovecot[114824]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.230, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<GpPIuWJHT5K594nm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.14.36
country_id: 3144096
description:
2026-01-02 13:03:48 dovecot_login authenticator failed for H=(cm-84.211.14.36.get.no) [84.211.14.36]:39616: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.236
country_id: 2635167
description:
Jan  2 13:04:02 host2 dovecot[114824]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.236, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<x8/Du2JHaclX7LDs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.226
country_id: 2635167
description:
Jan  2 13:04:35 host2 dovecot[114824]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.226, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<a0C9vWJHvdhX7LDi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.222
country_id: 2635167
description:
Jan  2 13:05:09 host2 dovecot[114824]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.222, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<Npi4v2JHN5hX7LDe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.114
country_id: 1269750
description:
2026-01-02 13:06:18 dovecot_login authenticator failed for H=([152.52.238.86]) [182.95.184.114]:43008: 535 Incorrect authentication data (set_id=postmaster@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.54
country_id: 1149361
description:
2026-01-02 13:06:31 dovecot_login authenticator failed for H=([149.54.62.54]) [149.54.62.54]:44351: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-01-02 13:06:07 dovecot_login authenticator failed for H=([197.219.228.242]) [197.219.228.242]:37070: 535 Incorrect authentication data (set_id=postmaster@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.72.184.60
country_id: 6252001
description:
2026-01-02 13:07:55 dovecot_login authenticator failed for H=24-72-184-24-72-184-60.cpe.sparklight.net [24.72.184.60]:33016: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.90.94
country_id: 1269750
description:
2026-01-02 13:08:11 dovecot_login authenticator failed for H=([182.95.85.106]) [27.123.90.94]:41674: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 13:08:48 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<HrGlzGJHMrQv/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.5.63.166
country_id: 1694008
description:
2026-01-02 13:10:05 dovecot_login authenticator failed for H=([103.5.63.166]) [103.5.63.166]:45078: 535 Incorrect authentication data (set_id=office@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.251
country_id: 6252001
description:
Jan  2 13:10:24 host2 dovecot[114824]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.251, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<rtOB0mJHe9DG6xj7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  2 13:12:11 host2 sshd[145671]: Disconnected from invalid user user 2.57.121.25 port 6559 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  2 13:16:10 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<IKj/5mJHMNpCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 13:20:44 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<wL1f92JHirOeRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.243.234.23
country_id: 6252001
description:
2026-01-02 13:23:21 dovecot_login authenticator failed for H=c-73-243-234-23.hsd1.co.comcast.net [73.243.234.23]:49318: 535 Incorrect authentication data (set_id=contact@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  2 13:22:45 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<6DqE/mJH/o5nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  2 13:27:07 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<g9cqDmNHGDpniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.104
country_id: 3865483
description:
Jan  2 13:32:22 host2 dovecot[114824]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=179.0.250.104, lip=66.85.158.91, TLS, session=<Qu7wH2NHDdizAPpo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.30.113.241
country_id: 3175395
description:
Jan  2 13:32:01 host2 dovecot[114824]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=185.30.113.241, lip=66.85.158.91, TLS, session=<RJ2kHmNHcJC5HnHx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 13:32:15 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<ueyHIGNHDq8v/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  2 13:34:08 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<76pCJ2NH7od100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  2 13:34:22 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<uTMaKGNH7toFhXlo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.203
country_id: 3144096
description:
2026-01-02 13:34:35 dovecot_login authenticator failed for H=(cm-84.211.13.203.get.no) [84.211.13.203]:52887: 535 Incorrect authentication data (set_id=office@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.5.63.166
country_id: 1694008
description:
2026-01-02 13:34:39 dovecot_login authenticator failed for H=([103.5.63.166]) [103.5.63.166]:58065: 535 Incorrect authentication data (set_id=sales@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.254.91
country_id: 3865483
description:
2026-01-02 13:35:13 dovecot_login authenticator failed for H=(static.92.254.104.190.cps.com.ar) [190.104.254.91]:50930: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.98.8
country_id: 3144096
description:
2026-01-02 13:35:25 dovecot_login authenticator failed for H=(cm-84.215.98.8.get.no) [84.215.98.8]:50399: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2026-01-02 13:36:10 dovecot_plain authenticator failed for H=(pared) [65.20.129.28]:45006: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.15
country_id: 798549
description:
Jan  2 13:38:10 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.15, lip=66.85.158.91, session=<KW3RNWNHEKNV2ZUP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  2 13:38:26 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<VuGfNmNHWMpn9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.168.139.28
country_id: 2264397
description:
Jan  2 13:39:35 host2 sshd[173839]: Disconnected from invalid user postgres 79.168.139.28 port 50012 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 13:41:07 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<l3JAQGNHOrueRdY+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 79.168.139.28
country_id: 2264397
description:
Jan  2 13:41:10 host2 sshd[175802]: Disconnected from invalid user ubuntu 79.168.139.28 port 41930 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.14.237.154
country_id: 6252001
description:
Jan  2 13:40:52 host2 sshd[175477]: Disconnected from invalid user game 128.14.237.154 port 39586 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.108.174.4
country_id: 3469034
description:
Jan  2 13:42:03 host2 sshd[176687]: Disconnected from invalid user admin1 200.108.174.4 port 58328 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.242.226.85
country_id: 6252001
description:
Jan  2 13:42:22 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.242.226.85, lip=66.85.158.92, session=<VKLURGNHDr258uJV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.157.20
country_id: 1819730
description:
Jan  2 13:42:40 host2 sshd[177379]: Disconnected from invalid user es 150.5.157.20 port 56728 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.27.76.210
country_id: 3469034
description:
2026-01-02 13:42:08 dovecot_login authenticator failed for H=(187-8-89-120.customer.tdatabrasil.net.br) [177.27.76.210]:57069: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 13:42:24 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<fv7WRGNHOoYjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.162.102
country_id: 1269750
description:
2026-01-02 13:42:32 dovecot_login authenticator failed for H=([125.19.164.187]) [125.19.162.102]:46520: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.19.250.18
country_id: 3017382
description:
Jan  2 13:43:06 host2 sshd[177836]: Disconnected from invalid user postgres 162.19.250.18 port 43280 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 150.5.157.20
country_id: 1819730
description:
Jan  2 13:44:38 host2 sshd[179290]: Disconnected from invalid user postgres 150.5.157.20 port 41534 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 79.168.139.28
country_id: 2264397
description:
Jan  2 13:43:49 host2 sshd[178500]: Received disconnect from 79.168.139.28 port 37880:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.157.20
country_id: 1819730
description:
Jan  2 13:44:00 host2 sshd[178633]: Disconnected from invalid user devops 150.5.157.20 port 39002 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.123
country_id: 1819730
description:
Jan  2 13:44:24 host2 sshd[179069]: Disconnected from invalid user ubuntu 154.83.15.123 port 58934 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.168.139.28
country_id: 2264397
description:
Jan  2 13:44:53 host2 sshd[179540]: Disconnected from invalid user deployer 79.168.139.28 port 44282 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.52.18
country_id: 798544
description:
Jan  2 13:45:05 host2 sshd[179890]: Disconnected from invalid user eva 54.38.52.18 port 37812 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.157.20
country_id: 1819730
description:
Jan  2 13:45:56 host2 sshd[180896]: Disconnected from invalid user test 150.5.157.20 port 41164 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.243
country_id: 6252001
description:
Jan  2 13:46:33 host2 dovecot[114824]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.243, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<1pnOU2NH2tDN0h/z>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 54.38.52.18
country_id: 798544
description:
Jan  2 13:47:23 host2 sshd[182471]: Disconnected from invalid user devops 54.38.52.18 port 43602 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.238.157
country_id: 6252001
description:
Jan  2 13:46:45 host2 sshd[181738]: Disconnected from invalid user ubuntu 167.99.238.157 port 56780 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.52.18
country_id: 798544
description:
Jan  2 13:46:48 host2 sshd[181802]: Disconnected from invalid user rafael 54.38.52.18 port 38194 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 210.79.142.221
country_id: 1643084
description:
Jan  2 13:46:51 host2 sshd[181832]: Disconnected from invalid user github 210.79.142.221 port 33060 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.108.174.4
country_id: 3469034
description:
Jan  2 13:47:45 host2 sshd[182888]: Disconnected from invalid user ec2-user 200.108.174.4 port 33582 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.123
country_id: 1819730
description:
Jan  2 13:47:50 host2 sshd[183011]: Disconnected from invalid user yaroslav 154.83.15.123 port 46358 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 210.79.142.221
country_id: 1643084
description:
Jan  2 13:48:12 host2 sshd[183667]: Disconnected from invalid user nokia 210.79.142.221 port 43852 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.238.157
country_id: 6252001
description:
Jan  2 13:48:25 host2 sshd[183984]: Disconnected from invalid user deploy 167.99.238.157 port 58100 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Jan  2 13:49:14 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<TF48XWNH5MqYNcU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.19.250.18
country_id: 3017382
description:
Jan  2 13:49:03 host2 sshd[184685]: Disconnected from invalid user ubuntu 162.19.250.18 port 51398 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.238.157
country_id: 6252001
description:
Jan  2 13:49:29 host2 sshd[185525]: Disconnected from invalid user ai 167.99.238.157 port 46176 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 79.168.139.28
country_id: 2264397
description:
Jan  2 13:48:56 host2 sshd[184541]: Received disconnect from 79.168.139.28 port 60436:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.52.18
country_id: 798544
description:
Jan  2 13:49:02 host2 sshd[184619]: Disconnected from invalid user ai 54.38.52.18 port 52058 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  2 13:49:27 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<tkITXmNH6sKi8Jp9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.108.174.4
country_id: 3469034
description:
Jan  2 13:50:10 host2 sshd[186443]: Disconnected from invalid user est 200.108.174.4 port 50740 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 210.79.142.221
country_id: 1643084
description:
Jan  2 13:50:40 host2 sshd[187030]: Disconnected from invalid user adam 210.79.142.221 port 47752 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.19.250.18
country_id: 3017382
description:
Jan  2 13:49:44 host2 sshd[185778]: Disconnected from invalid user deployer 162.19.250.18 port 34298 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.108.174.4
country_id: 3469034
description:
Jan  2 13:51:01 host2 sshd[187417]: Disconnected from invalid user postgres 200.108.174.4 port 45468 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.52.18
country_id: 798544
description:
Jan  2 13:50:42 host2 sshd[187080]: Disconnected from invalid user coin 54.38.52.18 port 53670 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  2 13:51:53 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<06m+ZmNHlpWi8GQy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.70.59.165
country_id: 2264397
description:
Jan  2 13:54:49 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=146.70.59.165, lip=66.85.158.91, TLS handshaking: Connection closed, session=<MfdfcWNHqtGSRjul>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.239.217.42
country_id: 3041565
description:
Jan  2 13:54:51 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=173.239.217.42, lip=66.85.158.91, session=<CwZ3cWNH0oCt79kq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 86.106.74.252
country_id: 719819
description:
Jan  2 13:54:49 host2 dovecot[114824]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=86.106.74.252, lip=66.85.158.91, TLS, session=<JVlfcWNHbKlWakr8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 98.159.40.153
country_id: 1210997
description:
Jan  2 13:54:49 host2 dovecot[114824]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=98.159.40.153, lip=66.85.158.91, session=<zDxgcWNHzotinyiZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 156.146.55.164
country_id: 732800
description:
Jan  2 13:54:49 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=156.146.55.164, lip=66.85.158.91, TLS, session=<TIRgcWNHutGckjek>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.120.50
country_id: 1269750
description:
2026-01-02 13:55:01 dovecot_login authenticator failed for H=(nsg-static-89.234.75.182-airtel.com) [182.95.120.50]:41334: 535 Incorrect authentication data (set_id=office@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2026-01-02 13:55:22 dovecot_login authenticator failed for H=([178.250.191.189]) [178.250.191.189]:58648: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 176.125.230.135
country_id: 2562770
description:
Jan  2 13:54:49 host2 dovecot[114824]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=176.125.230.135, lip=66.85.158.91, TLS handshaking: Connection closed, session=<jSxfcWNHXKmwfeaH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.233.160
country_id: 2993457
description:
Jan  2 13:54:49 host2 dovecot[114824]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=95.181.233.160, lip=66.85.158.91, session=<41RkcWNHwItftemg>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 170.64.227.24
country_id: 2077456
description:
Jan  2 13:56:29 host2 dovecot[114824]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 2 secs): user=<>, rip=170.64.227.24, lip=66.85.158.92, TLS, session=<RW1Yd2NHvs2qQOMY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.192.85.86
country_id: 3175395
description:
2026-01-02 13:56:14 dovecot_login authenticator failed for H=([2.192.85.86]) [2.192.85.86]:55752: 535 Incorrect authentication data (set_id=postmaster@kiriaswanu.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 134.122.45.192
country_id: 6251999
description:
Jan  2 13:56:27 host2 dovecot[114824]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=134.122.45.192, lip=66.85.158.91, TLS, session=<n3M3d2NH7MSGei3A>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.142.184.55
country_id: 1210997
description:
2026-01-02 13:56:28 dovecot_login authenticator failed for H=([103.133.175.82]) [103.142.184.55]:54047: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 155.117.98.117
country_id: 6252001
description:
Jan  2 13:56:03 host2 pure-ftpd[193837]: (?@155.117.98.117) [INFO] New connection from 155.117.98.117


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.122.45.192
country_id: 6251999
description:
Jan  2 13:56:26 host2 pure-ftpd[194373]: (?@134.122.45.192) [INFO] New connection from 134.122.45.192


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.122.45.192
country_id: 6251999
description:
Jan  2 13:56:27 host2 dovecot[114824]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=134.122.45.192, lip=66.85.158.91, TLS: Connection closed, session=<Z+Uwd2NH4n2Gei3A>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 170.64.227.24
country_id: 2077456
description:
Jan  2 13:56:27 host2 dovecot[114824]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=170.64.227.24, lip=66.85.158.92, session=<P6M6d2NHuM2qQOMY>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  2 13:58:59 host2 pure-ftpd[197109]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.11
country_id: 3017382
description:
Jan  2 13:59:00 host2 dovecot[114824]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.231.89.11, lip=66.85.158.91, session=<GTROgGNH4eFb51kL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.9
country_id: 3017382
description:
Jan  2 13:59:10 host2 dovecot[114824]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.231.89.9, lip=66.85.158.91, session=<9OLsgGNHW9lb51kJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.129
country_id: 3017382
description:
Jan  2 13:59:24 host2 dovecot[114824]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=91.231.89.129, lip=66.85.158.91, session=<UmXDgWNHYehb51mB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 14:00:08 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<5qpAhGNHANAjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.226.182
country_id: 3469034
description:
2026-01-02 14:02:26 dovecot_login authenticator failed for H=(189-108-192-66.customer.tdatabrasil.net.br) [187.50.226.182]:46234: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  2 14:03:39 host2 sshd[202087]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.248.47.114
country_id: 6252001
description:
2026-01-02 14:02:43 dovecot_login authenticator failed for H=(syn-172-248-047-114.res.spectrum.com) [172.248.47.114]:53518: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.242.226.85
country_id: 6252001
description:
Jan  2 14:02:45 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.242.226.85, lip=66.85.158.91, session=</1nBjWNHtuy58uJV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.23.68
country_id: 3144096
description:
2026-01-02 14:03:04 dovecot_login authenticator failed for H=([178.232.23.68]) [178.232.23.68]:49730: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 155.117.98.117
country_id: 6252001
description:
Jan  2 14:04:47 host2 pure-ftpd[203244]: (?@155.117.98.117) [INFO] New connection from 155.117.98.117


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.172
country_id: 6252001
description:
Jan  2 14:07:10 host2 dovecot[114824]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.172, lip=66.85.158.92, TLS handshaking: Connection closed, session=<3sWDnWNHpNRAPpys>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.172
country_id: 6252001
description:
Jan  2 14:07:43 host2 dovecot[114824]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=64.62.156.172, lip=66.85.158.92, TLS: Connection closed, session=<h4J7n2NHRkBAPpys>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.63.103
country_id: 3144096
description:
2026-01-02 14:08:18 dovecot_login authenticator failed for H=([84.215.63.103]) [84.215.63.103]:39154: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.175.201.167
country_id: 3469034
description:
2026-01-02 14:15:56 dovecot_login authenticator failed for H=200.175.201.167.dynamic.dialup.gvt.net.br (corporate.static.gvt.net.br) [200.175.201.167]:43876: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.218
country_id: 337996
description:
2026-01-02 14:16:52 dovecot_login authenticator failed for H=([196.189.124.218]) [196.189.124.218]:40178: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.218.247.234
country_id: 1522867
description:
2026-01-02 14:16:37 dovecot_login authenticator failed for H=([89.218.247.234]) [89.218.247.234]:37650: 535 Incorrect authentication data (set_id=postmaster@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  2 14:19:29 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<ZBlPyWNHQpcyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 14:19:50 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<rXawymNHMJsv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  2 14:19:49 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<qFGcymNHAIBo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2026-01-02 14:21:21 dovecot_login authenticator failed for H=([103.50.5.94]) [103.50.5.94]:35979: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.40.215.162
country_id: 3469034
description:
2026-01-02 14:21:33 dovecot_login authenticator failed for H=187-40-215-162.user.veloxzone.com.br [187.40.215.162]:53278: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.24
country_id: 2186224
description:
2026-01-02 14:23:58 dovecot_login authenticator failed for H=([121.73.169.24]) [121.73.169.24]:45202: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  2 14:24:02 host2 sshd[223081]: Disconnected from invalid user admin 2.57.121.112 port 8249 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  2 14:24:58 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<IqMT3WNHGBtniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 14:26:34 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<uJHM4mNHlo+eRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.219.68.189
country_id: 3865483
description:
2026-01-02 14:30:42 dovecot_login authenticator failed for H=([201.219.68.189]) [201.219.68.189]:46398: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.155.55.174
country_id: 1880251
description:
Jan  2 14:35:35 host2 sshd[236022]: Disconnected from invalid user arma3server 107.155.55.174 port 36188 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2026-01-02 14:36:44 dovecot_plain authenticator failed for H=c-73-213-237-28.hsd1.va.comcast.net (facutroic) [73.213.237.28]:50926: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.155.55.174
country_id: 1880251
description:
Jan  2 14:36:57 host2 sshd[237422]: Disconnected from invalid user lia 107.155.55.174 port 55980 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.190
country_id: 1269750
description:
2026-01-02 14:37:12 dovecot_login authenticator failed for H=([27.123.98.190]) [27.123.98.190]:47116: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.26.194.79
country_id: 3017382
description:
2026-01-02 14:37:18 dovecot_login authenticator failed for H=([217.26.194.79]) [217.26.194.79]:39391: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.185.37.239
country_id: 1269750
description:
2026-01-02 14:37:30 dovecot_login authenticator failed for H=([136.185.37.239]) [136.185.37.239]:37545: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.155.55.174
country_id: 1880251
description:
Jan  2 14:37:38 host2 sshd[238109]: Disconnected from invalid user opc 107.155.55.174 port 39762 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.155.55.174
country_id: 1880251
description:
Jan  2 14:38:49 host2 sshd[239205]: Disconnected from invalid user cosmos 107.155.55.174 port 35540 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  2 14:39:32 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<DioiEWRHEtJn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  2 14:39:32 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<Jh4lEWRHmpZ100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  2 14:40:46 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<jj2TFWRHUItnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 14:43:52 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<WoSjIGRHJLgv/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.59.26
country_id: 1269750
description:
2026-01-02 14:44:38 dovecot_login authenticator failed for H=([125.23.125.209]) [122.187.59.26]:35486: 535 Incorrect authentication data (set_id=test@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.228.146
country_id: 1269750
description:
2026-01-02 14:44:54 dovecot_login authenticator failed for H=([125.16.32.137]) [125.20.228.146]:52098: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  2 14:45:28 host2 sshd[246647]: Disconnected from invalid user user 2.57.121.25 port 24857 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 14:46:49 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<Qmw0K2RHFOaeRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.237
country_id: 2186224
description:
2026-01-02 14:46:50 dovecot_login authenticator failed for H=([121.73.169.237]) [121.73.169.237]:46746: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 14:49:37 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<Mps+NWRHmpojupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.188.88
country_id: 6252001
description:
Jan  2 14:52:06 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=44.220.188.88, lip=66.85.158.92, TLS handshaking: Connection closed, session=<hjg9PmRHKKEs3LxY>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  2 14:53:29 host2 sshd[254728]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.241.132.152
country_id: 1269750
description:
2026-01-02 14:54:06 dovecot_login authenticator failed for H=(static.ill.117.248.107.130.bsnl.co.in) [43.241.132.152]:39602: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  2 14:54:19 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<DMv7RWRHxsqi8GQy>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 87.236.176.185
country_id: 2635167
description:
Jan  2 14:53:56 host2 pure-ftpd[255134]: (?@87.236.176.185) [INFO] New connection from 87.236.176.185


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.170.50.2
country_id: 3932488
description:
2026-01-02 14:54:38 dovecot_login authenticator failed for H=([45.170.50.2]) [45.170.50.2]:48510: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  2 14:54:47 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<VjSuR2RHHq9CdMzo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.50
country_id: 6252001
description:
Jan  2 14:54:52 host2 dovecot[114824]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.50, lip=66.85.158.91, TLS, session=<qGchSGRHkOzN0h8y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.156
country_id: 1269750
description:
2026-01-02 14:54:25 dovecot_login authenticator failed for H=([103.146.233.156]) [103.146.233.156]:34957: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  2 14:55:47 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<RBY8S2RHPhmi8Jp9>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  2 15:01:56 host2 pure-ftpd[262838]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.122
country_id: 1269750
description:
2026-01-02 15:01:59 dovecot_login authenticator failed for H=([128.185.253.122]) [128.185.253.122]:34032: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.33.112
country_id: 3144096
description:
2026-01-02 15:02:16 dovecot_login authenticator failed for H=([178.232.33.112]) [178.232.33.112]:40446: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2026-01-02 15:01:45 dovecot_login authenticator failed for H=([189.59.210.1]) [186.215.245.175]:50687: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.69.161.7
country_id: 6252001
description:
2026-01-02 15:02:01 dovecot_login authenticator failed for H=([208.69.161.7]) [208.69.161.7]:50021: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.37.179.83
country_id: 3932488
description:
2026-01-02 15:02:11 dovecot_login authenticator failed for H=([200.37.179.83]) [200.37.179.83]:51794: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 11009
name: WHM login success
abuser: 112.134.166.125
country_id: 1227603
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 112.134.166.125 NEW root:V7jHYG51wx5QRs62 address=112.134.166.125,app=whostmgrd,creator=root,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  2 16:08:32 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 6 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<ebEzT2VHhMEyBsPO>


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 112.134.166.125
country_id: 1227603
description:
Jan  2 16:09:26 host2 sshd[5286]: Accepted publickey for root from 112.134.166.125 port 54561 ssh2: RSA SHA256:C0En+cJtfOiiBlRxct5LWBK/MIchNWIDnkBuPMzsR+o


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.219.237.113
country_id: 6252001
description:
Jan  2 16:11:02 host2 pure-ftpd[6706]: (?@104.219.237.113) [INFO] New connection from 104.219.237.113


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 104.219.237.113
country_id: 6252001
description:
Jan  2 16:11:09 host2 pure-ftpd[6706]: (?@104.219.237.113) [WARNING] Authentication failed for user [neotechlk]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.131.83
country_id: 690791
description:
Jan  2 16:19:03 host2 dovecot[1870]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=37.221.131.83, lip=66.85.158.91, TLS, session=<pGMvdGVHwo8l3YNT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  2 16:18:18 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<V2phcmVHQARniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.202.100.196
country_id: 798544
description:
Jan  2 16:19:21 host2 dovecot[1870]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=85.202.100.196, lip=66.85.158.91, TLS, session=<N7dGdWVH4YxVymTE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.239.160.152
country_id: 3996063
description:
2026-01-02 16:19:36 dovecot_login authenticator failed for H=([177.239.160.152]) [177.239.160.152]:60710: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.57
country_id: 1168579
description:
2026-01-02 16:19:44 dovecot_login authenticator failed for H=(57.92.zcomnetworks.com.pk) [103.148.92.57]:34327: 535 Incorrect authentication data (set_id=test@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-02 16:20:21 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:64217: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  2 16:30:35 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<DOpTnmVHWqMFhXlo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.74.41
country_id: 1527747
description:
2026-01-02 16:31:38 dovecot_login authenticator failed for H=(92-62-74-41.saimanet.kg) [92.62.74.41]:52349: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.81
country_id: 1733045
description:
2026-01-02 16:31:19 dovecot_login authenticator failed for H=([49.124.151.81]) [49.124.151.81]:39226: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  2 16:33:46 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<xz63qWVHDL9CdMzo>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 140.245.98.125
country_id: 1880251
description:
Jan  2 16:39:11 host2 pure-ftpd[30405]: (?@140.245.98.125) [INFO] New connection from 140.245.98.125


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 140.245.98.125
country_id: 1880251
description:
Jan  2 16:39:17 host2 pure-ftpd[30496]: (?@140.245.98.125) [INFO] New connection from 140.245.98.125


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 140.245.98.125
country_id: 1880251
description:
Jan  2 16:40:06 host2 pure-ftpd[31543]: (?@140.245.98.125) [INFO] New connection from 140.245.98.125


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 140.245.98.125
country_id: 1880251
description:
Jan  2 16:40:11 host2 pure-ftpd[31698]: (?@140.245.98.125) [INFO] New connection from 140.245.98.125


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
country_id: 290557
description:
2026-01-02 16:40:18 dovecot_plain authenticator failed for H=(fetahs) [80.227.147.94]:38900: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.23.172.153
country_id: 6252001
description:
Jan  2 16:41:17 host2 sshd[32840]: Disconnected from invalid user pms 154.23.172.153 port 48460 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.0.19
country_id: 3469034
description:
2026-01-02 16:42:18 dovecot_login authenticator failed for H=(177-215-153-215.user.vivozap.com.br) [189.56.0.19]:41293: 535 Incorrect authentication data (set_id=office@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  2 16:42:19 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<McxLyGVHmuhn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.228
country_id: 99237
description:
2026-01-02 16:42:32 dovecot_login authenticator failed for H=([65.20.205.228]) [65.20.205.228]:46590: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.30.51
country_id: 6251999
description:
Jan  2 16:43:16 host2 sshd[34663]: Disconnected from invalid user alexis 51.222.30.51 port 37800 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.222.30.51
country_id: 6251999
description:
Jan  2 16:43:47 host2 sshd[35157]: Disconnected from invalid user sam 51.222.30.51 port 44966 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 16:43:53 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<zT/kzWVHoOAv/AU1>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  2 16:44:25 host2 sshd[35825]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.30.51
country_id: 6251999
description:
Jan  2 16:44:16 host2 sshd[35698]: Disconnected from invalid user rushi 51.222.30.51 port 42824 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.75.27.166
country_id: 3017382
description:
Jan  2 16:45:13 host2 sshd[36823]: Disconnected from invalid user alberto 51.75.27.166 port 39966 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.38.169
country_id: 1880251
description:
Jan  2 16:45:34 host2 sshd[37161]: Disconnected from invalid user nextcloud 128.1.38.169 port 42680 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.75.27.166
country_id: 3017382
description:
Jan  2 16:45:46 host2 sshd[37505]: Disconnected from invalid user guest1 51.75.27.166 port 56156 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.75.27.166
country_id: 3017382
description:
Jan  2 16:46:21 host2 sshd[38542]: Disconnected from invalid user michele 51.75.27.166 port 54036 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.102.57
country_id: 6252001
description:
Jan  2 16:47:21 host2 sshd[39445]: Disconnected from invalid user user 64.227.102.57 port 55878 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.48.243.18
country_id: 1819730
description:
Jan  2 16:47:31 host2 sshd[39563]: Disconnected from invalid user git 144.48.243.18 port 60282 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 128.1.38.169
country_id: 1880251
description:
Jan  2 16:48:40 host2 sshd[40605]: Disconnected from invalid user sam 128.1.38.169 port 33092 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.102.57
country_id: 6252001
description:
Jan  2 16:48:08 host2 sshd[40184]: Disconnected from invalid user sagar 64.227.102.57 port 56994 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.38.169
country_id: 1880251
description:
Jan  2 16:49:14 host2 sshd[41115]: Disconnected from invalid user elly 128.1.38.169 port 44940 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.102.57
country_id: 6252001
description:
Jan  2 16:50:24 host2 sshd[42570]: Disconnected from invalid user tempftp 64.227.102.57 port 47772 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.48.243.18
country_id: 1819730
description:
Jan  2 16:50:38 host2 sshd[42826]: Disconnected from invalid user username 144.48.243.18 port 45740 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.62
country_id: 1269750
description:
2026-01-02 16:51:47 dovecot_login authenticator failed for H=([182.95.58.62]) [182.95.58.62]:60966: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.156.1.127
country_id: 3469034
description:
2026-01-02 16:52:44 dovecot_login authenticator failed for H=([38.156.1.127]) [38.156.1.127]:41881: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  2 16:52:50 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<d7fa7WVHdbR100Db>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 144.48.243.18
country_id: 1819730
description:
Jan  2 16:53:42 host2 sshd[45687]: Disconnected from invalid user usr01 144.48.243.18 port 56328 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  2 16:57:54 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<SKL+/2VH/r6i8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 17:00:53 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<G9ewCmZHXkYjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.170
country_id: 1733045
description:
2026-01-02 17:02:51 dovecot_login authenticator failed for H=([49.124.154.170]) [49.124.154.170]:42782: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.70
country_id: 1269750
description:
2026-01-02 17:03:06 dovecot_login authenticator failed for H=([125.17.70.25]) [125.20.251.70]:45634: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 17:07:56 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<GeTaI2ZHxNsv/AU1>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  2 17:07:31 host2 pure-ftpd[61404]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.65.172.46
country_id: 6252001
description:
[2026-01-02 17:07:33 +0530] info [cpaneld] 159.65.172.46 - cloudtourssrilan_travel "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.123
country_id: 6252001
description:
Jan  2 17:07:41 host2 pure-ftpd[61596]: (?@66.132.153.123) [INFO] New connection from 66.132.153.123


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  2 17:07:52 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<MyiqI2ZHnFSi8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2026-01-02 17:12:33 dovecot_login authenticator failed for H=([182.95.228.194]) [182.95.228.194]:38822: 535 Incorrect authentication data (set_id=postmaster@kiriaswanu.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.240.219.146
country_id: 6252001
description:
Jan  2 17:12:42 host2 dovecot[1870]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=66.240.219.146, lip=66.85.158.92, session=<2nAPNWZHwt5C8NuS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.111.136.21
country_id: 294640
description:
2026-01-02 17:12:26 dovecot_login authenticator failed for H=([84.111.136.21]) [84.111.136.21]:37079: 535 Incorrect authentication data (set_id=postmaster@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.190.155.43
country_id: 6252001
description:
2026-01-02 17:13:59 dovecot_plain authenticator failed for H=(frentef) [76.190.155.43]:49409: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  2 17:14:13 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<EUhXOmZHrzRniu0S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.240.219.146
country_id: 6252001
description:
Jan  2 17:15:40 host2 dovecot[1870]: pop3-login: Disconnected: Inactivity (no auth attempts in 180 secs): user=<>, rip=66.240.219.146, lip=66.85.158.92, TLS, session=<Lv2sP2ZHBt1C8NuS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  2 17:16:51 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<4NrFQ2ZH9sZnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.250.51.2
country_id: 1168579
description:
2026-01-02 17:16:56 dovecot_login authenticator failed for H=([160.250.51.2]) [160.250.51.2]:36439: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.70.157.25
country_id: 6252001
description:
2026-01-02 17:17:11 dovecot_login authenticator failed for H=([152.70.157.25]) [152.70.157.25]:57452: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 17:17:20 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<1emCRWZH0kMjupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.10
country_id: 6252001
description:
Jan  2 17:19:28 host2 dovecot[1870]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.10, lip=66.85.158.91, TLS handshaking: Connection closed, session=<c4M+TWZHuthAPpwK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.195.4.247
country_id: 6252001
description:
2026-01-02 17:21:15 dovecot_login authenticator failed for H=(mobile-166-195-004-247.mycingular.net) [166.195.4.247]:46446: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2026-01-02 17:21:15 dovecot_login authenticator failed for H=([193.46.192.20]) [193.46.192.20]:33756: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.111.140
country_id: 1269750
description:
2026-01-02 17:21:25 dovecot_login authenticator failed for H=(abts-mum-static-140.111.170.122.airtelbroadband.in) [122.170.111.140]:35390: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.245.38
country_id: 1269750
description:
2026-01-02 17:21:29 dovecot_login authenticator failed for H=([152.52.12.201]) [152.52.245.38]:33266: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 140.245.98.125
country_id: 1880251
description:
Jan  2 17:24:45 host2 pure-ftpd[81398]: (?@140.245.98.125) [INFO] New connection from 140.245.98.125


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 140.245.98.125
country_id: 1880251
description:
Jan  2 17:24:50 host2 pure-ftpd[81504]: (?@140.245.98.125) [INFO] New connection from 140.245.98.125


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  2 17:26:05 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<XYfJZGZHxhdo7MS0>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 140.245.98.125
country_id: 1880251
description:
Jan  2 17:25:06 host2 pure-ftpd[81970]: (?@140.245.98.125) [INFO] New connection from 140.245.98.125


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 140.245.98.125
country_id: 1880251
description:
Jan  2 17:25:08 host2 pure-ftpd[82024]: (?@140.245.98.125) [INFO] New connection from 140.245.98.125


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.246.166
country_id: 798544
description:
2026-01-02 17:29:45 dovecot_login authenticator failed for H=89-67-246-166.dynamic.play.pl [89.67.246.166]:34620: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.123.45.2
country_id: 1269750
description:
2026-01-02 17:29:52 dovecot_login authenticator failed for H=([103.123.45.2]) [103.123.45.2]:57750: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.250.1
country_id: 3469034
description:
2026-01-02 17:30:06 dovecot_login authenticator failed for H=(ticons.static.gvt.net.br) [177.207.250.1]:50174: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.13.139.61
country_id: 2510769
description:
2026-01-02 17:38:37 dovecot_login authenticator failed for H=61.red-88-13-139.dynamicip.rima-tde.net [88.13.139.61]:38499: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.219.54
country_id: 1269750
description:
2026-01-02 17:38:49 dovecot_login authenticator failed for H=([128.185.219.54]) [128.185.219.54]:43768: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2026-01-02 17:38:48 dovecot_login authenticator failed for H=([125.19.175.94]) [122.184.120.98]:60798: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2026-01-02 17:41:25 dovecot_plain authenticator failed for H=c-174-166-153-20.hsd1.nj.comcast.net (hogef) [174.166.153.20]:45212: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.169.105.44
country_id: 6252001
description:
Jan  2 17:42:00 host2 dovecot[1870]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.169.105.44, lip=66.85.158.92, session=<YdHanWZHsJYUqWks>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.127.155.221
country_id: 6252001
description:
Jan  2 17:43:39 host2 dovecot[1870]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.127.155.221, lip=66.85.158.91, session=<ORO4o2ZHeOEUf5vd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  2 17:44:30 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<in+kpmZHgq9n9M4G>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.134.231
country_id: 6252001
description:
Jan  2 17:44:49 host2 dovecot[1870]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=71.6.134.231, lip=66.85.158.91, TLS, session=<LRLop2ZHVpBHBobn>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  2 17:45:40 host2 sshd[104896]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.238.122
country_id: 2542007
description:
2026-01-02 17:45:34 dovecot_plain authenticator failed for H=(deambadies) [154.146.238.122]:33656: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.218.18
country_id: 1269750
description:
2026-01-02 17:47:27 dovecot_login authenticator failed for H=([128.185.217.27]) [128.185.218.18]:39372: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.150
country_id: 1269750
description:
2026-01-02 17:47:35 dovecot_login authenticator failed for H=(nsg-corporate-177.246.185.122.airtel.in) [122.184.127.150]:50142: 535 Incorrect authentication data (set_id=test@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.9.247.58
country_id: 3469034
description:
2026-01-02 17:47:40 dovecot_login authenticator failed for H=([186.238.157.140]) [187.9.247.58]:39615: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2026-01-02 17:52:29 dovecot_plain authenticator failed for H=(herizatar) [176.113.155.132]:36835: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2026-01-02 17:52:24 dovecot_plain authenticator failed for H=c-24-15-216-41.hsd1.il.comcast.net (terry) [24.15.216.41]:48936: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.221.194
country_id: 3144096
description:
2026-01-02 17:56:11 dovecot_login authenticator failed for H=([178.232.221.194]) [178.232.221.194]:55576: 535 Incorrect authentication data (set_id=contact@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.80.73
country_id: 2077456
description:
2026-01-02 17:56:20 dovecot_login authenticator failed for H=([120.157.80.73]) [120.157.80.73]:39964: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.164.238.63
country_id: 6252001
description:
2026-01-02 17:56:25 dovecot_login authenticator failed for H=c-67-164-238-63.hsd1.il.comcast.net [67.164.238.63]:34690: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.229.14
country_id: 1269750
description:
2026-01-02 18:05:41 dovecot_login authenticator failed for H=([152.52.229.14]) [152.52.229.14]:60268: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.219.101.174
country_id: 1880251
description:
Jan  2 18:06:02 host2 sshd[127763]: Disconnected from invalid user design 8.219.101.174 port 51662 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.8.12
country_id: 614540
description:
2026-01-02 18:05:17 dovecot_login authenticator failed for H=([194.31.8.12]) [194.31.8.12]:64659: 535 Incorrect authentication data (set_id=office@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.170.150.178
country_id: 1605651
description:
2026-01-02 18:05:19 dovecot_login authenticator failed for H=([203.170.150.178]) [203.170.150.178]:56214: 535 Incorrect authentication data (set_id=office@kiriaswanu.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  2 18:10:59 host2 pure-ftpd[133272]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.226.154
country_id: 294640
description:
2026-01-02 18:14:38 dovecot_login authenticator failed for H=([147.235.226.154]) [147.235.226.154]:60412: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.164.148.87
country_id: 1512440
description:
2026-01-02 18:14:17 dovecot_login authenticator failed for H=([62.164.148.87]) [62.164.148.87]:58630: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.94.102
country_id: 290557
description:
2026-01-02 18:14:20 dovecot_login authenticator failed for H=([87.200.94.102]) [87.200.94.102]:56912: 535 Incorrect authentication data (set_id=sales@kiriaswanu.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.134.15.100
country_id: 1522867
description:
Jan  2 18:18:47 host2 sshd[141815]: Disconnected from invalid user lily 2.134.15.100 port 46566 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.106.113
country_id: 1819730
description:
Jan  2 18:21:04 host2 sshd[144460]: Disconnected from invalid user ubuntu 101.36.106.113 port 36588 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.134.15.100
country_id: 1522867
description:
Jan  2 18:21:51 host2 sshd[145578]: Disconnected from invalid user devuser 2.134.15.100 port 54396 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.70.19.11
country_id: 3469034
description:
2026-01-02 18:22:57 dovecot_login authenticator failed for H=(45-70-19-11.static.damsolutionsturbo.com.br) [45.70.19.11]:56514: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.232.114.16
country_id: 3865483
description:
2026-01-02 18:23:06 dovecot_login authenticator failed for H=(OL16-114.fibertel.com.ar) [24.232.114.16]:47743: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.106.113
country_id: 1819730
description:
Jan  2 18:22:23 host2 sshd[146534]: Disconnected from invalid user ubuntu 101.36.106.113 port 46906 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  2 18:22:51 host2 dovecot[1870]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<h4vyL2dHbLoDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.23.68
country_id: 3144096
description:
2026-01-02 18:23:15 dovecot_login authenticator failed for H=(cm-178.232.23.68.get.no) [178.232.23.68]:54025: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  2 18:23:16 host2 dovecot[1870]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: Connection closed, session=<uSJmMWdHmoYDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.126
country_id: 1269750
description:
2026-01-02 18:23:12 dovecot_login authenticator failed for H=([122.185.152.190]) [182.95.178.126]:60554: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.134.15.100
country_id: 1522867
description:
Jan  2 18:24:20 host2 sshd[148302]: Disconnected from invalid user rtc 2.134.15.100 port 38374 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.31.164.124
country_id: 6252001
description:
2026-01-02 18:25:32 dovecot_plain authenticator failed for H=c-76-31-164-124.hsd1.tx.comcast.net (gascrodge) [76.31.164.124]:42232: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  2 18:25:38 host2 dovecot[1870]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<QG/eOWdHOrYDhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan  2 18:26:40 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@monarchdss.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<O6F1PWdHcqtIpyJ4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  2 18:26:38 host2 dovecot[1870]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS, session=<5l15PWdHBrIDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  2 18:27:32 host2 dovecot[1870]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS, session=</x2xQGdHTOoDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  2 18:28:31 host2 dovecot[1870]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<DQ43RGdHuOEDhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.225.40.153
country_id: 6252001
description:
Jan  2 18:28:56 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=64.225.40.153, lip=66.85.158.91, session=<Sw6NRWdH6spA4SiZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 114.7.163.154
country_id: 1643084
description:
Jan  2 18:29:19 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=114.7.163.154, lip=66.85.158.91, session=<dr3pRmdHTNFyB6Oa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  2 18:29:29 host2 dovecot[1870]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<hIChR2dHIKUDhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan  2 18:30:25 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@monarchdss.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<46DVSmdHBIMUOAHJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  2 18:30:27 host2 dovecot[1870]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: Connection closed, session=<tBUaS2dHgrcDhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.234.136.51
country_id: 690791
description:
Jan  2 18:30:50 host2 dovecot[1870]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=91.234.136.51, lip=66.85.158.91, TLS, session=<DPJ9S2dHKrBb6ogz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  2 18:31:29 host2 dovecot[1870]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS, session=<FKnITmdHhOcDhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  2 18:31:31 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@askinternationalconsortium.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<LJPFTmdH8oVnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.164.148.87
country_id: 1512440
description:
2026-01-02 18:31:45 dovecot_login authenticator failed for H=([62.164.148.87]) [62.164.148.87]:58640: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.45.251
country_id: 953987
description:
Jan  2 18:31:13 host2 dovecot[1870]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<charanaw>, method=PLAIN, rip=102.64.45.251, lip=66.85.158.91, TLS, session=<vJukTGdH641mQC37>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.92.171.7
country_id: 6252001
description:
Jan  2 18:31:20 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@ceylondigest.com>, method=PLAIN, rip=190.92.171.7, lip=66.85.158.91, session=<pkUkTmdHdJ2+XKsH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.93.90
country_id: 1269750
description:
2026-01-02 18:31:23 dovecot_login authenticator failed for H=([182.95.20.228]) [122.186.93.90]:37808: 535 Incorrect authentication data (set_id=postmaster@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan  2 18:33:53 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<bxFKV2dHAoIv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 174.138.59.242
country_id: 6252001
description:
Jan  2 18:33:40 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=174.138.59.242, lip=66.85.158.91, session=<xwh0VmdHBjquijvy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan  2 18:33:48 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@maximsholdings.com>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<L7L6VmdHss4v/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan  2 18:34:39 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@lakwelholdings.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<y4gAWmdHpuwyBvlc>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  2 18:35:50 host2 sshd[161511]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  2 18:35:47 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<CfgIXmdH2IJn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.53.44.125
country_id: 1643084
description:
Jan  2 18:35:47 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=117.53.44.125, lip=66.85.158.91, session=<dt4JXmdH2rN1NSx9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.15
country_id: 241170
description:
Jan  2 18:36:24 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.15, lip=66.85.158.91, session=<1MpEYGdH5ofE+2YP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan  2 18:36:26 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<LLZjYGdHFI5npBQq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.133
country_id: 6252001
description:
Jan  2 18:38:40 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.133, lip=66.85.158.91, TLS: Connection closed, session=<JGd/aGdH5L5ChJmF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan  2 18:38:44 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<8dCcaGdHcNov/lVz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.236.132
country_id: 614540
description:
Jan  2 18:40:06 host2 dovecot[165786]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=95.181.236.132, lip=66.85.158.91, session=<7YmcbWdHiLlfteyE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.239.220.5
country_id: 3658394
description:
Jan  2 18:40:07 host2 dovecot[165786]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=173.239.220.5, lip=66.85.158.91, TLS handshaking: Connection closed, session=<FoarbWdHwLyt79wF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.233.168
country_id: 2993457
description:
Jan  2 18:40:06 host2 dovecot[165786]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=95.181.233.168, lip=66.85.158.91, session=<Y12ZbWdHjrlftemo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.225.40.153
country_id: 6252001
description:
Jan  2 18:39:11 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=64.225.40.153, lip=66.85.158.91, session=<kYU4amdHAJNA4SiZ>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 188.241.80.140
country_id: 1814991
description:
Jan  2 18:40:01 host2 pure-ftpd[166747]: (?@188.241.80.140) [INFO] New connection from 188.241.80.140


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 176.125.229.135
country_id: 3194884
description:
Jan  2 18:40:02 host2 pure-ftpd[166873]: (?@176.125.229.135) [INFO] New connection from 176.125.229.135


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.6.31
country_id: 1880251
description:
2026-01-02 18:40:28 dovecot_login authenticator failed for H=(31.6.245.49.unknown.m1.com.sg) [49.245.6.31]:58045: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan  2 18:40:30 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<OGTobmdHwJmygBt7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.222.238
country_id: 3144096
description:
2026-01-02 18:40:39 dovecot_login authenticator failed for H=(cm-178.232.222.238.get.no) [178.232.222.238]:48614: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.252.18
country_id: 1269750
description:
2026-01-02 18:40:45 dovecot_login authenticator failed for H=(dsl-kk-static-089.203.95.61.airtelbroadband.in) [125.20.252.18]:35902: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.103.27.217
country_id: 390903
description:
2026-01-02 18:40:20 dovecot_login authenticator failed for H=owniyj.static.otenet.gr ([2.85.77.70]) [62.103.27.217]:61755: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan  2 18:41:19 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@lezzarotech.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<BVTMcWdHErwvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  2 18:43:41 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@monarchdss.com>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<SCRMemdHVJ9o7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.199.47
country_id: 1269750
description:
Jan  2 18:44:02 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@askinternationalconsortium.com>, method=PLAIN, rip=66.116.199.47, lip=66.85.158.91, session=<Jf+He2dH9q9CdMcv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.249.23
country_id: 3865483
description:
Jan  2 18:44:18 host2 dovecot[165786]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=179.0.249.23, lip=66.85.158.91, TLS, session=<OtNve2dH6ZOzAPkX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.215.27
country_id: 732800
description:
Jan  2 18:44:35 host2 dovecot[165786]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.255.215.27, lip=66.85.158.91, TLS, session=<gAayfGdHxJm5/9cb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 18:45:40 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colperlab.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<vJtqgWdHqqsjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.110.7.34
country_id: 2464461
description:
2026-01-02 18:46:16 dovecot_login authenticator failed for H=([102.110.7.34]) [102.110.7.34]:4913: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.211.132.176
country_id: 1861060
description:
Jan  2 18:46:19 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=8.211.132.176, lip=66.85.158.91, session=<uuqyg2dHEKwI04Sw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.39
country_id: 2186224
description:
2026-01-02 18:46:27 dovecot_login authenticator failed for H=([121.73.163.39]) [121.73.163.39]:59242: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.11
country_id: 241170
description:
Jan  2 18:46:45 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.11, lip=66.85.158.91, session=<YZFEhWdH1q7E+2YL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  2 18:49:03 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@dataesite.lk>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<Ykh+jWdHsJxCdMzo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.76.191.29
country_id: 1819730
description:
2026-01-02 18:48:41 dovecot_login authenticator failed for H=029.191.76.219.static.netvigator.com [219.76.191.29]:49181: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.218.54.218
country_id: 6252001
description:
Jan  2 18:48:48 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@monarchdss.com>, method=PLAIN, rip=104.218.54.218, lip=66.85.158.91, session=<KnCYjGdH3udo2jba>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.164.35.116
country_id: 2328926
description:
2026-01-02 18:49:04 dovecot_login authenticator failed for H=([102.164.35.116]) [102.164.35.116]:44754: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.92.171.7
country_id: 6252001
description:
Jan  2 18:49:46 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@ayuzonelanka.com>, method=PLAIN, rip=190.92.171.7, lip=66.85.158.91, session=<adURkGdHruW+XKsH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.53.44.125
country_id: 1643084
description:
Jan  2 18:52:31 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=117.53.44.125, lip=66.85.158.91, session=<2kTmmWdHFMB1NSx9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.131.211.168
country_id: 690791
description:
2026-01-02 18:53:03 dovecot_login authenticator failed for H=([94.131.211.168]) [94.131.211.168]:56506: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 184.105.247.252
country_id: 6252001
description:
Jan  2 18:53:03 host2 pure-ftpd[183799]: (?@184.105.247.252) [INFO] New connection from 184.105.247.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.188.102.28
country_id: 298795
description:
2026-01-02 18:53:47 dovecot_login authenticator failed for H=([78.188.102.28]) [78.188.102.28]:54678: 535 Incorrect authentication data (set_id=test@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2026-01-02 18:53:55 dovecot_plain authenticator failed for H=(odock) [65.20.160.107]:33131: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.152
country_id: 1269750
description:
2026-01-02 18:54:02 dovecot_login authenticator failed for H=(nsg-corporate-152.227.187.122.airtel.in) [122.187.227.152]:53847: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.3.163.126
country_id: 6252001
description:
Jan  2 18:53:13 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@monarchdss.com>, method=PLAIN, rip=192.3.163.126, lip=66.85.158.91, session=<+8ljnGdHuszAA6N+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.38.27
country_id: 798544
description:
2026-01-02 18:53:28 dovecot_login authenticator failed for H=89-67-38-27.dynamic.play.pl [89.67.38.27]:43794: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  2 18:55:00 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@maximsholdings.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<4pbGomdH+ONCdMzo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 68.183.62.218
country_id: 6252001
description:
Jan  2 18:56:11 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=68.183.62.218, lip=66.85.158.91, session=<p2odp2dHaKREtz7a>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 142.93.183.101
country_id: 6252001
description:
Jan  2 18:56:11 host2 dovecot[165786]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=142.93.183.101, lip=66.85.158.91, TLS handshaking: Connection closed, session=<xC4fp2dHQN6OXbdl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.130
country_id: 1269750
description:
2026-01-02 18:57:01 dovecot_login authenticator failed for H=([27.123.114.130]) [27.123.114.130]:43222: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.227.75.125
country_id: 6252001
description:
Jan  2 18:56:11 host2 dovecot[165786]: imap-login: Disconnected: Connection closed (disconnected before auth was ready, waited 0 secs): user=<>, rip=165.227.75.125, lip=66.85.158.91, TLS handshaking: Connection closed, session=<A1Mep2dHcNml40t9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.169.77
country_id: 3469034
description:
2026-01-02 18:56:45 dovecot_login authenticator failed for H=179-125-169-77.static.desktop.com.br [179.125.169.77]:34569: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


