# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-01-11 05:43:28 dovecot_plain authenticator failed for H=(undinger) [24.187.213.29]:35826: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.246
country_id: 6252001
description:
Jan 11 05:44:31 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.246, lip=66.85.158.92, session=<5h+ApBFInOvN0h/2>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 05:47:33 host2 sshd[3825369]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.186.81.8
country_id: 3469034
description:
2026-01-11 05:47:52 dovecot_login authenticator failed for H=([45.186.81.8]) [45.186.81.8]:58514: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.18
country_id: 1269750
description:
2026-01-11 05:48:14 dovecot_login authenticator failed for H=([125.17.10.161]) [182.95.58.18]:33118: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.105
country_id: 6252001
description:
Jan 11 05:51:36 host2 pure-ftpd[3830236]: (?@147.185.132.105) [INFO] New connection from 147.185.132.105


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.88.26.89
country_id: 294640
description:
Jan 11 05:52:35 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=149.88.26.89, lip=66.85.158.91, session=<AmBRwRFIosaVWBpZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.133.193.5
country_id: 2629691
description:
Jan 11 05:52:36 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=45.133.193.5, lip=66.85.158.91, TLS handshaking: Connection closed, session=<UfxjwRFIGI0thcEF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.202.20.23
country_id: 6252001
description:
Jan 11 05:52:44 host2 dovecot[3239883]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=44.202.20.23, lip=66.85.158.92, session=<0o/ewRFIBuwsyhQX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.244.33.7
country_id: 1282988
description:
Jan 11 05:52:34 host2 dovecot[3239883]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=173.244.33.7, lip=66.85.158.91, session=<Nd1MwRFIssat9CEH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.199.59.18
country_id: 2750405
description:
2026-01-11 05:56:34 dovecot_plain authenticator failed for H=(lugoness) [128.199.59.18]:42122: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 05:57:04 host2 sshd[3837448]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.245.134.222
country_id: 6252001
description:
Jan 11 05:58:35 host2 sshd[3839304]: Disconnected from invalid user admin 157.245.134.222 port 34796 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 157.245.134.222
country_id: 6252001
description:
Jan 11 05:59:03 host2 sshd[3839834]: Disconnected from invalid user ubuntu 157.245.134.222 port 46186 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 11 05:59:08 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<Urmd2BFI1KV100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.214.49.194
country_id: 6252001
description:
2026-01-11 06:00:46 dovecot_login authenticator failed for H=wsip-72-214-49-194.hr.hr.cox.net [72.214.49.194]:47710: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 06:01:32 host2 sshd[3842945]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 139.59.46.198
country_id: 1269750
description:
[2026-01-11 06:01:11 +0530] info [cpaneld] 139.59.46.198 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.138.90.195
country_id: 2661886
description:
2026-01-11 06:01:31 dovecot_login authenticator failed for H=h79-138-90-195.cust.bredband2.com [79.138.90.195]:40588: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2026-01-11 06:03:59 dovecot_login authenticator failed for H=([122.184.124.46]) [122.184.124.46]:57012: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.36.82
country_id: 1210997
description:
2026-01-11 06:04:25 dovecot_login authenticator failed for H=([49.0.36.82]) [49.0.36.82]:43672: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.168
country_id: 6252001
description:
Jan 11 06:04:44 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.168, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<XvfD7BFIysmTuYSo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.109
country_id: 2186224
description:
2026-01-11 06:05:50 dovecot_login authenticator failed for H=([121.73.169.109]) [121.73.169.109]:35368: 535 Incorrect authentication data (set_id=reserve@jrdc.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.76
country_id: 6252001
description:
Jan 11 06:05:53 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.132.76, lip=66.85.158.92, TLS, session=<qYvi8BFIlOOTuYRM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.168.136
country_id: 1269750
description:
2026-01-11 06:06:15 dovecot_login authenticator failed for H=([203.193.168.136]) [203.193.168.136]:54422: 535 Incorrect authentication data (set_id=reserve)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 06:08:54 host2 sshd[3852025]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 06:11:04 host2 sshd[3854862]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 06:13:22 host2 sshd[3857369]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.196.48.232
country_id: 6252001
description:
Jan 11 06:18:01 host2 dovecot[3239883]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=54.196.48.232, lip=66.85.158.91, session=<YbxOHBJIuto2xDDo>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 06:19:02 host2 sshd[3863012]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 06:20:23 host2 sshd[3864726]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.52
country_id: 6252001
description:
Jan 11 06:20:07 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.52, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<c4bKIxJIx8fG6xg0>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 06:23:41 host2 sshd[3868226]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2026-01-11 06:22:58 dovecot_plain authenticator failed for H=c-98-204-134-124.hsd1.md.comcast.net (tormam) [98.204.134.124]:39210: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.98
country_id: 6252001
description:
Jan 11 06:23:08 host2 pure-ftpd[3867633]: (?@205.210.31.98) [INFO] New connection from 205.210.31.98


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 06:24:02 host2 sshd[3868616]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 06:26:11 host2 sshd[3870573]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 06:27:56 host2 sshd[3872511]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.187.2
country_id: 1269750
description:
2026-01-11 06:31:20 dovecot_login authenticator failed for H=([128.185.187.2]) [128.185.187.2]:55436: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.59.154
country_id: 1269750
description:
2026-01-11 06:31:40 dovecot_login authenticator failed for H=([182.95.25.48]) [182.95.59.154]:53198: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan 11 06:35:37 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@seyawin.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<4p8eWxJIROAUOAHJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan 11 06:36:10 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@ceylondigest.com>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<2SQTXRJIOoVm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan 11 06:37:08 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<Yx1zYBJIQI1CdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan 11 06:37:46 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@mathsmotorcysle.xyz>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<cYzRYhJIjLQv/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Jan 11 06:37:45 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<TdDAYhJIkssv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan 11 06:38:02 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<63/BYxJIDIlIpyJ4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 105.174.17.50
country_id: 3351879
description:
Jan 11 06:38:05 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=105.174.17.50, lip=66.85.158.91, session=<WLbuYxJIDnVprhEy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan 11 06:38:14 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<OWF6ZBJI2qkvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Jan 11 06:38:18 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<bSK5ZBJIZqO8putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Jan 11 06:38:56 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<postfix@sobaherbal.com>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<NmrxZhJInM+l0xnK>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 109.105.209.18
country_id: 2264397
description:
Jan 11 06:40:33 host2 pure-ftpd[3888744]: (?@109.105.209.18) [INFO] New connection from 109.105.209.18


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 109.105.209.20
country_id: 2264397
description:
Jan 11 06:40:34 host2 pure-ftpd[3888757]: (?@109.105.209.20) [INFO] New connection from 109.105.209.20


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 109.105.209.17
country_id: 2264397
description:
Jan 11 06:40:37 host2 pure-ftpd[3888805]: (?@109.105.209.17) [INFO] New connection from 109.105.209.17


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan 11 06:40:56 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<VjIcbhJIEsei8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 141.94.22.51
country_id: 3017382
description:
Jan 11 06:40:56 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=141.94.22.51, lip=66.85.158.91, session=<neogbhJIlOyNXhYz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan 11 06:43:48 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@venee.lk>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<Hi1ZeBJIYJAv/VJZ>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.202.118.20
country_id: 6252001
description:
Jan 11 06:44:38 host2 pure-ftpd[3893482]: (?@172.202.118.20) [INFO] New connection from 172.202.118.20


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 105.174.17.50
country_id: 3351879
description:
Jan 11 06:44:04 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=105.174.17.50, lip=66.85.158.91, session=<zCNPeRJITr5prhEy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.68.110.207
country_id: 2921044
description:
Jan 11 06:45:00 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=138.68.110.207, lip=66.85.158.91, session=<KLGrfBJIjqGKRG7P>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.169.105.57
country_id: 6252001
description:
Jan 11 06:45:29 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.169.105.57, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<vi2CfhJICqkUqWk5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.196.48.232
country_id: 6252001
description:
Jan 11 06:45:42 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=54.196.48.232, lip=66.85.158.91, TLS, session=<dhdMfxJIOpM2xDDo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Jan 11 06:45:45 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=</0lhfxJIGOK2uHYF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan 11 06:45:44 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<fXZIfxJIkrBm2gqW>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 06:46:51 host2 sshd[3896319]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan 11 06:46:51 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@kiriaswanu.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<nYZDgxJIkrwv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Jan 11 06:47:12 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<SISPhBJI8Mm8putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan 11 06:48:38 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<Q1KniRJI4J1nmud6>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 06:49:31 host2 sshd[3899567]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.105.156.165
country_id: 3923057
description:
Jan 11 06:49:40 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@rehanseo.online>, method=PLAIN, rip=200.105.156.165, lip=66.85.158.91, session=<gLBhjRJIlOTIaZyl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.131.104
country_id: 1819730
description:
Jan 11 06:51:04 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=152.32.131.104, lip=66.85.158.91, TLS, session=<Gt5/khJIrtqYIINo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.227.143.105
country_id: 2921044
description:
Jan 11 06:51:51 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=165.227.143.105, lip=66.85.158.91, session=<YU1ClRJIt0il449p>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.99.136.12
country_id: 2921044
description:
Jan 11 06:51:51 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.99.136.12, lip=66.85.158.91, session=<FkBIlRJIMFenY4gM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan 11 06:52:08 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<RFovlhJIWMJCdMzo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.241.30
country_id: 1269750
description:
2026-01-11 06:53:14 dovecot_login authenticator failed for H=([182.78.241.30]) [182.78.241.30]:50828: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 06:54:16 host2 sshd[3905746]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.51
country_id: 6252001
description:
Jan 11 06:54:24 host2 dovecot[3239883]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=167.94.146.51, lip=66.85.158.91, session=<4m1onhJI/tmnXpIz>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 06:55:43 host2 sshd[3907836]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.37.223.58
country_id: 3175395
description:
2026-01-11 06:56:15 dovecot_login authenticator failed for H=net-2-37-223-58.cust.vodafonedsl.it [2.37.223.58]:56028: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 06:57:06 host2 sshd[3909443]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.172
country_id: 1733045
description:
2026-01-11 06:57:03 dovecot_login authenticator failed for H=([49.124.154.172]) [49.124.154.172]:55388: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.194
country_id: 1269750
description:
2026-01-11 06:58:50 dovecot_login authenticator failed for H=([182.95.54.194]) [182.95.54.194]:47588: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.43.109
country_id: 1819730
description:
2026-01-11 06:59:09 dovecot_login authenticator failed for H=109.43.246.220.static.netvigator.com [220.246.43.109]:57927: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 07:00:07 host2 sshd[3913035]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.230.228.16
country_id: 6252001
description:
2026-01-11 07:04:13 dovecot_plain authenticator failed for H=c-71-230-228-16.hsd1.de.comcast.net (corgaste) [71.230.228.16]:49868: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 07:06:48 host2 sshd[3921088]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 07:08:52 host2 sshd[3923626]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.97.155.25
country_id: 6252001
description:
2026-01-11 07:11:55 dovecot_plain authenticator failed for H=c-76-97-155-25.hsd1.ga.comcast.net (seionistin) [76.97.155.25]:53576: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-11 07:12:42 dovecot_plain authenticator failed for H=(exise) [64.72.74.162]:44434: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 07:17:44 host2 sshd[3934423]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 07:19:27 host2 sshd[3936165]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 07:20:32 host2 sshd[3937579]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2026-01-11 07:23:13 dovecot_plain authenticator failed for H=(gramply) [65.20.160.107]:43252: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.67
country_id: 6252001
description:
Jan 11 07:24:25 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.20.67, lip=66.85.158.91, TLS handshaking: Connection closed, session=<km28CRNI9pRBMRRD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.67
country_id: 6252001
description:
Jan 11 07:24:52 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.20.67, lip=66.85.158.91, TLS: Connection closed, session=<AgBbCxNInJpBMRRD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.47
country_id: 290557
description:
Jan 11 07:26:26 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@colperlab.com>, method=PLAIN, rip=185.93.89.47, lip=66.85.158.91, session=<N//XEBNISpy5XVkv>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 07:30:26 host2 sshd[3948520]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 11 07:33:06 host2 sshd[3951498]: Disconnected from invalid user admin 2.57.121.112 port 22968 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.91.236.125
country_id: 3686110
description:
Jan 11 07:33:44 host2 sshd[3952191]: Disconnected from invalid user test1 200.91.236.125 port 39115 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.114.49.19
country_id: 1269750
description:
Jan 11 07:34:35 host2 sshd[3953165]: Disconnected from invalid user vpn 45.114.49.19 port 57244 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.53.7.231
country_id: 6252001
description:
2026-01-11 07:34:40 dovecot_login authenticator failed for H=([64.53.7.231]) [64.53.7.231]:54162: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.114.49.19
country_id: 1269750
description:
Jan 11 07:35:17 host2 sshd[3954262]: Disconnected from invalid user admin 45.114.49.19 port 40406 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.170.251.33
country_id: 2017370
description:
2026-01-11 07:35:32 dovecot_login authenticator failed for H=(178.170.251.33.leadertelecom.ru) [178.170.251.33]:49220: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.114.49.19
country_id: 1269750
description:
Jan 11 07:35:59 host2 sshd[3955189]: Disconnected from invalid user sinusbot 45.114.49.19 port 52454 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.91.236.125
country_id: 3686110
description:
Jan 11 07:36:38 host2 sshd[3956132]: Disconnected from invalid user testuser 200.91.236.125 port 39970 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 07:37:28 host2 sshd[3957494]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 40.124.174.248
country_id: 6252001
description:
Jan 11 07:38:02 host2 pure-ftpd[3958199]: (?@40.124.174.248) [INFO] New connection from 40.124.174.248


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 5.191.246.48
country_id: 587116
description:
Jan 11 07:38:58 host2 sshd[3959173]: Disconnected from invalid user vpn 5.191.246.48 port 52772 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 07:40:08 host2 sshd[3961121]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.116.220.140
country_id: 3865483
description:
Jan 11 07:39:53 host2 sshd[3960567]: Disconnected from invalid user ftpuser 181.116.220.140 port 40795 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.203.176
country_id: 1880251
description:
Jan 11 07:41:14 host2 sshd[3962393]: Disconnected from invalid user testuser 45.78.203.176 port 60772 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.203.176
country_id: 1880251
description:
Jan 11 07:42:12 host2 sshd[3963458]: Disconnected from invalid user vpn 45.78.203.176 port 37800 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.203.176
country_id: 1880251
description:
Jan 11 07:43:11 host2 sshd[3964564]: Disconnected from invalid user postgres 45.78.203.176 port 37748 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.197
country_id: 6252001
description:
Jan 11 07:46:50 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.236.228.197, lip=66.85.158.91, TLS, session=<yszoWRNI9k2s7OTF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 179.0.250.42
country_id: 3865483
description:
Jan 11 07:47:43 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 13 secs): user=<>, rip=179.0.250.42, lip=66.85.158.91, session=<Pq4YXRNIoZ2zAPoq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.1.224
country_id: 1210997
description:
2026-01-11 07:47:46 dovecot_plain authenticator failed for H=(LE7AQH53ZALJ4) [103.174.1.224]:14861: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 07:48:21 host2 sshd[3971650]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.1.224
country_id: 1210997
description:
2026-01-11 07:47:52 dovecot_login authenticator failed for H=(LE7AQH53ZALJ4) [103.174.1.224]:14861: 535 Incorrect authentication data


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 87.126.82.50
country_id: 732800
description:
Jan 11 07:47:50 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info@jrdc.lk>, method=PLAIN, rip=87.126.82.50, lip=66.85.158.91, TLS, session=<tbU0XBNIhatXflIy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.145
country_id: 3865483
description:
Jan 11 07:47:52 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info@jrdc.lk>, method=PLAIN, rip=179.0.252.145, lip=66.85.158.91, TLS, session=<NFhJXBNI6MmzAPyR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.168.138.138
country_id: 3996063
description:
Jan 11 07:48:14 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=201.168.138.138, lip=66.85.158.91, TLS, session=<bf3JXRNIV8fJqIqK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.246.168
country_id: 1269750
description:
Jan 11 07:48:15 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=103.164.246.168, lip=66.85.158.91, TLS, session=<5WbaXRNIGednpPao>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.249.50
country_id: 3865483
description:
Jan 11 07:47:53 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info@jrdc.lk>, method=PLAIN, rip=179.0.249.50, lip=66.85.158.91, TLS, session=<VHZMXBNIAOCzAPky>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.221
country_id: 3865483
description:
Jan 11 07:47:54 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<info@jrdc.lk>, method=PLAIN, rip=179.0.252.221, lip=66.85.158.91, TLS, session=<NvJKXBNIxK+zAPzd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 168.194.25.219
country_id: 3469034
description:
Jan 11 07:48:02 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@jrdc.lk>, method=PLAIN, rip=168.194.25.219, lip=66.85.158.91, TLS, session=<X8MsXRNIipKowhnb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.54.190
country_id: 953987
description:
Jan 11 07:48:11 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=102.129.54.190, lip=66.85.158.91, TLS, session=<XUypXRNIhMFmgTa+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.217.118
country_id: 226074
description:
Jan 11 07:48:25 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=196.0.217.118, lip=66.85.158.91, TLS, session=<G/9iXhNIrcDEANl2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.142.106.177
country_id: 298795
description:
2026-01-11 07:50:44 dovecot_login authenticator failed for H=([188.132.210.145]) [195.142.106.177]:12032: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.46
country_id: 1269750
description:
2026-01-11 07:50:44 dovecot_login authenticator failed for H=([182.95.85.181]) [182.95.123.46]:51588: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.109.154.54
country_id: 3469034
description:
2026-01-11 07:51:15 dovecot_login authenticator failed for H=([189.109.154.54]) [189.109.154.54]:57039: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 100.37.16.11
country_id: 6252001
description:
2026-01-11 07:51:00 dovecot_login authenticator failed for H=pool-100-37-16-11.nycmny.fios.verizon.net [100.37.16.11]:53906: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 72.56.94.78
country_id: 2750405
description:
Jan 11 07:52:20 host2 sshd[3976517]: Disconnected from invalid user deploy 72.56.94.78 port 38880 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 07:53:52 host2 sshd[3978209]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.14.32.198
country_id: 298795
description:
Jan 11 07:54:44 host2 sshd[3979617]: Disconnected from invalid user deployerer 213.14.32.198 port 57350 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.165.80.210
country_id: 6252001
description:
Jan 11 07:54:10 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=52.165.80.210, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<UhAkdBNILqs0pVDS>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 72.56.94.78
country_id: 2750405
description:
Jan 11 07:55:40 host2 sshd[3980935]: Disconnected from invalid user qbtuser 72.56.94.78 port 57036 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.14.32.198
country_id: 298795
description:
Jan 11 07:57:21 host2 sshd[3982969]: Disconnected from invalid user steam 213.14.32.198 port 37922 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 59.98.83.57
country_id: 1269750
description:
Jan 11 07:57:24 host2 sshd[3983029]: Disconnected from invalid user steam 59.98.83.57 port 33164 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.31.74
country_id: 1522867
description:
2026-01-11 07:57:37 dovecot_login authenticator failed for H=2.135.31.74.dynamic.telecom.kz [2.135.31.74]:49865: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 07:58:19 host2 sshd[3984065]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 213.14.32.198
country_id: 298795
description:
Jan 11 07:57:54 host2 sshd[3983558]: Disconnected from invalid user vpn 213.14.32.198 port 47558 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.194
country_id: 1269750
description:
2026-01-11 07:58:02 dovecot_login authenticator failed for H=([182.95.52.194]) [182.95.52.194]:59238: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.30.179
country_id: 6252001
description:
Jan 11 07:58:14 host2 sshd[3983967]: Disconnected from invalid user testuser 137.184.30.179 port 59558 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.30.179
country_id: 6252001
description:
Jan 11 08:00:39 host2 sshd[3986705]: Disconnected from invalid user deployerer 137.184.30.179 port 54470 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 137.184.30.179
country_id: 6252001
description:
Jan 11 08:01:43 host2 sshd[3987760]: Disconnected from invalid user secret 137.184.30.179 port 41898 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 08:02:21 host2 sshd[3988581]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
country_id: 1269750
description:
2026-01-11 08:02:14 dovecot_login authenticator failed for H=(nsg-static-82.71.76.182-airtel.com) [182.76.71.82]:46974: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.238.213.180
country_id: 2661886
description:
2026-01-11 08:01:51 dovecot_login authenticator failed for H=h85-238-213-180.cust.bredband2.com [85.238.213.180]:35764: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 08:03:26 host2 sshd[3989771]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.49.152.12
country_id: 3469034
description:
Jan 11 08:07:21 host2 sshd[3994395]: Disconnected from invalid user teamspeak 187.49.152.12 port 33382 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 08:09:48 host2 sshd[3996872]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.49.152.12
country_id: 3469034
description:
Jan 11 08:09:52 host2 sshd[3997015]: Disconnected from invalid user teamspeak 187.49.152.12 port 40270 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.49.152.12
country_id: 3469034
description:
Jan 11 08:11:05 host2 sshd[3998493]: Disconnected from invalid user claude 187.49.152.12 port 34648 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.153
country_id: 6252001
description:
Jan 11 08:11:19 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=147.185.133.153, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<fe9zsRNIU9aTuYWZ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 175.107.201.149
country_id: 1168579
description:
Jan 11 08:12:40 host2 sshd[4000142]: Disconnected from invalid user postgres 175.107.201.149 port 42534 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.107.201.149
country_id: 1168579
description:
Jan 11 08:12:04 host2 sshd[3999540]: Disconnected from invalid user teamspeak 175.107.201.149 port 48372 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.153
country_id: 6252001
description:
Jan 11 08:12:25 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=147.185.133.153, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<uvhjtRNIXO6TuYWZ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.107.201.149
country_id: 1168579
description:
Jan 11 08:13:16 host2 sshd[4000943]: Disconnected from invalid user ubuntu 175.107.201.149 port 36790 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan 11 08:14:33 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: Connection closed, session=<kbIJvRNIeMsDhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.25.232.7
country_id: 953987
description:
Jan 11 08:16:33 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<amila@euroentertainmentlk.com>, method=PLAIN, rip=41.25.232.7, lip=66.85.158.91, session=<ji0GxBNIIdUpGegH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2026-01-11 08:16:59 dovecot_plain authenticator failed for H=c-73-195-211-98.hsd1.nj.comcast.net (ainess) [73.195.211.98]:54654: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan 11 08:17:15 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<mK66xhNIZJkDhpQ7>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 08:18:11 host2 sshd[4006985]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan 11 08:19:27 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS, session=<mrCMzhNIfNIDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.153
country_id: 6252001
description:
Jan 11 08:19:11 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.133.153, lip=66.85.158.91, TLS, session=<DayXzRNIuv+TuYWZ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 08:20:44 host2 sshd[4010007]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.234.80.128
country_id: 6252001
description:
Jan 11 08:21:59 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=54.234.80.128, lip=66.85.158.92, TLS, session=<+KWb1xNIxKc26lCA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan 11 08:22:09 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: Connection closed, session=<xP052BNIHsgDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.182.65.40
country_id: 3017382
description:
2026-01-11 08:23:37 dovecot_login authenticator failed for H=40.ip-217-182-65.eu [217.182.65.40]:34164: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.18
country_id: 1269750
description:
2026-01-11 08:23:49 dovecot_login authenticator failed for H=(nsg-corporate-127.152.185.122.airtel.in) [122.185.146.18]:44282: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan 11 08:25:00 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS, session=<9GRp4hNISsIDhpQ7>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 08:30:47 host2 sshd[4022440]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 08:32:33 host2 sshd[4024702]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.118.162.194
country_id: 2453866
description:
2026-01-11 08:32:42 dovecot_login authenticator failed for H=([154.118.162.194]) [154.118.162.194]:39204: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.190
country_id: 1269750
description:
2026-01-11 08:33:16 dovecot_login authenticator failed for H=([128.185.223.185]) [27.123.114.190]:47236: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.197.6.173
country_id: 3017382
description:
2026-01-11 08:35:52 dovecot_login authenticator failed for H=([78.197.6.173]) [78.197.6.173]:62484: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.240
country_id: 1269750
description:
2026-01-11 08:36:11 dovecot_login authenticator failed for H=(nsg-corporate-240.226.187.122.airtel.in) [122.187.226.240]:55078: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 08:38:03 host2 sshd[4031346]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 08:39:20 host2 sshd[4032822]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 08:41:07 host2 sshd[4034933]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 08:43:15 host2 sshd[4037383]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.207.176.58
country_id: 192950
description:
2026-01-11 08:46:59 dovecot_login authenticator failed for H=([196.207.176.58]) [196.207.176.58]:49377: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.170
country_id: 1269750
description:
2026-01-11 08:46:45 dovecot_login authenticator failed for H=(nsg-corporate-48.223.187.122.airtel.in) [128.185.201.170]:57636: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 08:47:43 host2 sshd[4042877]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.253.154
country_id: 1269750
description:
2026-01-11 08:48:52 dovecot_login authenticator failed for H=([182.78.122.253]) [125.19.253.154]:47522: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 13.89.125.254
country_id: 6252001
description:
Jan 11 08:49:21 host2 pure-ftpd[4044578]: (?@13.89.125.254) [INFO] New connection from 13.89.125.254


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.106
country_id: 1269750
description:
2026-01-11 08:51:28 dovecot_login authenticator failed for H=([152.52.244.106]) [152.52.244.106]:36234: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2026-01-11 08:52:01 dovecot_login authenticator failed for H=([128.185.23.89]) [125.19.160.206]:37500: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.88
country_id: 2635167
description:
Jan 11 08:52:03 host2 dovecot[3239883]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.88, lip=66.85.158.92, TLS, session=<AokuQxRILc2594lY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.143
country_id: 2635167
description:
Jan 11 08:52:04 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.143, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<ESw+QxRId75X7LCP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.140
country_id: 2635167
description:
Jan 11 08:52:38 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.140, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<AHY5RRRIQey594mM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.120
country_id: 2635167
description:
Jan 11 08:53:11 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.120, lip=66.85.158.92, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<pcU0RxRIh+e594l4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.114
country_id: 2635167
description:
Jan 11 08:53:44 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.114, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<TCEwSRRIZ89X7LBy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.116
country_id: 2635167
description:
Jan 11 08:54:17 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.116, lip=66.85.158.92, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<U2ArSxRISa9X7LB0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.123
country_id: 2635167
description:
Jan 11 08:54:51 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.123, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Tt4kTRRIebRX7LB7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.125
country_id: 2635167
description:
Jan 11 08:55:24 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.125, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<ODsiTxRILaNX7LB9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.119
country_id: 2635167
description:
Jan 11 08:55:57 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.119, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<xIUdURRIueZX7LB3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.134
country_id: 2635167
description:
Jan 11 08:56:30 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.134, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<gQ4XUxRI/aO594mG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.110
country_id: 2635167
description:
Jan 11 08:57:04 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.110, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<fGgSVRRI1Ye594lu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.197.178
country_id: 1269750
description:
2026-01-11 08:59:08 dovecot_login authenticator failed for H=([128.185.197.178]) [128.185.197.178]:33736: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.166.137.91
country_id: 6252001
description:
2026-01-11 08:59:19 dovecot_login authenticator failed for H=wsip-70-166-137-91.fv.ks.cox.net [70.166.137.91]:41997: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.6.147
country_id: 3144096
description:
2026-01-11 08:59:51 dovecot_login authenticator failed for H=([78.156.6.147]) [78.156.6.147]:60437: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.142.126.37
country_id: 6252001
description:
2026-01-11 09:00:26 dovecot_plain authenticator failed for H=c-69-142-126-37.hsd1.nj.comcast.net (cheate) [69.142.126.37]:59318: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 09:01:30 host2 sshd[4059538]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 09:05:12 host2 sshd[4064346]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.163.39.86
country_id: 6252001
description:
Jan 11 09:09:21 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.163.39.86, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<QsUNgRRIBIMUoydW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.92
country_id: 6252001
description:
Jan 11 09:14:50 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.92, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<5gKqlBRIz8nG6xhc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.42.225.40
country_id: 2510769
description:
2026-01-11 09:16:31 dovecot_login authenticator failed for H=40.red-81-42-225.staticip.rima-tde.net [81.42.225.40]:50540: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.181.133.153
country_id: 3469034
description:
2026-01-11 09:16:45 dovecot_login authenticator failed for H=([179.181.133.153]) [179.181.133.153]:46655: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.74
country_id: 6252001
description:
Jan 11 09:21:27 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.74, lip=66.85.158.91, TLS, session=<j21IrBRIOPnN0h9K>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.11
country_id: 2635167
description:
Jan 11 09:24:25 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 11 secs): user=<>, rip=35.203.211.11, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<L27uthRIg98jy9ML>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.11
country_id: 2635167
description:
Jan 11 09:25:32 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 10 secs): user=<>, rip=35.203.211.11, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<G5rnuhRI7Oojy9ML>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.98.45.238
country_id: 6252001
description:
2026-01-11 09:29:55 dovecot_plain authenticator failed for H=c-24-98-45-238.hsd1.ga.comcast.net (unbous) [24.98.45.238]:42902: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.11
country_id: 2635167
description:
Jan 11 09:33:08 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.11, lip=66.85.158.92, TLS, session=<bTUX1hRIouYjy9ML>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.38
country_id: 6252001
description:
Jan 11 09:32:39 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.38, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Tpld1BRIKtnN0h8m>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.83.145.39
country_id: 6252001
description:
Jan 11 09:36:17 host2 dovecot[3239883]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.83.145.39, lip=66.85.158.92, session=<aG1a4RRILuUDU5En>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.45
country_id: 290557
description:
Jan 11 09:38:20 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=185.93.89.45, lip=66.85.158.91, session=<yqmC6BRILua5XVkt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.49
country_id: 290557
description:
Jan 11 09:38:50 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=185.93.89.49, lip=66.85.158.91, session=<4/FP6hRIHKO5XVkx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.48
country_id: 290557
description:
Jan 11 09:39:30 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=185.93.89.48, lip=66.85.158.91, session=<lqW07BRInuu5XVkw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.45
country_id: 290557
description:
Jan 11 09:39:39 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=185.93.89.45, lip=66.85.158.91, session=<u0dA7RRInq65XVkt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.49
country_id: 290557
description:
Jan 11 09:40:07 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=185.93.89.49, lip=66.85.158.91, session=<OaLy7hRIeNW5XVkx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.46
country_id: 290557
description:
Jan 11 09:40:47 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=185.93.89.46, lip=66.85.158.91, session=<cDdL8RRI6tW5XVku>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.48
country_id: 290557
description:
Jan 11 09:40:49 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=185.93.89.48, lip=66.85.158.91, session=<bWhz8RRIwte5XVkw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.46
country_id: 290557
description:
Jan 11 09:42:06 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=185.93.89.46, lip=66.85.158.91, session=<Co4M9hRITNq5XVku>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.30
country_id: 290557
description:
Jan 11 09:42:35 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=185.93.89.30, lip=66.85.158.91, session=<rBnI9xRIDre5XVke>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.38.0.41
country_id: 6252001
description:
2026-01-11 09:42:59 dovecot_login authenticator failed for H=([45.38.0.41]) [45.38.0.41]:2605: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.161
country_id: 2993457
description:
Jan 11 09:44:09 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.161, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<OFV2/RRI1/7CpRCh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.29
country_id: 290557
description:
Jan 11 09:43:17 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=185.93.89.29, lip=66.85.158.91, session=<3WhJ+hRIqKS5XVkd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.231.6
country_id: 1269750
description:
2026-01-11 09:43:21 dovecot_login authenticator failed for H=([125.20.231.225]) [128.185.231.6]:47546: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.30
country_id: 290557
description:
Jan 11 09:43:54 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=185.93.89.30, lip=66.85.158.91, session=<aTh8/BRIro25XVke>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.29
country_id: 290557
description:
Jan 11 09:44:38 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=185.93.89.29, lip=66.85.158.91, session=<poUX/xRIOOy5XVkd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.28
country_id: 290557
description:
Jan 11 09:45:14 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=185.93.89.28, lip=66.85.158.91, session=<LAE/ARVI0IW5XVkc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.27
country_id: 290557
description:
Jan 11 09:45:21 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=185.93.89.27, lip=66.85.158.91, session=<QzasARVI+uW5XVkb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.28
country_id: 290557
description:
Jan 11 09:46:35 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=185.93.89.28, lip=66.85.158.91, session=<Wl0UBhVIXOa5XVkc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.27
country_id: 290557
description:
Jan 11 09:46:51 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=185.93.89.27, lip=66.85.158.91, session=<cqUDBxVIKMa5XVkb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2026-01-11 09:51:20 dovecot_plain authenticator failed for H=c-73-196-144-25.hsd1.nj.comcast.net (stersied) [73.196.144.25]:34114: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.116.199.234
country_id: 1269750
description:
Jan 11 09:55:20 host2 sshd[4126854]: Disconnected from invalid user syncer 66.116.199.234 port 46450 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.86.180.10
country_id: 1269750
description:
Jan 11 09:56:08 host2 sshd[4127687]: Disconnected from invalid user menudefs 103.86.180.10 port 48594 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2026-01-11 09:56:23 dovecot_plain authenticator failed for H=(preaden) [65.20.160.107]:58778: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.86.180.10
country_id: 1269750
description:
Jan 11 09:57:36 host2 sshd[4129223]: Disconnected from invalid user association 103.86.180.10 port 32959 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 218.255.103.194
country_id: 1819730
description:
Jan 11 09:57:45 host2 sshd[4129383]: Disconnected from invalid user jszip 218.255.103.194 port 43168 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.116.199.234
country_id: 1269750
description:
Jan 11 09:57:52 host2 sshd[4129472]: Disconnected from invalid user association 66.116.199.234 port 46634 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.212.133
country_id: 1819730
description:
Jan 11 09:57:20 host2 sshd[4128962]: Disconnected from invalid user cenabletqa 123.58.212.133 port 53964 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.86.180.10
country_id: 1269750
description:
Jan 11 09:58:12 host2 sshd[4129803]: Disconnected from invalid user mockapp 103.86.180.10 port 38552 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.116.199.234
country_id: 1269750
description:
Jan 11 09:58:32 host2 sshd[4130106]: Disconnected from invalid user hidetask 66.116.199.234 port 43816 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2026-01-11 09:58:49 dovecot_plain authenticator failed for H=c-73-183-74-177.hsd1.pa.comcast.net (sunmel) [73.183.74.177]:55446: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.45
country_id: 290557
description:
Jan 11 09:58:57 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=185.93.89.45, lip=66.85.158.91, session=<++BMMhVIqJe5XVkt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.93.89.49
country_id: 290557
description:
Jan 11 09:59:01 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=185.93.89.49, lip=66.85.158.91, session=<i0Z/MhVI/Ma5XVkx>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 66.116.199.234
country_id: 1269750
description:
Jan 11 09:59:18 host2 sshd[4131025]: Disconnected from invalid user cenabletqa 66.116.199.234 port 55892 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.93.89.48
country_id: 290557
description:
Jan 11 10:00:05 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=185.93.89.48, lip=66.85.158.91, session=<eqRbNhVISNK5XVkw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.46
country_id: 290557
description:
Jan 11 10:01:23 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=185.93.89.46, lip=66.85.158.91, session=<IqYAOxVI4uW5XVku>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 123.58.212.133
country_id: 1819730
description:
Jan 11 10:03:04 host2 sshd[4135048]: Disconnected from invalid user web 123.58.212.133 port 43398 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.30
country_id: 290557
description:
Jan 11 10:03:08 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=185.93.89.30, lip=66.85.158.91, session=<IP06QRVI6NS5XVke>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.235.121.114
country_id: 6252001
description:
Jan 11 10:03:24 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=74.235.121.114, lip=66.85.158.91, TLS handshaking: Connection closed, session=<P7lSQhVIgLdK63ly>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.49.11
country_id: 3144096
description:
2026-01-11 10:03:48 dovecot_login authenticator failed for H=([84.214.49.11]) [84.214.49.11]:36355: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.29
country_id: 290557
description:
Jan 11 10:04:11 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=185.93.89.29, lip=66.85.158.91, session=<kXkFRRVIDr25XVkd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.142.184.55
country_id: 1210997
description:
2026-01-11 10:04:15 dovecot_login authenticator failed for H=([103.133.175.82]) [103.142.184.55]:56532: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.28
country_id: 290557
description:
Jan 11 10:06:18 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=185.93.89.28, lip=66.85.158.91, session=<l0iLTBVIbsC5XVkc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.27
country_id: 290557
description:
Jan 11 10:07:08 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=185.93.89.27, lip=66.85.158.91, session=<BtmRTxVIGIC5XVkb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2026-01-11 10:08:51 dovecot_plain authenticator failed for H=(reaccity) [12.150.243.22]:12217: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.165
country_id: 99237
description:
2026-01-11 10:10:31 dovecot_plain authenticator failed for H=(mearconnes) [65.20.148.165]:40389: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan 11 10:10:27 host2 dovecot[3239883]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<gh6EWxVIkpMDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan 11 10:11:54 host2 dovecot[3239883]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<8GSyYBVIdr0DiUnd>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 111.238.174.6
country_id: 1861060
description:
Jan 11 10:14:40 host2 sshd[4147814]: Disconnected from invalid user teamspeak 111.238.174.6 port 46154 [preauth]


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.137.73.221
country_id: 6252001
description:
Jan 11 10:15:40 host2 dovecot[3239883]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<718zbhVI9LMDiUnd>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 10:16:20 host2 sshd[4149825]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.238.174.6
country_id: 1861060
description:
Jan 11 10:16:34 host2 sshd[4150038]: Disconnected from invalid user deploy 111.238.174.6 port 51420 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan 11 10:17:26 host2 dovecot[3239883]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<ZqKGdBVIQL4DiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2026-01-11 10:24:02 dovecot_login authenticator failed for H=([50.217.40.11]) [50.217.40.11]:37226: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2026-01-11 10:24:27 dovecot_login authenticator failed for H=([38.226.118.9]) [38.226.118.0]:58360: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.127.128
country_id: 3144096
description:
2026-01-11 10:26:31 dovecot_login authenticator failed for H=([46.212.127.128]) [46.212.127.128]:60569: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.135.117.245
country_id: 6252001
description:
2026-01-11 10:26:40 dovecot_login authenticator failed for H=107-135-117-245.lightspeed.livnmi.sbcglobal.net [107.135.117.245]:53533: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 10:27:55 host2 sshd[4161569]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.126.40.196
country_id: 2510769
description:
2026-01-11 10:29:15 dovecot_login authenticator failed for H=([91.126.40.196]) [91.126.40.196]:33874: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.47
country_id: 290557
description:
Jan 11 10:30:55 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@euroentertainmentlk.com>, method=PLAIN, rip=185.93.89.47, lip=66.85.158.91, session=<6nyYpBVIPqC5XVkv>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 10:31:33 host2 sshd[4165127]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2026-01-11 10:39:42 dovecot_plain authenticator failed for H=217-215-74-195-no2620.tbcn.telia.com (hypte) [217.215.74.195]:38522: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-01-11 10:40:11 dovecot_plain authenticator failed for H=host-196-47-172-253.afnet.net (bugly) [196.47.172.253]:55755: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.161.96.107
country_id: 6252001
description:
2026-01-11 10:46:13 dovecot_plain authenticator failed for H=c-73-161-96-107.hsd1.mi.comcast.net (flacep) [73.161.96.107]:38698: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.47
country_id: 290557
description:
Jan 11 10:51:40 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=185.93.89.47, lip=66.85.158.91, session=<2KTS7hVI8Lm5XVkv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.143.166
country_id: 1819730
description:
2026-01-11 10:53:15 dovecot_login authenticator failed for H=([180.188.143.166]) [180.188.143.166]:59484: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.107.180
country_id: 1269750
description:
2026-01-11 10:53:38 dovecot_login authenticator failed for H=(static.ill.117.250.107.180.bsnl.co.in) [117.250.107.180]:34832: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2026-01-11 10:58:46 dovecot_plain authenticator failed for H=(spote) [91.73.188.251]:45880: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.2
country_id: 798549
description:
Jan 11 10:59:31 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.2, lip=66.85.158.91, session=<1rQCCxZIRNFV2ZUC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.25.232.7
country_id: 953987
description:
Jan 11 11:02:33 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<amila@euroentertainmentlk.com>, method=PLAIN, rip=41.25.232.7, lip=66.85.158.91, session=<G+KzFRZIf94pGegH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.8
country_id: 798549
description:
Jan 11 11:02:20 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.8, lip=66.85.158.91, TLS: Connection closed, session=<zHwcFRZI3ttV2ZUI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.93
country_id: 99237
description:
2026-01-11 11:08:40 dovecot_plain authenticator failed for H=(swify) [65.20.149.93]:43240: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.225.176.238
country_id: 6252001
description:
Jan 11 11:10:07 host2 sshd[14339]: Disconnected from invalid user claude 50.225.176.238 port 39788 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.138.42.12
country_id: 1861060
description:
Jan 11 11:11:42 host2 sshd[15862]: Disconnected from invalid user deployerer 168.138.42.12 port 47280 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.162
country_id: 2993457
description:
Jan 11 11:11:45 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.162, lip=66.85.158.91, session=<PiHKNhZIwf7CpRCi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.49
country_id: 290557
description:
Jan 11 11:12:19 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<info@dataesite.lk>, method=PLAIN, rip=185.93.89.49, lip=66.85.158.91, session=<KkuROBZIiKC5XVkx>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 168.138.42.12
country_id: 1861060
description:
Jan 11 11:12:43 host2 sshd[16841]: Disconnected from invalid user user2 168.138.42.12 port 58688 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.161.96.107
country_id: 6252001
description:
2026-01-11 11:13:08 dovecot_plain authenticator failed for H=c-73-161-96-107.hsd1.mi.comcast.net (colennic) [73.161.96.107]:36070: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.45
country_id: 290557
description:
Jan 11 11:14:14 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=185.93.89.45, lip=66.85.158.91, session=<f9N9PxZIONu5XVkt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.138.42.12
country_id: 1861060
description:
Jan 11 11:14:32 host2 sshd[18919]: Disconnected from invalid user ionadmin 168.138.42.12 port 53250 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.225.176.238
country_id: 6252001
description:
Jan 11 11:14:48 host2 sshd[19214]: Disconnected from invalid user user2 50.225.176.238 port 33416 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.48
country_id: 290557
description:
Jan 11 11:14:59 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=185.93.89.48, lip=66.85.158.91, session=<4NI2QhZIXpu5XVkw>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.102.116.25
country_id: 6252001
description:
Jan 11 11:15:14 host2 sshd[19796]: Disconnected from invalid user steam 20.102.116.25 port 40458 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.225.176.238
country_id: 6252001
description:
Jan 11 11:15:22 host2 sshd[19948]: Disconnected from invalid user testuser 50.225.176.238 port 42176 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.46
country_id: 290557
description:
Jan 11 11:16:20 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=185.93.89.46, lip=66.85.158.91, session=<0dsBRxZI5K25XVku>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 50.225.176.238
country_id: 6252001
description:
Jan 11 11:16:21 host2 sshd[20929]: Disconnected from invalid user steam 50.225.176.238 port 59238 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.30
country_id: 290557
description:
Jan 11 11:17:31 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=185.93.89.30, lip=66.85.158.91, session=<egdCSxZISMS5XVke>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.29
country_id: 290557
description:
Jan 11 11:20:01 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=185.93.89.29, lip=66.85.158.91, session=<MckuVBZIMte5XVkd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.27
country_id: 290557
description:
Jan 11 11:21:56 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=185.93.89.27, lip=66.85.158.91, session=<p7cMWxZISMK5XVkb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.28
country_id: 290557
description:
Jan 11 11:22:43 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=185.93.89.28, lip=66.85.158.91, session=<UhjiXRZI5tS5XVkc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 11 11:29:55 host2 sshd[37471]: Disconnected from invalid user admin 2.57.121.112 port 14140 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.47.2
country_id: 1269750
description:
2026-01-11 11:40:34 dovecot_login authenticator failed for H=([27.123.105.140]) [182.95.47.2]:34490: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.209.30
country_id: 1269750
description:
2026-01-11 11:41:18 dovecot_login authenticator failed for H=([125.18.43.161]) [128.185.209.30]:44592: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2026-01-11 11:49:22 dovecot_plain authenticator failed for H=c-68-82-141-145.hsd1.pa.comcast.net (joida) [68.82.141.145]:51924: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.49
country_id: 290557
description:
Jan 11 11:51:16 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=185.93.89.49, lip=66.85.158.91, session=<fiPfwxZIQse5XVkx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.45
country_id: 290557
description:
Jan 11 11:54:02 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=185.93.89.45, lip=66.85.158.91, session=<OZvBzRZIGs+5XVkt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.48
country_id: 290557
description:
Jan 11 11:54:42 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=185.93.89.48, lip=66.85.158.91, session=<vi5E0BZI3Ne5XVkw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.46
country_id: 290557
description:
Jan 11 11:55:57 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=185.93.89.46, lip=66.85.158.91, session=<ULav1BZIru25XVku>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.30
country_id: 290557
description:
Jan 11 11:56:57 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=185.93.89.30, lip=66.85.158.91, session=<ZoBD2BZIutO5XVke>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.29
country_id: 290557
description:
Jan 11 12:00:16 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=185.93.89.29, lip=66.85.158.91, session=<S4om5BZIlqq5XVkd>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 12:00:37 host2 sshd[73591]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.27
country_id: 290557
description:
Jan 11 12:01:11 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=185.93.89.27, lip=66.85.158.91, session=<6p1w5xZI8uW5XVkb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2026-01-11 12:01:51 dovecot_plain authenticator failed for H=c-174-166-153-20.hsd1.nj.comcast.net (aettentic) [174.166.153.20]:57044: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2026-01-11 12:01:35 dovecot_plain authenticator failed for H=c-71-224-169-28.hsd1.pa.comcast.net (pulize) [71.224.169.28]:36780: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.19.79.32
country_id: 285570
description:
2026-01-11 12:01:46 dovecot_plain authenticator failed for H=(croores) [185.19.79.32]:36849: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.28
country_id: 290557
description:
Jan 11 12:03:05 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=185.93.89.28, lip=66.85.158.91, session=<yiAz7hZIyIG5XVkc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.76.55.177
country_id: 3175395
description:
2026-01-11 12:04:11 dovecot_login authenticator failed for H=([151.76.55.177]) [151.76.55.177]:46270: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan 11 12:05:12 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: Connection closed, session=<23zr9RZI8MwDlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.194.128.158
country_id: 1269750
description:
2026-01-11 12:04:30 dovecot_login authenticator failed for H=(static-158.128.194.14-tataidc.co.in) [14.194.128.158]:36254: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan 11 12:07:49 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<yQpM/xZIuMwDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan 11 12:08:22 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<pBQ3ARdIxIQDlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.93
country_id: 99237
description:
2026-01-11 12:09:04 dovecot_login authenticator failed for H=([65.20.250.93]) [65.20.250.93]:54658: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.120.182
country_id: 3144096
description:
2026-01-11 12:09:13 dovecot_login authenticator failed for H=(cm-178.232.120.182.get.no) [178.232.120.182]:58036: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.13
country_id: 241170
description:
Jan 11 12:09:27 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.13, lip=66.85.158.91, session=<Cxr6BBdIJsXE+2YN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan 11 12:10:02 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<2ns6BxdItsQDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan 11 12:10:21 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS, session=<XWJOCBdIZJwDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan 11 12:12:17 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<r5Q+DxdIUucDlTsa>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.21.178
country_id: 1880251
description:
Jan 11 12:15:13 host2 sshd[90388]: Disconnected from invalid user server 103.210.21.178 port 58328 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan 11 12:13:33 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Y0zAExdIRI4DlTsa>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 12:15:53 host2 sshd[91216]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2026-01-11 12:15:56 dovecot_login authenticator failed for H=([152.52.234.134]) [125.20.245.182]:42936: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.223.176.171
country_id: 6252001
description:
2026-01-11 12:16:05 dovecot_login authenticator failed for H=([50.223.176.171]) [50.223.176.171]:36064: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Jan 11 12:15:28 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS, session=<xruiGhdIduEDlTsa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.49
country_id: 290557
description:
Jan 11 12:15:41 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@seyawin.com>, method=PLAIN, rip=185.93.89.49, lip=66.85.158.91, session=<wyw8GxdI8uy5XVkx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.43.169.117
country_id: 1269750
description:
2026-01-11 12:16:35 dovecot_plain authenticator failed for H=(X58MAJ152S6) [49.43.169.117]:56576: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.26.212
country_id: 2077456
description:
2026-01-11 12:18:53 dovecot_login authenticator failed for H=([101.168.26.212]) [101.168.26.212]:35020: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.45
country_id: 290557
description:
Jan 11 12:19:05 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=185.93.89.45, lip=66.85.158.91, session=<2ChvJxdIGKe5XVkt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.249.252.237
country_id: 1861060
description:
2026-01-11 12:19:20 dovecot_login authenticator failed for H=fs96f9fced.tkyc203.ap.nuro.jp [150.249.252.237]:45037: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.48
country_id: 290557
description:
Jan 11 12:19:44 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=185.93.89.48, lip=66.85.158.91, session=<nObFKRdI2r65XVkw>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.210.21.178
country_id: 1880251
description:
Jan 11 12:21:02 host2 sshd[97232]: Disconnected from invalid user frappe 103.210.21.178 port 42282 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.194.140.170
country_id: 3996063
description:
Jan 11 12:20:27 host2 sshd[96570]: Disconnected from invalid user claude 189.194.140.170 port 42718 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.46
country_id: 290557
description:
Jan 11 12:20:55 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=185.93.89.46, lip=66.85.158.91, session=<wpT6LRdI1pO5XVku>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.21.178
country_id: 1880251
description:
Jan 11 12:21:34 host2 sshd[97909]: Disconnected from invalid user vpn 103.210.21.178 port 52780 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.194.140.170
country_id: 3996063
description:
Jan 11 12:21:40 host2 sshd[97998]: Disconnected from invalid user deploy 189.194.140.170 port 36964 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.30
country_id: 290557
description:
Jan 11 12:21:47 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=185.93.89.30, lip=66.85.158.91, session=<BCAgMRdIMOK5XVke>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.109.130
country_id: 1819730
description:
Jan 11 12:22:25 host2 sshd[98801]: Disconnected from invalid user test1 101.36.109.130 port 57384 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.194.140.170
country_id: 3996063
description:
Jan 11 12:22:51 host2 sshd[99304]: Disconnected from invalid user teste 189.194.140.170 port 59444 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.27
country_id: 290557
description:
Jan 11 12:25:57 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=185.93.89.27, lip=66.85.158.91, session=<LxgEQBdIcOe5XVkb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.29
country_id: 290557
description:
Jan 11 12:25:34 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=185.93.89.29, lip=66.85.158.91, session=<ehynPhdI1Jy5XVkd>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.109.130
country_id: 1819730
description:
Jan 11 12:25:40 host2 sshd[102504]: Disconnected from invalid user server 101.36.109.130 port 45422 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.16
country_id: 241170
description:
Jan 11 12:26:29 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.16, lip=66.85.158.91, session=<vfXqQRdIupXE+2YQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.28
country_id: 290557
description:
Jan 11 12:28:28 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=185.93.89.28, lip=66.85.158.91, session=<suYDSRdI7sa5XVkc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.118
country_id: 1269750
description:
2026-01-11 12:31:54 dovecot_plain authenticator failed for H=(swingler) [182.95.177.118]:47316: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.78
country_id: 1269750
description:
2026-01-11 12:35:26 dovecot_login authenticator failed for H=([182.95.177.78]) [182.95.177.78]:54068: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2026-01-11 12:36:08 dovecot_login authenticator failed for H=(138.219.244.10.static.softdados.net) [177.128.209.48]:38718: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.83.145.39
country_id: 6252001
description:
Jan 11 12:39:55 host2 dovecot[3239883]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.83.145.39, lip=66.85.158.91, session=<UpUXchdIaJQDU5En>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2026-01-11 12:41:05 dovecot_plain authenticator failed for H=c-67-172-54-29.hsd1.pa.comcast.net (penticon) [67.172.54.29]:52860: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.101.50
country_id: 1269750
description:
2026-01-11 12:41:15 dovecot_login authenticator failed for H=(nsg-corporate-50.101.185.122.airtel.in) [122.185.101.50]:43942: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.252
country_id: 2186224
description:
2026-01-11 12:41:47 dovecot_login authenticator failed for H=([121.73.168.252]) [121.73.168.252]:46732: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.47.94.55
country_id: 1643084
description:
Jan 11 12:41:59 host2 sshd[122057]: Disconnected from invalid user steam 38.47.94.55 port 35520 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.47.94.55
country_id: 1643084
description:
Jan 11 12:42:38 host2 sshd[122748]: Disconnected from invalid user server 38.47.94.55 port 43162 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.68.9.182
country_id: 6252001
description:
Jan 11 12:45:30 host2 sshd[126254]: Disconnected from invalid user admin 138.68.9.182 port 49936 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.68.9.182
country_id: 6252001
description:
Jan 11 12:46:36 host2 sshd[127450]: Disconnected from invalid user secret 138.68.9.182 port 45868 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.68.9.182
country_id: 6252001
description:
Jan 11 12:47:40 host2 sshd[129026]: Disconnected from invalid user deployerer 138.68.9.182 port 54172 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.49
country_id: 290557
description:
Jan 11 12:50:44 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=185.93.89.49, lip=66.85.158.91, session=<oZ6XmBdI3o+5XVkx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.45
country_id: 290557
description:
Jan 11 12:55:00 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=185.93.89.45, lip=66.85.158.91, session=<wUjYpxdIPui5XVkt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.48
country_id: 290557
description:
Jan 11 12:55:33 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=185.93.89.48, lip=66.85.158.91, session=<84jeqRdIBJG5XVkw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.46
country_id: 290557
description:
Jan 11 12:56:46 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=185.93.89.46, lip=66.85.158.91, session=<hAQvrhdIkOa5XVku>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.30
country_id: 290557
description:
Jan 11 12:57:24 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=185.93.89.30, lip=66.85.158.91, session=<WTZ+sBdICKu5XVke>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.202
country_id: 1149361
description:
2026-01-11 12:58:27 dovecot_login authenticator failed for H=([180.94.75.202]) [180.94.75.202]:44195: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.110
country_id: 1269750
description:
2026-01-11 12:59:02 dovecot_login authenticator failed for H=([27.123.111.110]) [27.123.111.110]:59996: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.29
country_id: 290557
description:
Jan 11 13:01:59 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=185.93.89.29, lip=66.85.158.91, session=<iSTiwBdIHNy5XVkd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.27
country_id: 290557
description:
Jan 11 13:01:36 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=185.93.89.27, lip=66.85.158.91, session=<x/x4vxdIEoi5XVkb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.167
country_id: 2993457
description:
Jan 11 13:04:59 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.167, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<Bae1yxdIRv7CpRCn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.28
country_id: 290557
description:
Jan 11 13:05:02 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=185.93.89.28, lip=66.85.158.91, session=<IXiryxdICsW5XVkc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2026-01-11 13:07:23 dovecot_plain authenticator failed for H=c-24-127-53-61.hsd1.mi.comcast.net (neopided) [24.127.53.61]:54992: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 66.85.158.91
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 66.85.158.91: 266 connections per 30 seconds to 8443 port.


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 11 13:16:16 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<gUbx8xdIx7V100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.49
country_id: 290557
description:
Jan 11 13:17:13 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@rehanseo.online>, method=PLAIN, rip=185.93.89.49, lip=66.85.158.91, session=<3EJF9xdIXNq5XVkx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.217.204.91
country_id: 2658434
description:
2026-01-11 13:17:59 dovecot_login authenticator failed for H=adsl-89-217-204-91.adslplus.ch [89.217.204.91]:55122: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.10
country_id: 1269750
description:
2026-01-11 13:18:16 dovecot_login authenticator failed for H=([125.18.244.137]) [182.78.64.10]:55510: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2026-01-11 13:20:39 dovecot_plain authenticator failed for H=(feres) [91.73.188.251]:38520: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.48
country_id: 290557
description:
Jan 11 13:22:35 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=185.93.89.48, lip=66.85.158.91, session=<XtKPChhICoO5XVkw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.45
country_id: 290557
description:
Jan 11 13:22:02 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@rehanseo.online>, method=PLAIN, rip=185.93.89.45, lip=66.85.158.91, session=<oCKECBhICqO5XVkt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-11 13:22:31 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (lairs) [87.103.126.54]:11762: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.30
country_id: 290557
description:
Jan 11 13:24:16 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=185.93.89.30, lip=66.85.158.91, session=<II2PEBhIzK+5XVke>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.46
country_id: 290557
description:
Jan 11 13:23:42 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=185.93.89.46, lip=66.85.158.91, session=<HhF8DhhIFN+5XVku>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.27
country_id: 290557
description:
Jan 11 13:28:37 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 15 secs): user=<hr@rehanseo.online>, method=PLAIN, rip=185.93.89.27, lip=66.85.158.91, session=<gi1bHxhIEu25XVkb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.29
country_id: 290557
description:
Jan 11 13:29:23 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=185.93.89.29, lip=66.85.158.91, session=<Xm7TIhhIKNm5XVkd>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 203.150.162.250
country_id: 1605651
description:
Jan 11 13:29:49 host2 sshd[162037]: Disconnected from invalid user newuser 203.150.162.250 port 48670 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.28
country_id: 290557
description:
Jan 11 13:32:28 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@rehanseo.online>, method=PLAIN, rip=185.93.89.28, lip=66.85.158.91, session=<LxDlLRhIfIm5XVkc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan 11 13:34:39 host2 sshd[163850]: Disconnected from invalid user user 2.57.121.25 port 9791 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.61.176.110
country_id: 3469034
description:
2026-01-11 13:39:46 dovecot_login authenticator failed for H=(177-61-176-110.dsl.telesp.net.br) [177.61.176.110]:46502: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.147.96
country_id: 1733045
description:
2026-01-11 13:40:19 dovecot_login authenticator failed for H=([49.124.147.96]) [49.124.147.96]:37038: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.142.126.37
country_id: 6252001
description:
2026-01-11 13:43:34 dovecot_plain authenticator failed for H=c-69-142-126-37.hsd1.nj.comcast.net (chonis) [69.142.126.37]:46474: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 13:45:28 host2 sshd[172441]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.45
country_id: 6252001
description:
Jan 11 13:46:33 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.45, lip=66.85.158.91, session=<0mhfYBhI9uuTuYQt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.25.232.7
country_id: 953987
description:
Jan 11 13:50:31 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<amila@euroentertainmentlk.com>, method=PLAIN, rip=41.25.232.7, lip=66.85.158.91, session=<ScJwbhhIh/wpGegH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.32.253.235
country_id: 99237
description:
2026-01-11 13:56:52 dovecot_login authenticator failed for H=([213.32.253.235]) [213.32.253.235]:40997: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.76.55.177
country_id: 3175395
description:
2026-01-11 13:57:34 dovecot_login authenticator failed for H=([151.76.55.177]) [151.76.55.177]:54674: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.74.122
country_id: 1149361
description:
2026-01-11 13:58:18 dovecot_login authenticator failed for H=([180.94.74.122]) [180.94.74.122]:59054: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 14:00:43 host2 sshd[184995]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2026-01-11 14:01:14 dovecot_plain authenticator failed for H=(uncepte) [65.20.129.28]:36166: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.66
country_id: 6252001
description:
Jan 11 14:03:05 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=65.49.1.66, lip=66.85.158.91, session=<1yp4mxhIGh1BMQFC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.182
country_id: 6252001
description:
Jan 11 14:03:09 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.182, lip=66.85.158.92, session=</Ue2mxhIUHJAPpy2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-01-11 14:05:55 dovecot_login authenticator failed for H=([50.235.31.47]) [50.235.31.47]:34148: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2026-01-11 14:06:06 dovecot_login authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:59860: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.49
country_id: 290557
description:
Jan 11 14:06:15 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=185.93.89.49, lip=66.85.158.91, session=<7YqsphhIBqq5XVkx>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.238.191.229
country_id: 6252001
description:
Jan 11 14:07:17 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.238.191.229, lip=66.85.158.92, TLS, session=<r5J9qhhIfLED7r/l>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-01-11 14:08:52 dovecot_plain authenticator failed for H=host-196-47-172-253.afnet.net (gourreose) [196.47.172.253]:37330: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.45
country_id: 290557
description:
Jan 11 14:11:54 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=185.93.89.45, lip=66.85.158.91, session=<FjzquhhInLy5XVkt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.48
country_id: 290557
description:
Jan 11 14:12:29 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=185.93.89.48, lip=66.85.158.91, session=<lj4GvRhIZI25XVkw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.46
country_id: 290557
description:
Jan 11 14:13:27 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=185.93.89.46, lip=66.85.158.91, session=<vmp3wBhIwsy5XVku>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.30
country_id: 290557
description:
Jan 11 14:13:48 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=185.93.89.30, lip=66.85.158.91, session=<aXKtwRhIkNi5XVke>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2026-01-11 14:15:25 dovecot_login authenticator failed for H=bb121-6-81-59.singnet.com.sg [121.6.81.59]:49419: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.134.27.194
country_id: 1210997
description:
2026-01-11 14:15:14 dovecot_login authenticator failed for H=([103.134.27.194]) [103.134.27.194]:46212: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.27
country_id: 290557
description:
Jan 11 14:17:56 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=185.93.89.27, lip=66.85.158.91, session=<ZzeA0BhI3Me5XVkb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.165.219
country_id: 1605651
description:
2026-01-11 14:19:38 dovecot_login authenticator failed for H=([106.0.165.219]) [106.0.165.219]:41342: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.29
country_id: 290557
description:
Jan 11 14:19:53 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=185.93.89.29, lip=66.85.158.91, session=<tAZ51xhIJoW5XVkd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.63
country_id: 6252001
description:
Jan 11 14:19:58 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.63, lip=66.85.158.91, TLS: Connection closed, session=<Mabc1xhIEL2nXpI/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.181.107.134
country_id: 2264397
description:
2026-01-11 14:20:01 dovecot_login authenticator failed for H=89-181-107-134.net.novis.pt [89.181.107.134]:38700: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.28
country_id: 290557
description:
Jan 11 14:22:59 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=185.93.89.28, lip=66.85.158.91, session=<gZ6S4hhIduG5XVkc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.227.65.142
country_id: 3469034
description:
2026-01-11 14:27:37 dovecot_login authenticator failed for H=([168.227.65.142]) [168.227.65.142]:50169: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.56.228.149
country_id: 6252001
description:
2026-01-11 14:27:46 dovecot_login authenticator failed for H=ool-6038e495.static.optonline.net [96.56.228.149]:59226: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.173.10.75
country_id: 6252001
description:
2026-01-11 14:34:11 dovecot_login authenticator failed for H=([209.173.10.75]) [209.173.10.75]:51456: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.23
country_id: 1733045
description:
2026-01-11 14:34:24 dovecot_login authenticator failed for H=([49.124.153.23]) [49.124.153.23]:44298: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.172.117
country_id: 1819730
description:
Jan 11 14:36:38 host2 sshd[214764]: Disconnected from invalid user ubuntu 152.32.172.117 port 46050 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.172.117
country_id: 1819730
description:
Jan 11 14:37:23 host2 sshd[215274]: Disconnected from invalid user claude 152.32.172.117 port 49262 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.172.117
country_id: 1819730
description:
Jan 11 14:38:40 host2 sshd[216247]: Disconnected from invalid user teamspeak 152.32.172.117 port 56830 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2026-01-11 14:40:56 dovecot_plain authenticator failed for H=(ingar) [12.150.243.22]:23366: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-01-11 14:46:54 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:47806: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2026-01-11 14:47:35 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:46748: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.156
country_id: 3703430
description:
Jan 11 14:48:21 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=45.227.254.156, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<JVZoPRlIDAgt4/6c>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.162
country_id: 2993457
description:
Jan 11 14:54:58 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.162, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<EMsQVRlIG/7CpRCi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.60.143.30
country_id: 3175395
description:
2026-01-11 15:01:16 dovecot_login authenticator failed for H=([151.60.143.30]) [151.60.143.30]:58739: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.145.54
country_id: 1269750
description:
2026-01-11 15:00:43 dovecot_login authenticator failed for H=([128.185.135.33]) [122.185.145.54]:54266: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-01-11 15:02:28 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:32916: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.153.110
country_id: 290557
description:
2026-01-11 15:02:44 dovecot_login authenticator failed for H=([91.72.153.110]) [91.72.153.110]:50798: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.133.174
country_id: 1819730
description:
Jan 11 15:09:08 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=152.32.133.174, lip=66.85.158.92, TLS handshaking: Connection closed, session=<lBS4hxlIhLmYIIWu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.38
country_id: 1819730
description:
Jan 11 15:09:48 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=45.142.154.38, lip=66.85.158.91, TLS, session=<VtEWihlI6Kgtjpom>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 11 15:14:07 host2 sshd[246903]: Disconnected from invalid user admin 2.57.121.112 port 35473 [preauth]


plugin: ossec
rule: 2501
name: User authentication failure.
description:
2026-01-11 15:19:07 1ves4I-000000013Rw-2a8F <= wordpress@venee.lk U=veneelk P=local S=36252 id=gzuNseTtJwTFoApV8DF2cL9uD2x8e42aP5eumfEoII@coatrent.venee.lk T="Failed login by IP 159.89.203.80 venee.lk/coatrent" for admin@venee.lk


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.30.170
country_id: 3144096
description:
2026-01-11 15:19:05 dovecot_login authenticator failed for H=([178.232.30.170]) [178.232.30.170]:47174: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.50
country_id: 1269750
description:
2026-01-11 15:20:55 dovecot_login authenticator failed for H=([27.123.102.50]) [27.123.102.50]:58842: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.154
country_id: 1269750
description:
2026-01-11 15:21:14 dovecot_login authenticator failed for H=(nsg-corporate-1.193.187.122.airtel.in) [182.95.178.154]:59526: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.61.63
country_id: 1861060
description:
Jan 11 15:23:55 host2 sshd[255995]: Disconnected from invalid user test01 118.193.61.63 port 13910 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.193.61.63
country_id: 1861060
description:
Jan 11 15:24:32 host2 sshd[256610]: Disconnected from invalid user test 118.193.61.63 port 26780 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 14.139.216.56
country_id: 1269750
description:
Jan 11 15:25:46 host2 sshd[257900]: Disconnected from invalid user steam 14.139.216.56 port 55238 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 14.139.216.56
country_id: 1269750
description:
Jan 11 15:26:32 host2 sshd[258626]: Disconnected from invalid user deploy 14.139.216.56 port 38358 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.6.215.53
country_id: 3469034
description:
Jan 11 15:27:08 host2 sshd[259281]: Disconnected from invalid user botuser 69.6.215.53 port 43470 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.18
country_id: 241170
description:
Jan 11 15:28:49 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.18, lip=66.85.158.91, session=<0gb3zRlIdLnE+2YS>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 69.6.215.53
country_id: 3469034
description:
Jan 11 15:28:22 host2 sshd[260415]: Disconnected from invalid user test 69.6.215.53 port 54358 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 15:29:57 host2 sshd[261700]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.52.119.193
country_id: 6252001
description:
2026-01-11 15:32:59 dovecot_plain authenticator failed for H=c-68-52-119-193.hsd1.tn.comcast.net (uvened) [68.52.119.193]:54588: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.155.0.205
country_id: 1605651
description:
Jan 11 15:35:53 host2 sshd[267175]: Disconnected from invalid user user1 122.155.0.205 port 19432 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.199.157.145
country_id: 1880251
description:
Jan 11 15:36:53 host2 sshd[268338]: Disconnected from invalid user test 128.199.157.145 port 60248 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.89.46.251
country_id: 6252001
description:
Jan 11 15:36:07 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=159.89.46.251, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<jXg76BlIgNWfWS77>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.113.48.116
country_id: 3175395
description:
2026-01-11 15:36:08 dovecot_plain authenticator failed for H=mob-109-113-48-116.net.vodafone.it (JKJEX) [109.113.48.116]:56461: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.224.109
country_id: 1880251
description:
Jan 11 15:37:43 host2 sshd[269166]: Disconnected from invalid user teamspeak 45.78.224.109 port 51242 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.134.182
country_id: 1819730
description:
Jan 11 15:37:53 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=152.32.134.182, lip=66.85.158.91, session=<piqO7hlI7m2YIIa2>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 128.199.157.145
country_id: 1880251
description:
Jan 11 15:37:33 host2 sshd[268975]: Disconnected from invalid user postgres 128.199.157.145 port 43206 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.155.0.205
country_id: 1605651
description:
Jan 11 15:37:35 host2 sshd[269000]: Disconnected from invalid user vpn 122.155.0.205 port 57949 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.155.0.205
country_id: 1605651
description:
Jan 11 15:38:50 host2 sshd[270428]: Disconnected from invalid user ftpuser 122.155.0.205 port 45352 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.155.0.205
country_id: 1605651
description:
Jan 11 15:38:14 host2 sshd[269732]: Disconnected from invalid user ubuntu 122.155.0.205 port 61441 [preauth]


plugin: ossec
rule: 2501
name: User authentication failure.
description:
2026-01-11 15:39:28 1vesNz-000000018VS-2C4x <= wordpress@venee.lk U=veneelk P=local S=36245 id=bZPsO9vVq4FNFpTKxSrGhsul0KXzCBAKLbMSaw1CA@coatrent.venee.lk T="Failed login by IP 159.89.203.80 venee.lk/coatrent" for admin@venee.lk


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.52.18
country_id: 798544
description:
Jan 11 15:39:57 host2 sshd[271538]: Disconnected from invalid user test 54.38.52.18 port 56410 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.199.157.145
country_id: 1880251
description:
Jan 11 15:39:37 host2 sshd[271285]: Disconnected from invalid user user1 128.199.157.145 port 48564 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2026-01-11 15:40:27 dovecot_login authenticator failed for H=([152.52.234.46]) [182.95.176.194]:48802: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.187.21.105
country_id: 298795
description:
Jan 11 15:40:51 host2 sshd[272589]: Disconnected from invalid user admin 78.187.21.105 port 39636 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.52.18
country_id: 798544
description:
Jan 11 15:40:31 host2 sshd[272311]: Disconnected from invalid user deploy 54.38.52.18 port 44004 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.183.106.192
country_id: 6252001
description:
2026-01-11 15:40:41 dovecot_login authenticator failed for H=(syn-075-183-106-192.res.spectrum.com) [75.183.106.192]:39935: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.237.125.237
country_id: 6252001
description:
Jan 11 15:40:47 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=135.237.125.237, lip=66.85.158.91, session=<cfXj+BlIKu2H7X3t>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.52.18
country_id: 798544
description:
Jan 11 15:41:37 host2 sshd[273155]: Disconnected from invalid user teamspeak 54.38.52.18 port 44818 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.195.66
country_id: 1269750
description:
2026-01-11 15:41:39 dovecot_login authenticator failed for H=([128.185.169.25]) [125.19.195.66]:39230: 535 Incorrect authentication data (set_id=hostmaster@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.129.13.184
country_id: 1880251
description:
2026-01-11 15:41:57 dovecot_login authenticator failed for H=(184.13.129.180.unknown.m1.com.sg) [180.129.13.184]:56243: 535 Incorrect authentication data (set_id=hostmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-01-11 15:41:12 dovecot_login authenticator failed for H=([197.219.228.242]) [197.219.228.242]:48768: 535 Incorrect authentication data (set_id=hostmaster@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.210.233.234
country_id: 6252001
description:
Jan 11 15:41:25 host2 sshd[273016]: Disconnected from invalid user steam 192.210.233.234 port 55784 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 78.187.21.105
country_id: 298795
description:
Jan 11 15:42:23 host2 sshd[273712]: Disconnected from invalid user frappe 78.187.21.105 port 36698 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.224.109
country_id: 1880251
description:
Jan 11 15:44:39 host2 sshd[275653]: Disconnected from invalid user admin 45.78.224.109 port 57366 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 15:45:15 host2 sshd[276861]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.147
country_id: 2186224
description:
2026-01-11 15:45:12 dovecot_login authenticator failed for H=([121.73.162.147]) [121.73.162.147]:38798: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.174.225.60
country_id: 6252001
description:
Jan 11 15:46:49 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=172.174.225.60, lip=66.85.158.92, session=<S7F7DhpIUOOsruE8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.17
country_id: 241170
description:
Jan 11 15:48:44 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.17, lip=66.85.158.91, session=<i/guFRpI4oXE+2YR>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 18.144.47.94
country_id: 6252001
description:
Jan 11 15:48:52 host2 sshd[280315]: Disconnected from invalid user test 18.144.47.94 port 42716 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.33.91.226
country_id: 357994
description:
Jan 11 15:49:47 host2 sshd[281051]: Disconnected from invalid user user 41.33.91.226 port 57954 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 119.18.55.118
country_id: 1269750
description:
Jan 11 15:49:56 host2 sshd[281193]: Disconnected from invalid user test 119.18.55.118 port 45384 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.33.91.226
country_id: 357994
description:
Jan 11 15:50:22 host2 sshd[281976]: Disconnected from invalid user claude 41.33.91.226 port 42138 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 18.144.47.94
country_id: 6252001
description:
Jan 11 15:50:42 host2 sshd[282296]: Disconnected from invalid user user 18.144.47.94 port 40382 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.57.150
country_id: 1643084
description:
Jan 11 15:51:47 host2 sshd[283417]: Disconnected from invalid user steam 103.179.57.150 port 48836 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 119.18.55.118
country_id: 1269750
description:
Jan 11 15:52:23 host2 sshd[284014]: Disconnected from invalid user user2 119.18.55.118 port 34968 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.38.64
country_id: 1880251
description:
Jan 11 15:52:51 host2 sshd[284445]: Disconnected from invalid user user 128.1.38.64 port 57502 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.168.140.35
country_id: 3469034
description:
2026-01-11 15:54:52 dovecot_login authenticator failed for H=(45.168.140-35.smartlinkfibra.com.br) [45.168.140.35]:43940: 535 Incorrect authentication data (set_id=postmaster@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.10
country_id: 1269750
description:
2026-01-11 15:55:29 dovecot_login authenticator failed for H=([125.18.244.137]) [182.78.64.10]:50956: 535 Incorrect authentication data (set_id=postmaster@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.210.95.88
country_id: 294640
description:
2026-01-11 15:55:53 dovecot_login authenticator failed for H=([46.210.95.88]) [46.210.95.88]:37266: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Jan 11 15:56:22 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<+B2eMBpIlLCLonQW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.232.73.84
country_id: 3469034
description:
Jan 11 15:56:32 host2 sshd[289136]: Disconnected from invalid user postgres 45.232.73.84 port 59042 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.11
country_id: 798549
description:
Jan 11 15:57:01 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.11, lip=66.85.158.92, session=<d4r1MhpIzOxV2ZUL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 119.92.70.82
country_id: 1694008
description:
Jan 11 15:57:05 host2 sshd[289748]: Disconnected from invalid user testuser 119.92.70.82 port 52456 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 119.92.70.82
country_id: 1694008
description:
Jan 11 15:58:23 host2 sshd[290982]: Disconnected from invalid user testuser 119.92.70.82 port 43876 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.232.73.84
country_id: 3469034
description:
Jan 11 15:58:34 host2 sshd[291110]: Disconnected from invalid user secret 45.232.73.84 port 55540 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.232.73.84
country_id: 3469034
description:
Jan 11 15:59:18 host2 sshd[291637]: Disconnected from invalid user testuser 45.232.73.84 port 38502 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.128.218.144
country_id: 798544
description:
Jan 11 16:00:46 host2 sshd[293253]: Disconnected from invalid user secret 57.128.218.144 port 56626 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.34
country_id: 1819730
description:
Jan 11 16:01:02 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=45.142.154.34, lip=66.85.158.92, session=<wKhOQRpImKktjpoi>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 119.92.70.82
country_id: 1694008
description:
Jan 11 16:01:49 host2 sshd[294294]: Disconnected from invalid user claude 119.92.70.82 port 55166 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.128.218.144
country_id: 798544
description:
Jan 11 16:01:55 host2 sshd[294364]: Disconnected from invalid user testuser 57.128.218.144 port 40848 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.216.63.127
country_id: 1835841
description:
Jan 11 16:02:03 host2 sshd[294450]: Disconnected from invalid user testuser 35.216.63.127 port 43654 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.82
country_id: 1269750
description:
2026-01-11 16:02:37 dovecot_login authenticator failed for H=([59.145.212.121]) [182.95.184.82]:44880: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.216.63.127
country_id: 1835841
description:
Jan 11 16:02:43 host2 sshd[295063]: Disconnected from invalid user admin 35.216.63.127 port 61840 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.64.86
country_id: 1269750
description:
2026-01-11 16:02:54 dovecot_login authenticator failed for H=(nsg-corporate-80.50.185.122.airtel.in) [122.186.64.86]:59834: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 57.128.218.144
country_id: 798544
description:
Jan 11 16:02:58 host2 sshd[295240]: Disconnected from invalid user ftpuser 57.128.218.144 port 37238 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.128.218.144
country_id: 798544
description:
Jan 11 16:03:58 host2 sshd[296114]: Disconnected from invalid user claude 57.128.218.144 port 53170 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.137.230
country_id: 1269750
description:
2026-01-11 16:03:13 dovecot_login authenticator failed for H=(abts-north-static-230.137.160.122.airtelbroadband.in) [122.160.137.230]:45643: 535 Incorrect authentication data (set_id=abuse@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.216.63.127
country_id: 1835841
description:
Jan 11 16:03:22 host2 sshd[295708]: Disconnected from invalid user test1 35.216.63.127 port 44504 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.38.64
country_id: 1880251
description:
Jan 11 16:03:32 host2 sshd[295804]: Disconnected from invalid user secret 128.1.38.64 port 38136 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.38.64
country_id: 1880251
description:
Jan 11 16:04:22 host2 sshd[296465]: Disconnected from invalid user user 128.1.38.64 port 44200 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2026-01-11 16:05:38 dovecot_plain authenticator failed for H=(tauccle) [65.20.160.107]:58681: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.206
country_id: 1269750
description:
2026-01-11 16:06:17 dovecot_login authenticator failed for H=([128.185.140.225]) [182.95.176.206]:35480: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.208.177.56
country_id: 6252001
description:
2026-01-11 16:06:26 dovecot_login authenticator failed for H=([74.208.177.56]) [74.208.177.56]:35132: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 128.1.38.64
country_id: 1880251
description:
Jan 11 16:08:54 host2 sshd[300658]: Disconnected from invalid user admin 128.1.38.64 port 52820 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.250.160.76
country_id: 1269750
description:
2026-01-11 16:08:55 dovecot_login authenticator failed for H=([103.250.160.76]) [103.250.160.76]:40008: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.2
country_id: 1269750
description:
2026-01-11 16:09:28 dovecot_login authenticator failed for H=([125.19.173.202]) [152.52.236.2]:49574: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2026-01-11 16:09:42 dovecot_login authenticator failed for H=([83.136.176.12]) [83.136.176.12]:24332: 535 Incorrect authentication data (set_id=abuse@neotechlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.127.101.225
country_id: 1880251
description:
2026-01-11 16:10:11 dovecot_login authenticator failed for H=([101.127.101.225]) [101.127.101.225]:36492: 535 Incorrect authentication data (set_id=abuse)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2026-01-11 16:10:35 dovecot_login authenticator failed for H=([85.19.195.12]) [85.19.195.12]:60872: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.132.221.84
country_id: 1210997
description:
2026-01-11 16:10:46 dovecot_login authenticator failed for H=([103.132.220.252]) [103.132.221.84]:57666: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.25
country_id: 798549
description:
Jan 11 16:14:20 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=85.217.149.25, lip=66.85.158.92, session=<KBbccBpIeN1V2ZUZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.237.113.106
country_id: 587116
description:
2026-01-11 16:18:52 dovecot_login authenticator failed for H=([109.237.113.106]) [109.237.113.106]:52578: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.85
country_id: 1210997
description:
2026-01-11 16:19:08 dovecot_login authenticator failed for H=([103.115.252.60]) [103.115.252.85]:58090: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-01-11 16:20:51 dovecot_plain authenticator failed for H=(heene) [154.144.243.93]:58358: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 11 16:24:56 host2 sshd[316188]: Disconnected from invalid user admin 2.57.121.112 port 40600 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 11 16:27:25 host2 sshd[318239]: Disconnected from invalid user admin 2.57.121.112 port 50414 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.143.101.69
country_id: 3686110
description:
Jan 11 16:34:10 host2 sshd[324976]: Disconnected from invalid user test 190.143.101.69 port 51118 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.213.238.91
country_id: 1210997
description:
Jan 11 16:34:31 host2 sshd[325340]: Disconnected from invalid user secret 103.213.238.91 port 46664 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 11 16:36:02 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<ZpJ6vhpIJsUDjyE/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.143.101.69
country_id: 3686110
description:
Jan 11 16:37:46 host2 sshd[328877]: Disconnected from invalid user claude 190.143.101.69 port 57022 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 11 16:38:10 host2 dovecot[3239883]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<3sYYxhpI7qoDjyE/>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.143.101.69
country_id: 3686110
description:
Jan 11 16:39:00 host2 sshd[330050]: Disconnected from invalid user testuser 190.143.101.69 port 53256 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 11 16:39:32 host2 dovecot[3239883]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<HigCyxpILIMDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 11 16:40:35 host2 dovecot[3239883]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<jBe/zhpIAooDjyE/>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 11 16:41:07 host2 dovecot[3239883]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<dvqs0BpIOLwDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 11 16:41:07 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<4tmn0BpIJrwDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 11 16:42:43 host2 dovecot[3239883]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<Ku9i1hpIUukDjyE/>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 11 16:43:27 host2 dovecot[3239883]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<6vAH2RpIytkDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.25.232.7
country_id: 953987
description:
Jan 11 16:44:52 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<amila@euroentertainmentlk.com>, method=PLAIN, rip=41.25.232.7, lip=66.85.158.91, session=<wRTz3RpIDfwpGegH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.163
country_id: 99237
description:
2026-01-11 16:44:13 dovecot_plain authenticator failed for H=(puglated) [65.20.250.163]:47166: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.176.157.57
country_id: 6252001
description:
2026-01-11 16:44:17 dovecot_plain authenticator failed for H=c-73-176-157-57.hsd1.il.comcast.net (warlene) [73.176.157.57]:52800: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 11 16:44:50 host2 dovecot[3239883]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<ACj83RpIbNUDjyE/>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 187.217.186.18
country_id: 3996063
description:
Jan 11 17:06:53 host2 pure-ftpd[360472]: (?@187.217.186.18) [INFO] New connection from 187.217.186.18


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 17:08:00 host2 sshd[361448]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 187.217.186.18
country_id: 3996063
description:
Jan 11 17:07:26 host2 pure-ftpd[360978]: (?@187.217.186.18) [INFO] New connection from 187.217.186.18


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 187.217.186.18
country_id: 3996063
description:
Jan 11 17:07:27 host2 pure-ftpd[360997]: (?@187.217.186.18) [INFO] New connection from 187.217.186.18


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 187.217.186.18
country_id: 3996063
description:
Jan 11 17:08:09 host2 pure-ftpd[362189]: (?@187.217.186.18) [INFO] New connection from 187.217.186.18


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 187.217.186.18
country_id: 3996063
description:
Jan 11 17:08:09 host2 pure-ftpd[362203]: (?@187.217.186.18) [INFO] New connection from 187.217.186.18


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 187.217.186.18
country_id: 3996063
description:
Jan 11 17:09:07 host2 pure-ftpd[364170]: (?@187.217.186.18) [INFO] New connection from 187.217.186.18


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 187.217.186.18
country_id: 3996063
description:
Jan 11 17:09:07 host2 pure-ftpd[364163]: (?@187.217.186.18) [INFO] New connection from 187.217.186.18


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.51.244
country_id: 6252001
description:
2026-01-11 17:11:23 dovecot_login authenticator failed for H=dummitfradin.com [174.138.51.244]:59456: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 17:14:52 host2 sshd[372084]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.68.220.15
country_id: 6252001
description:
2026-01-11 17:15:41 dovecot_plain authenticator failed for H=c-73-68-220-15.hsd1.ma.comcast.net (paspistis) [73.68.220.15]:47048: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 17:30:16 host2 sshd[387647]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2026-01-11 17:33:41 dovecot_plain authenticator failed for H=c-73-13-220-220.hsd1.de.comcast.net (endereae) [73.13.220.220]:41096: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.241.202.104
country_id: 6252001
description:
2026-01-11 17:33:41 dovecot_plain authenticator failed for H=cm-72-241-202-104.buckeyecom.net (ponnoccal) [72.241.202.104]:59866: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.10
country_id: 1269750
description:
2026-01-11 17:35:39 dovecot_login authenticator failed for H=([182.95.20.28]) [182.95.228.10]:52164: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2026-01-11 17:35:50 dovecot_plain authenticator failed for H=c-67-172-54-29.hsd1.pa.comcast.net (afting) [67.172.54.29]:53996: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.35.178.104
country_id: 732800
description:
2026-01-11 17:35:51 dovecot_plain authenticator failed for H=(kneigna) [46.35.178.104]:53318: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.242.112.200
country_id: 1269750
description:
2026-01-11 17:36:11 dovecot_login authenticator failed for H=(static-154-209-252-178.pol.net.in) [121.242.112.200]:57464: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.83.130.80
country_id: 1269750
description:
2026-01-11 17:36:37 dovecot_login authenticator failed for H=(80.130.83.103.static.rapidnet.in) [103.83.130.80]:43211: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.239.182
country_id: 1269750
description:
2026-01-11 17:37:43 dovecot_login authenticator failed for H=([128.185.217.84]) [128.185.239.182]:39416: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.218.26
country_id: 1269750
description:
2026-01-11 17:38:03 dovecot_login authenticator failed for H=(nsg-corporate-191.126.187.122.airtel.in) [182.66.218.26]:42334: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.161.96.107
country_id: 6252001
description:
2026-01-11 17:41:32 dovecot_plain authenticator failed for H=c-73-161-96-107.hsd1.mi.comcast.net (darac) [73.161.96.107]:37608: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 9.234.8.54
country_id: 6252001
description:
Jan 11 17:43:23 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=9.234.8.54, lip=66.85.158.91, session=<QgdfrxtILJ8J6gg2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.49
country_id: 290557
description:
Jan 11 17:48:08 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@venee.lk>, method=PLAIN, rip=185.93.89.49, lip=66.85.158.91, session=<zBkuwBtIkOW5XVkx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.190.155.43
country_id: 6252001
description:
2026-01-11 17:49:55 dovecot_plain authenticator failed for H=(undcal) [76.190.155.43]:35424: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.153
country_id: 1733045
description:
2026-01-11 17:50:09 dovecot_login authenticator failed for H=([49.124.152.153]) [49.124.152.153]:47370: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.121
country_id: 6252001
description:
2026-01-11 17:50:43 dovecot_login authenticator failed for H=([209.23.72.121]) [209.23.72.121]:35952: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.31.197.108
country_id: 6252001
description:
2026-01-11 17:51:44 dovecot_login authenticator failed for H=(173-31-197-108.client.mchsi.com) [173.31.197.108]:41124: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.12
country_id: 1269750
description:
2026-01-11 17:53:15 dovecot_login authenticator failed for H=(nsg-corporate-12.226.187.122.airtel.in) [122.187.226.12]:36147: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.190.68.63
country_id: 6252001
description:
Jan 11 17:55:01 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=146.190.68.63, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<Pczw2BtIxIySvkQ/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.55.99.64
country_id: 6252001
description:
Jan 11 17:55:59 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.55.99.64, lip=66.85.158.92, session=<NDhu3BtITOIUN2NA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-11 17:57:06 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:29888: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2026-01-11 17:57:15 dovecot_plain authenticator failed for H=c-73-145-107-251.hsd1.mi.comcast.net (foriving) [73.145.107.251]:49764: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.172.176.93
country_id: 2921044
description:
Jan 11 17:57:25 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=167.172.176.93, lip=66.85.158.92, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<7KqI4RtIS+SnrLBd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-01-11 17:57:34 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:53762: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.99.136.12
country_id: 2921044
description:
Jan 11 17:58:01 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=167.99.136.12, lip=66.85.158.92, TLS handshaking: Connection closed, session=<V3Wo4xtIquGnY4gM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2026-01-11 17:57:18 dovecot_plain authenticator failed for H=(muffer) [24.105.248.218]:52292: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2026-01-11 17:57:27 dovecot_login authenticator failed for H=([103.51.26.198]) [103.51.26.198]:53667: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-01-11 17:57:44 dovecot_login authenticator failed for H=(227.69.57.37.triolan.net) [37.57.69.227]:52085: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.45
country_id: 290557
description:
Jan 11 17:58:33 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=185.93.89.45, lip=66.85.158.91, session=<0Lhw5RtIMpa5XVkt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2026-01-11 17:58:36 dovecot_plain authenticator failed for H=c-174-166-153-20.hsd1.nj.comcast.net (samices) [174.166.153.20]:41922: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.30
country_id: 290557
description:
Jan 11 17:59:54 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=185.93.89.30, lip=66.85.158.91, session=<j78/6htITNC5XVke>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.48
country_id: 290557
description:
Jan 11 17:59:48 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=185.93.89.48, lip=66.85.158.91, session=<fWT36RtIdsG5XVkw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2026-01-11 18:02:13 dovecot_login authenticator failed for H=(237-166.adsl.static.espeed.com.bn) [119.160.166.237]:45114: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.23.140
country_id: 3144096
description:
2026-01-11 18:02:23 dovecot_login authenticator failed for H=([178.232.23.140]) [178.232.23.140]:34853: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.46
country_id: 290557
description:
Jan 11 18:02:32 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@venee.lk>, method=PLAIN, rip=185.93.89.46, lip=66.85.158.91, session=<Q9Gu8xtIEOS5XVku>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.102.148.242
country_id: 6252001
description:
2026-01-11 18:02:33 dovecot_login authenticator failed for H=syn-098-102-148-242.biz.spectrum.com [98.102.148.242]:35628: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.169.113
country_id: 2635167
description:
2026-01-11 18:03:31 dovecot_login authenticator failed for H=(165-220-169-113.cust.exede.net) [165.220.169.113]:46692: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.29
country_id: 290557
description:
Jan 11 18:10:59 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=185.93.89.29, lip=66.85.158.91, session=<XgvzERxI2ru5XVkd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.209.67
country_id: 933860
description:
Jan 11 18:13:46 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=41.216.209.67, lip=66.85.158.91, TLS, session=<xJvdGhxIrYsp2NFD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.44.140.203
country_id: 690791
description:
Jan 11 18:14:04 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<careers>, method=PLAIN, rip=194.44.140.203, lip=66.85.158.91, TLS, session=<aGgaHBxI+w3CLIzL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.28
country_id: 290557
description:
Jan 11 18:14:05 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=185.93.89.28, lip=66.85.158.91, session=<H2oAHRxIgJS5XVkc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.131.211.168
country_id: 690791
description:
2026-01-11 18:14:41 dovecot_login authenticator failed for H=([94.131.211.168]) [94.131.211.168]:49002: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.20.228.20
country_id: 1269750
description:
2026-01-11 18:14:51 dovecot_login authenticator failed for H=([157.20.228.20]) [157.20.228.20]:33144: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.246.199
country_id: 453733
description:
2026-01-11 18:16:37 dovecot_login authenticator failed for H=199-246-29-85.dyn.estpak.ee [85.29.246.199]:44442: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.40.221
country_id: 1269750
description:
2026-01-11 18:16:56 dovecot_login authenticator failed for H=([122.169.40.221]) [122.169.40.221]:42144: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-11 18:17:52 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (aming) [87.103.126.54]:60729: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.209.108.42
country_id: 6254930
description:
2026-01-11 18:19:11 dovecot_plain authenticator failed for H=(forrento) [185.209.108.42]:49498: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.184.80
country_id: 99237
description:
2026-01-11 18:22:20 dovecot_plain authenticator failed for H=(goyis) [65.20.184.80]:57499: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-01-11 18:30:28 dovecot_plain authenticator failed for H=(mangratume) [102.53.15.17]:54034: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.227.136
country_id: 2921044
description:
Jan 11 18:34:25 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (disconnected before auth was ready, waited 0 secs): user=<>, rip=164.92.227.136, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<No7XZRxIN0GkXOOI>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.189.21
country_id: 1819730
description:
Jan 11 18:34:59 host2 sshd[450874]: Disconnected from invalid user minecraft 152.32.189.21 port 44638 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.244.15
country_id: 2921044
description:
Jan 11 18:35:02 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=164.92.244.15, lip=66.85.158.91, TLS handshaking: Connection closed, session=<SbIMaBxIVqmkXPQP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.70
country_id: 1269750
description:
2026-01-11 18:35:27 dovecot_login authenticator failed for H=([182.66.214.70]) [182.66.214.70]:37554: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.10
country_id: 1269750
description:
2026-01-11 18:35:41 dovecot_login authenticator failed for H=([128.185.241.106]) [182.95.54.10]:50584: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.109.56.73
country_id: 6252001
description:
2026-01-11 18:37:46 dovecot_login authenticator failed for H=(dfw-206-109-56-73.ip4.99.network) [206.109.56.73]:43092: 535 Incorrect authentication data (set_id=abuse@kamecho.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.140.218.210
country_id: 1269750
description:
2026-01-11 18:38:45 dovecot_login authenticator failed for H=(14.140.218.210.Static-bangalore-vsnl.net.in) [14.140.218.210]:56117: 535 Incorrect authentication data (set_id=abuse)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.170.42
country_id: 1819730
description:
Jan 11 18:42:42 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=152.32.170.42, lip=66.85.158.91, TLS handshaking: Connection closed, session=<MemCgxxIev+YIKoq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.242
country_id: 3996063
description:
2026-01-11 18:49:50 dovecot_login authenticator failed for H=([177.236.146.242]) [177.236.146.242]:36365: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.181.19.144
country_id: 1527747
description:
2026-01-11 18:50:38 dovecot_login authenticator failed for H=(158.181.19.144.mega.kg) [158.181.19.144]:43472: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 11 18:50:52 host2 sshd[466942]: Disconnected from invalid user admin 2.57.121.112 port 50959 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 18:53:53 host2 sshd[469626]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.196.42.114
country_id: 2077456
description:
2026-01-11 18:56:03 dovecot_login authenticator failed for H=(203-196-42-114.static.dsl.net.au) [203.196.42.114]:37302: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 18:56:54 host2 sshd[472677]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.211.94.35
country_id: 289688
description:
2026-01-11 18:56:19 dovecot_login authenticator failed for H=([37.211.94.35]) [37.211.94.35]:51234: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.96.83
country_id: 3469034
description:
Jan 11 18:59:23 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=191.240.96.83, lip=66.85.158.91, TLS, session=<0ir3vRxINty/8GBT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 83.143.24.188
country_id: 933860
description:
Jan 11 18:59:45 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<env_eng>, method=PLAIN, rip=83.143.24.188, lip=66.85.158.91, TLS, session=<e5VDvxxIqIlTjxi8>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 19:00:21 host2 sshd[475659]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.47.136.71
country_id: 3175395
description:
Jan 11 19:05:49 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<env_eng>, method=PLAIN, rip=185.47.136.71, lip=66.85.158.91, TLS, session=<A2sr1RxI99C5L4hH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.16.88.108
country_id: 1269750
description:
Jan 11 19:05:31 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 27 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=210.16.88.108, lip=66.85.158.91, TLS, session=<ATl50xxI2eXSEFhs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.4.138
country_id: 1733045
description:
2026-01-11 19:05:49 dovecot_login authenticator failed for H=([183.171.4.138]) [183.171.4.138]:53906: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.157.128.165
country_id: 1861060
description:
2026-01-11 19:06:13 dovecot_login authenticator failed for H=s128165.ppp.asahi-net.or.jp [220.157.128.165]:52295: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-11 19:14:01 dovecot_plain authenticator failed for H=(goory) [64.72.74.162]:46522: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 19:15:53 host2 sshd[491616]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 192.241.142.175
country_id: 6252001
description:
Jan 11 19:27:35 host2 dovecot[3239883]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=192.241.142.175, lip=66.85.158.92, TLS, session=<XJ4CJB1IQqXA8Y6v>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.208
country_id: 2542007
description:
2026-01-11 19:33:02 dovecot_plain authenticator failed for H=(muslodonic) [154.144.255.208]:59430: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-11 19:33:01 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (lomac) [87.103.126.54]:23622: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.25.232.7
country_id: 953987
description:
Jan 11 19:37:54 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<amila@euroentertainmentlk.com>, method=PLAIN, rip=41.25.232.7, lip=66.85.158.91, session=<8y+wSB1IiNgpGegH>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.53.215.134
country_id: 3658394
description:
Jan 11 19:41:51 host2 sshd[515345]: Disconnected from invalid user test 177.53.215.134 port 48210 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.53.215.134
country_id: 3658394
description:
Jan 11 19:42:28 host2 sshd[515844]: Disconnected from invalid user secret 177.53.215.134 port 59306 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2026-01-11 19:45:47 dovecot_plain authenticator failed for H=c-73-196-144-25.hsd1.nj.comcast.net (coema) [73.196.144.25]:41264: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.172.205.208
country_id: 1643084
description:
Jan 11 19:46:43 host2 sshd[521661]: Disconnected from invalid user user2 103.172.205.208 port 57902 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.47.10.10
country_id: 3469034
description:
Jan 11 19:48:50 host2 sshd[525038]: Disconnected from invalid user testuser 189.47.10.10 port 33824 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.182.83.231
country_id: 2510769
description:
Jan 11 19:51:22 host2 sshd[529088]: Disconnected from invalid user claude 5.182.83.231 port 37538 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 5.182.83.231
country_id: 2510769
description:
Jan 11 19:52:19 host2 sshd[529816]: Disconnected from invalid user admin 5.182.83.231 port 46036 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.182.83.231
country_id: 2510769
description:
Jan 11 19:53:13 host2 sshd[530460]: Disconnected from invalid user ubuntu 5.182.83.231 port 43490 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.47.10.10
country_id: 3469034
description:
Jan 11 19:54:35 host2 sshd[531818]: Disconnected from invalid user secret 189.47.10.10 port 51268 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.47.10.10
country_id: 3469034
description:
Jan 11 19:55:34 host2 sshd[532988]: Disconnected from invalid user user 189.47.10.10 port 52908 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.47.10.10
country_id: 3469034
description:
Jan 11 19:56:31 host2 sshd[533789]: Disconnected from invalid user frappe 189.47.10.10 port 50840 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 11 20:05:58 host2 sshd[543779]: Disconnected from invalid user admin 2.57.121.112 port 53069 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.119
country_id: 6252001
description:
Jan 11 20:11:00 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=162.216.150.119, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<A+hFvx1IMtui2JZ3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.119
country_id: 6252001
description:
Jan 11 20:11:56 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=162.216.150.119, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<i3KYwh1IeO6i2JZ3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-11 20:13:35 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (laystron) [87.103.126.54]:51447: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.119
country_id: 6252001
description:
Jan 11 20:17:52 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=162.216.150.119, lip=66.85.158.92, TLS, session=<Vk/O1x1Iuv2i2JZ3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.57.194
country_id: 1269750
description:
2026-01-11 20:18:58 dovecot_login authenticator failed for H=([182.79.126.100]) [182.95.57.194]:45644: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.251.233.179
country_id: 798544
description:
2026-01-11 20:18:24 dovecot_login authenticator failed for H=apn-87-251-233-179.static.gprs.plus.pl [87.251.233.179]:47235: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.245.38
country_id: 1269750
description:
2026-01-11 20:19:48 dovecot_login authenticator failed for H=([152.52.245.38]) [152.52.245.38]:43072: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.75.93
country_id: 1880251
description:
2026-01-11 20:20:05 dovecot_login authenticator failed for H=(93.75.245.49.unknown.m1.com.sg) [49.245.75.93]:43616: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.12
country_id: 1733045
description:
2026-01-11 20:20:20 dovecot_login authenticator failed for H=([49.124.152.12]) [49.124.152.12]:53322: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.186.81.8
country_id: 3469034
description:
2026-01-11 20:20:22 dovecot_login authenticator failed for H=([45.186.81.8]) [45.186.81.8]:56803: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 20:21:57 host2 sshd[559449]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.5.246
country_id: 690791
description:
Jan 11 20:27:33 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=176.103.5.246, lip=66.85.158.91, TLS, session=<KwVg+R1IA8ywZwX2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.208.106.186
country_id: 3175395
description:
Jan 11 20:27:51 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<env_eng>, method=PLAIN, rip=185.208.106.186, lip=66.85.158.91, TLS, session=<MSeD+h1IZMm50Gq6>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 20:28:54 host2 sshd[565967]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-11 20:30:31 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (scophy) [87.103.126.54]:40039: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.7.187.152
country_id: 3469034
description:
Jan 11 20:34:07 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=45.7.187.152, lip=66.85.158.91, TLS, session=<lovTEB5IULctB7uY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.99
country_id: 3469034
description:
Jan 11 20:34:27 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<env_eng>, method=PLAIN, rip=190.89.137.99, lip=66.85.158.91, TLS, session=<JsoMEh5IMtq+WYlj>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.227.254.155
country_id: 3703430
description:
Jan 11 20:40:44 host2 pure-ftpd[578037]: (?@45.227.254.155) [INFO] New connection from 45.227.254.155


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.145.10.140
country_id: 6252001
description:
2026-01-11 20:40:27 dovecot_plain authenticator failed for H=c-76-145-10-140.hsd1.ga.comcast.net (unced) [76.145.10.140]:56420: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.190.22.247
country_id: 2750405
description:
Jan 11 20:42:28 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=146.190.22.247, lip=66.85.158.91, session=<v5exLx5I/OCSvhb3>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 20:44:24 host2 sshd[581820]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.22.121.52
country_id: 2635167
description:
Jan 11 20:51:56 host2 dovecot[3239883]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 1 secs): user=<>, rip=165.22.121.52, lip=66.85.158.91, TLS, session=<672hUR5IMI2lFnk0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.170.251.33
country_id: 2017370
description:
2026-01-11 20:58:45 dovecot_login authenticator failed for H=(178.170.251.33.leadertelecom.ru) [178.170.251.33]:50942: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2026-01-11 20:59:11 dovecot_login authenticator failed for H=([27.123.119.235]) [122.185.176.126]:39212: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.128.151.92
country_id: 6252001
description:
2026-01-11 21:00:50 dovecot_login authenticator failed for H=c-73-128-151-92.hsd1.de.comcast.net [73.128.151.92]:59354: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
country_id: 6252001
description:
2026-01-11 21:01:37 dovecot_login authenticator failed for H=c-71-229-1-186.hsd1.al.comcast.net [71.229.1.186]:47344: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.44
country_id: 1819730
description:
Jan 11 21:03:45 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 6 secs): user=<>, rip=45.142.154.44, lip=66.85.158.92, session=<ACzxex5I9Ngtjpos>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.49
country_id: 290557
description:
Jan 11 21:05:47 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=185.93.89.49, lip=66.85.158.91, session=<mxgPgx5IONS5XVkx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.43.254.214
country_id: 732800
description:
2026-01-11 21:06:40 dovecot_login authenticator failed for H=cable-84-43-254-214.mnet.bg [84.43.254.214]:37451: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.40.212
country_id: 290557
description:
2026-01-11 21:07:05 dovecot_login authenticator failed for H=([5.31.40.212]) [5.31.40.212]:48587: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.49
country_id: 290557
description:
Jan 11 21:10:13 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=185.93.89.49, lip=66.85.158.91, session=<iyLlkh5IEtW5XVkx>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 21:11:37 host2 sshd[609779]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.56.236
country_id: 953987
description:
Jan 11 21:12:43 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=102.129.56.236, lip=66.85.158.91, TLS, session=<6/3Kmh5Iq7hmgTjs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.66.6.155
country_id: 953987
description:
Jan 11 21:13:05 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<careers>, method=PLAIN, rip=102.66.6.155, lip=66.85.158.91, TLS, session=<f5ggnB5Ik9FmQgab>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 21:17:41 host2 sshd[616224]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.11
country_id: 241170
description:
Jan 11 21:17:51 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.11, lip=66.85.158.91, session=<23E/rh5Iot3E+2YL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.30
country_id: 290557
description:
Jan 11 21:20:21 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=185.93.89.30, lip=66.85.158.91, session=<hd0xtx5Iori5XVke>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.48
country_id: 290557
description:
Jan 11 21:21:38 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=185.93.89.48, lip=66.85.158.91, session=<GcbFux5Iquy5XVkw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.41.137
country_id: 337996
description:
2026-01-11 21:22:43 dovecot_login authenticator failed for H=([196.190.43.138]) [196.190.41.137]:46270: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.60.146
country_id: 1269750
description:
2026-01-11 21:23:18 dovecot_login authenticator failed for H=([182.95.60.146]) [182.95.60.146]:36468: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.30
country_id: 290557
description:
Jan 11 21:24:51 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=185.93.89.30, lip=66.85.158.91, session=<CdZExx5IINa5XVke>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.46
country_id: 290557
description:
Jan 11 21:25:02 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=185.93.89.46, lip=66.85.158.91, session=<ELPsxx5IAIa5XVku>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.212.27.150
country_id: 6252001
description:
2026-01-11 21:25:38 dovecot_login authenticator failed for H=([50.212.27.146]) [50.212.27.150]:45656: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.48
country_id: 290557
description:
Jan 11 21:26:07 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=185.93.89.48, lip=66.85.158.91, session=<sfHCyx5IgMu5XVkw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.228.235.21
country_id: 3508796
description:
2026-01-11 21:26:45 dovecot_login authenticator failed for H=([168.228.235.21]) [168.228.235.21]:59214: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.19.165.90
country_id: 3469034
description:
2026-01-11 21:28:07 dovecot_login authenticator failed for H=(secovi-rs.pae.gvt.net.br) [177.19.165.90]:60435: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.202.4
country_id: 99237
description:
2026-01-11 21:28:35 dovecot_login authenticator failed for H=([65.20.202.4]) [65.20.202.4]:39454: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.46
country_id: 290557
description:
Jan 11 21:29:31 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=185.93.89.46, lip=66.85.158.91, session=<afX21x5IyoK5XVku>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 138.197.182.211
country_id: 2921044
description:
Jan 11 21:31:26 host2 pure-ftpd[630910]: (?@138.197.182.211) [INFO] New connection from 138.197.182.211


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.29
country_id: 290557
description:
Jan 11 21:33:59 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=185.93.89.29, lip=66.85.158.91, session=<s2Xl5x5ItLi5XVkd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-01-11 21:35:50 dovecot_plain authenticator failed for H=(etitchings) [154.144.243.93]:52852: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2026-01-11 21:36:10 dovecot_login authenticator failed for H=([103.50.5.94]) [103.50.5.94]:39303: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.28
country_id: 290557
description:
Jan 11 21:36:51 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=185.93.89.28, lip=66.85.158.91, session=<uEkv8h5IfKm5XVkc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.29
country_id: 290557
description:
Jan 11 21:38:41 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=185.93.89.29, lip=66.85.158.91, session=<JkO9+B5IMIu5XVkd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2026-01-11 21:39:49 dovecot_login authenticator failed for H=([192.34.128.202]) [192.34.128.202]:43266: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-01-11 21:40:20 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:49821: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.28
country_id: 290557
description:
Jan 11 21:41:19 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=185.93.89.28, lip=66.85.158.91, session=<HPgmAh9IuJq5XVkc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.161.168.8
country_id: 6252001
description:
Jan 11 21:41:22 host2 sshd[640378]: Disconnected from invalid user odoo 23.161.168.8 port 58810 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.142.110.144
country_id: 2635167
description:
Jan 11 21:41:53 host2 sshd[640902]: Disconnected from invalid user ec2-user 34.142.110.144 port 41196 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.214.11.146
country_id: 2921044
description:
Jan 11 21:42:13 host2 sshd[641232]: Disconnected from invalid user odoo 95.214.11.146 port 60672 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.142.110.144
country_id: 2635167
description:
Jan 11 21:42:28 host2 sshd[641507]: Disconnected from invalid user developer 34.142.110.144 port 52390 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.96.189.27
country_id: 298795
description:
2026-01-11 21:45:29 dovecot_plain authenticator failed for H=(stagic) [85.96.189.27]:50376: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 23.161.168.8
country_id: 6252001
description:
Jan 11 21:47:06 host2 sshd[646040]: Disconnected from invalid user sshadmin 23.161.168.8 port 57812 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.214.11.146
country_id: 2921044
description:
Jan 11 21:47:31 host2 sshd[646417]: Disconnected from invalid user varnish 95.214.11.146 port 53808 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.161.168.8
country_id: 6252001
description:
Jan 11 21:47:33 host2 sshd[646471]: Disconnected from invalid user ts1 23.161.168.8 port 43514 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.49
country_id: 290557
description:
Jan 11 21:47:10 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=185.93.89.49, lip=66.85.158.91, session=<Ij0UFx9Itr25XVkx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.18.99.126
country_id: 1269750
description:
2026-01-11 21:59:03 dovecot_login authenticator failed for H=([125.18.99.126]) [125.18.99.126]:57598: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.181.27.37
country_id: 3923057
description:
Jan 11 21:59:51 host2 sshd[672559]: Disconnected from invalid user git 190.181.27.37 port 35170 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.118.138
country_id: 3144096
description:
2026-01-11 21:59:16 dovecot_login authenticator failed for H=([46.212.118.138]) [46.212.118.138]:38536: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 22:00:42 host2 sshd[673432]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.27.37
country_id: 3923057
description:
Jan 11 22:00:31 host2 sshd[673483]: Disconnected from invalid user tester 190.181.27.37 port 40184 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.30
country_id: 290557
description:
Jan 11 22:02:40 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=185.93.89.30, lip=66.85.158.91, session=<S92GTh9IktW5XVke>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.30
country_id: 290557
description:
Jan 11 22:03:35 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=185.93.89.30, lip=66.85.158.91, session=<4OPDUR9IPMK5XVke>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.48
country_id: 290557
description:
Jan 11 22:03:51 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=185.93.89.48, lip=66.85.158.91, session=<Hty+Uh9IvNC5XVkw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.48
country_id: 290557
description:
Jan 11 22:04:45 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=185.93.89.48, lip=66.85.158.91, session=<g7j5VR9Iyuu5XVkw>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.198
country_id: 6252001
description:
Jan 11 22:05:29 host2 pure-ftpd[679194]: (?@205.210.31.198) [INFO] New connection from 205.210.31.198


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.46
country_id: 290557
description:
Jan 11 22:07:21 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=185.93.89.46, lip=66.85.158.91, session=<UUA4Xx9IDpq5XVku>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.153.110
country_id: 290557
description:
2026-01-11 22:08:05 dovecot_login authenticator failed for H=([91.72.153.110]) [91.72.153.110]:33874: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.46
country_id: 290557
description:
Jan 11 22:08:16 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=185.93.89.46, lip=66.85.158.91, session=<l0x/Yh9I2LC5XVku>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-01-11 22:08:37 dovecot_login authenticator failed for H=([200.106.49.149]) [200.106.49.149]:33726: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.234
country_id: 2635167
description:
Jan 11 22:12:04 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=35.203.210.234, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<hBk+cB9I89Ajy9Lq>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 22:14:37 host2 sshd[689744]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2026-01-11 22:14:33 dovecot_plain authenticator failed for H=(unianthuto) [102.53.15.180]:47213: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.29
country_id: 290557
description:
Jan 11 22:18:44 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=185.93.89.29, lip=66.85.158.91, session=<UtHshx9IRKi5XVkd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.234
country_id: 2635167
description:
Jan 11 22:19:10 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.234, lip=66.85.158.91, TLS, session=<mrekiR9IovYjy9Lq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.28
country_id: 290557
description:
Jan 11 22:19:28 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=185.93.89.28, lip=66.85.158.91, session=<W2aPih9I8pG5XVkc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.29
country_id: 290557
description:
Jan 11 22:19:38 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=185.93.89.29, lip=66.85.158.91, session=<CG4zix9Ioqi5XVkd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.28
country_id: 290557
description:
Jan 11 22:20:22 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@nsteeleng.com>, method=PLAIN, rip=185.93.89.28, lip=66.85.158.91, session=<w4zQjR9IVOy5XVkc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-11 22:23:27 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (brallinain) [87.103.126.54]:14589: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.25.232.7
country_id: 953987
description:
Jan 11 22:23:45 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<amila@euroentertainmentlk.com>, method=PLAIN, rip=41.25.232.7, lip=66.85.158.91, session=<VL/jmR9Ig+UpGegH>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 22:25:31 host2 sshd[701639]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.227.70
country_id: 1269750
description:
2026-01-11 22:25:51 dovecot_login authenticator failed for H=(dsl-ncr-dynamic-145.59.23.125.airtelbroadband.in) [182.95.227.70]:53308: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.60.142
country_id: 1269750
description:
2026-01-11 22:26:11 dovecot_login authenticator failed for H=(nsg-corporate-142.60.186.122.airtel.in) [122.186.60.142]:50430: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.162
country_id: 2993457
description:
Jan 11 22:27:23 host2 pure-ftpd[703643]: (?@194.165.16.162) [INFO] New connection from 194.165.16.162


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.221.130
country_id: 1269750
description:
2026-01-11 22:29:02 dovecot_login authenticator failed for H=(nsg-corporate-130.221.187.122.airtel.in) [122.187.221.130]:33612: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.182.130
country_id: 1269750
description:
2026-01-11 22:29:33 dovecot_login authenticator failed for H=([182.95.182.130]) [182.95.182.130]:46576: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 22:30:09 host2 sshd[706233]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 54.145.158.145
country_id: 6252001
description:
Jan 11 22:30:20 host2 pure-ftpd[706438]: (?@54.145.158.145) [INFO] New connection from 54.145.158.145


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.120
country_id: 2635167
description:
Jan 11 22:31:24 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.120, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<jMlhtR9IU52594l4>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.212
country_id: 2635167
description:
Jan 11 22:31:23 host2 dovecot[3239883]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.212, lip=66.85.158.92, TLS, session=<o+ZRtR9Iq7VX7LDU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.139
country_id: 2635167
description:
Jan 11 22:31:57 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.139, lip=66.85.158.92, TLS handshaking: Connection closed, session=<ETxdtx9IIbC594mL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.143
country_id: 2635167
description:
Jan 11 22:32:31 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=87.236.176.143, lip=66.85.158.92, TLS handshaking: Connection closed, session=<bpxYuR9Io+lX7LCP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.144
country_id: 2635167
description:
Jan 11 22:33:04 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.144, lip=66.85.158.92, TLS handshaking: Connection closed, session=<ARpUux9IC7i594mQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.128
country_id: 2635167
description:
Jan 11 22:33:37 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.128, lip=66.85.158.92, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<amZPvR9IqcC594mA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.129
country_id: 2635167
description:
Jan 11 22:34:10 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (disconnected before auth was ready, waited 0 secs): user=<>, rip=185.247.137.129, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<lcZIvx9IPa6594mB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.132
country_id: 2635167
description:
Jan 11 22:34:44 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.132, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<EANGwR9I55e594mE>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 22:35:41 host2 sshd[711734]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.135
country_id: 2635167
description:
Jan 11 22:35:17 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.135, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<XmVBwx9Id7BX7LCH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.126
country_id: 2635167
description:
Jan 11 22:35:50 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.126, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<f8I6xR9Ig9VX7LB+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.128
country_id: 2635167
description:
Jan 11 22:36:24 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.128, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<JalCxx9IT8BX7LCA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2026-01-11 22:39:03 dovecot_plain authenticator failed for H=(adoaterhal) [65.20.160.107]:32852: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 22:39:51 host2 sshd[715348]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.16.7.82
country_id: 6252001
description:
2026-01-11 22:39:45 dovecot_plain authenticator failed for H=c-76-16-7-82.hsd1.il.comcast.net (denon) [76.16.7.82]:38343: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.85.144
country_id: 1269750
description:
2026-01-11 22:43:59 dovecot_login authenticator failed for H=(abts-north-static-144.85.160.122.airtelbroadband.in) [122.160.85.144]:56596: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.38.130
country_id: 1210997
description:
2026-01-11 22:44:16 dovecot_login authenticator failed for H=([49.0.38.130]) [49.0.38.130]:34544: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 22:49:22 host2 sshd[724725]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 168.0.226.42
country_id: 3469034
description:
Jan 11 22:52:05 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=168.0.226.42, lip=66.85.158.91, TLS, session=<tA89/h9IFraoAOIq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.44.140.32
country_id: 690791
description:
Jan 11 22:52:24 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<env_eng>, method=PLAIN, rip=194.44.140.32, lip=66.85.158.91, TLS, session=<1FBs/x9Ip7vCLIwg>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.236.228.193
country_id: 6252001
description:
Jan 11 22:53:03 host2 pure-ftpd[728252]: (?@172.236.228.193) [INFO] New connection from 172.236.228.193


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.246.199.216
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.246.199.216: 250 connections per 30 seconds to 443 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.220.88.67
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.220.88.67: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.220.3.101
country_id: 226074
description:
Jan 11 22:59:30 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=41.220.3.101, lip=66.85.158.91, TLS, session=<s/rIGCBI0K0p3ANl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.219.80
country_id: 3144096
description:
2026-01-11 22:59:33 dovecot_login authenticator failed for H=([84.210.219.80]) [84.210.219.80]:46133: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.211.236.187
country_id: 3175395
description:
2026-01-11 22:59:36 dovecot_plain authenticator failed for H=([80.211.236.187]) [80.211.236.187]:49251: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 52.25.240.159
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 52.25.240.159: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.59.97.98
country_id: 2661886
description:
Jan 11 22:59:46 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 15 secs): user=<587hr>, method=PLAIN, rip=46.59.97.98, lip=66.85.158.91, TLS, session=<84rtGSBIRJUuO2Fi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.18.99.38
country_id: 1269750
description:
2026-01-11 23:00:10 dovecot_login authenticator failed for H=([182.95.20.225]) [125.18.99.38]:56406: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.170.1.244
country_id: 3017382
description:
2026-01-11 23:00:20 dovecot_login authenticator failed for H=176-170-1-244.abo.bbox.fr [176.170.1.244]:46708: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2026-01-11 23:00:47 dovecot_login authenticator failed for H=([62.220.236.203]) [62.220.236.203]:48206: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.105.141.172
country_id: 3923057
description:
2026-01-11 23:01:03 dovecot_login authenticator failed for H=static-200-105-141-172.acelerate.net (static-200-105-141-161.acelerate.net) [200.105.141.172]:59942: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.255.221.189
country_id: 6252001
description:
Jan 11 23:02:00 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=173.255.221.189, lip=66.85.158.92, session=<WyrVIiBIltGt/929>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.215
country_id: 6252001
description:
Jan 11 23:07:14 host2 pure-ftpd[743088]: (?@198.235.24.215) [INFO] New connection from 198.235.24.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-11 23:08:46 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (guyal) [87.103.126.54]:52065: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.144.20
country_id: 3996063
description:
2026-01-11 23:09:19 dovecot_login authenticator failed for H=([177.236.144.20]) [177.236.144.20]:46716: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.201.237.208
country_id: 1269750
description:
2026-01-11 23:09:48 dovecot_login authenticator failed for H=(abts-west-static-208.237.201.106.airtelbroadband.in) [106.201.237.208]:39918: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.32.190.134
country_id: 3175395
description:
Jan 11 23:12:44 host2 sshd[748145]: Disconnected from invalid user sshtest 79.32.190.134 port 60596 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 79.32.190.134
country_id: 3175395
description:
Jan 11 23:13:24 host2 sshd[748896]: Disconnected from invalid user share 79.32.190.134 port 43570 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.138.158.114
country_id: 1512440
description:
Jan 11 23:13:22 host2 sshd[748889]: Disconnected from invalid user deploytest 45.138.158.114 port 50398 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.32.190.134
country_id: 3175395
description:
Jan 11 23:14:11 host2 sshd[749570]: Disconnected from invalid user debian 79.32.190.134 port 54784 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.219.125.194
country_id: 6252001
description:
Jan 11 23:16:18 host2 sshd[751711]: Disconnected from invalid user botuser1 154.219.125.194 port 50594 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.225.146.23
country_id: 934292
description:
Jan 11 23:16:29 host2 sshd[751813]: Disconnected from invalid user newuser 197.225.146.23 port 34888 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 208.69.84.112
country_id: 6252001
description:
Jan 11 23:16:39 host2 sshd[751917]: Disconnected from invalid user ftptest 208.69.84.112 port 33498 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.138.158.114
country_id: 1512440
description:
Jan 11 23:17:16 host2 sshd[752707]: Disconnected from invalid user ftp-admin 45.138.158.114 port 46720 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 208.69.84.112
country_id: 6252001
description:
Jan 11 23:17:09 host2 sshd[752570]: Disconnected from invalid user luis 208.69.84.112 port 60850 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 23:18:55 host2 sshd[754187]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.138.158.114
country_id: 1512440
description:
Jan 11 23:18:26 host2 sshd[753762]: Disconnected from invalid user support 45.138.158.114 port 54682 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.107.155.203
country_id: 798544
description:
Jan 11 23:26:05 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=89.107.155.203, lip=66.85.158.91, TLS, session=<PDzmdyBIHbJZa5vL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.246.224
country_id: 1269750
description:
Jan 11 23:26:25 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<env_eng>, method=PLAIN, rip=103.164.246.224, lip=66.85.158.91, TLS, session=<1kgReSBIoa1npPbg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2026-01-11 23:27:31 dovecot_login authenticator failed for H=([103.51.26.198]) [103.51.26.198]:59665: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.82.86
country_id: 1880251
description:
2026-01-11 23:29:21 dovecot_login authenticator failed for H=(86.82.156.175.unknown.m1.com.sg) [175.156.82.86]:45967: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.148.174.234
country_id: 2017370
description:
2026-01-11 23:29:40 dovecot_login authenticator failed for H=([31.148.174.234]) [31.148.174.234]:58130: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 184.105.139.69
country_id: 6252001
description:
Jan 11 23:30:40 host2 pure-ftpd[766141]: (?@184.105.139.69) [INFO] New connection from 184.105.139.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-11 23:31:47 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (chiandyned) [87.103.126.54]:50257: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 120.28.109.188
country_id: 1694008
description:
Jan 11 23:32:42 host2 sshd[767849]: Disconnected from invalid user botuser 120.28.109.188 port 54482 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.104.127.125
country_id: 1269750
description:
Jan 11 23:33:25 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=103.104.127.125, lip=66.85.158.91, TLS, session=<Q5gCkiBIbLFnaH99>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 67.204.23.12
country_id: 6252001
description:
Jan 11 23:33:41 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 15 secs): user=<careers>, method=PLAIN, rip=67.204.23.12, lip=66.85.158.91, TLS, session=</qk2kyBIXZZDzBcM>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 120.28.109.188
country_id: 1694008
description:
Jan 11 23:34:59 host2 sshd[769550]: Disconnected from invalid user odoo13 120.28.109.188 port 40146 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.247.239.202
country_id: 1269750
description:
2026-01-11 23:35:29 dovecot_login authenticator failed for H=(abts-north-static-194.142.160.122.airtelbroadband.in) [117.247.239.202]:36106: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 120.28.109.188
country_id: 1694008
description:
Jan 11 23:35:33 host2 sshd[770351]: Disconnected from invalid user minecraft 120.28.109.188 port 39600 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2026-01-11 23:35:52 dovecot_login authenticator failed for H=(85-19-195-12.telia-isp.no) [85.19.195.12]:44724: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.210.246.54
country_id: 289688
description:
2026-01-11 23:35:55 dovecot_login authenticator failed for H=([37.210.246.54]) [37.210.246.54]:41050: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 120.28.109.188
country_id: 1694008
description:
Jan 11 23:36:42 host2 sshd[771549]: Disconnected from invalid user bot1 120.28.109.188 port 33016 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.186.17.150
country_id: 6252001
description:
2026-01-11 23:36:12 dovecot_login authenticator failed for H=([162.186.17.150]) [162.186.17.150]:55432: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.55.194.114
country_id: 6252001
description:
2026-01-11 23:37:17 dovecot_plain authenticator failed for H=c-73-55-194-114.hsd1.tx.comcast.net (comed) [73.55.194.114]:54590: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2026-01-11 23:37:46 dovecot_login authenticator failed for H=([193.46.192.20]) [193.46.192.20]:49544: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2026-01-11 23:39:57 dovecot_login authenticator failed for H=([24.104.225.201]) [24.104.225.201]:45168: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.209.30
country_id: 1269750
description:
2026-01-11 23:39:27 dovecot_login authenticator failed for H=([128.185.209.30]) [128.185.209.30]:37330: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.246.248.18
country_id: 1819730
description:
Jan 11 23:39:30 host2 sshd[774150]: Disconnected from invalid user cs 38.246.248.18 port 55506 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.126.144.30
country_id: 6252001
description:
2026-01-11 23:52:16 dovecot_plain authenticator failed for H=ool-457e901e.dyn.optonline.net (eptiousk) [69.126.144.30]:56880: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-11 23:52:40 dovecot_plain authenticator failed for H=(colized) [64.72.74.162]:57063: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.74.41.172
country_id: 1861060
description:
Jan 11 23:58:29 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 3 secs): user=<>, rip=47.74.41.172, lip=66.85.158.92, session=<FBLW7CBIIqUvSims>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 12 00:00:22 host2 sshd[795156]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.6
country_id: 290557
description:
2026-01-12 00:01:14 dovecot_login authenticator failed for H=([5.32.107.6]) [5.32.107.6]:37786: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.66
country_id: 1269750
description:
2026-01-12 00:01:59 dovecot_login authenticator failed for H=([122.187.230.66]) [122.187.230.66]:47921: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 12 00:04:52 host2 sshd[799161]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.255.53.62
country_id: 6252001
description:
Jan 12 00:08:57 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.255.53.62, lip=66.85.158.91, session=<0d1FEiFIhMQs/zU+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.149.108.129
country_id: 6252001
description:
Jan 12 00:10:04 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=54.149.108.129, lip=66.85.158.91, session=<BNA4FiFIWp42lWyB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 34.212.106.243
country_id: 6252001
description:
Jan 12 00:10:02 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=34.212.106.243, lip=66.85.158.91, session=<oQkgFiFIbqQi1Grz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 16.144.77.186
country_id: 6252001
description:
Jan 12 00:10:04 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=16.144.77.186, lip=66.85.158.91, session=<TSo5FiFILLwQkE26>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.187.101.93
country_id: 6252001
description:
Jan 12 00:10:04 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=54.187.101.93, lip=66.85.158.91, session=<hvpBFiFI8IA2u2Vd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 16.146.103.231
country_id: 6252001
description:
Jan 12 00:10:54 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 120 secs): user=<>, rip=16.146.103.231, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Ae4xGSFIrq8Qkmfn>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 44.246.125.118
country_id: 6252001
description:
Jan 12 00:11:51 host2 pure-ftpd[806262]: (?@44.246.125.118) [INFO] New connection from 44.246.125.118


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.249.247.204
country_id: 6252001
description:
Jan 12 00:11:29 host2 dovecot[3239883]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=44.249.247.204, lip=66.85.158.91, TLS, session=<EORKGyFIVp4s+ffM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.252.74.17
country_id: 6252001
description:
Jan 12 00:11:29 host2 dovecot[3239883]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=44.252.74.17, lip=66.85.158.91, TLS, session=<aMFNGyFIFtks/EoR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.202.57.130
country_id: 6252001
description:
Jan 12 00:11:29 host2 dovecot[3239883]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=54.202.57.130, lip=66.85.158.91, TLS, session=<4I1RGyFIyLI2yjmC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.149.108.129
country_id: 6252001
description:
Jan 12 00:11:30 host2 dovecot[3239883]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=54.149.108.129, lip=66.85.158.91, TLS, session=<MwlhGyFIRJY2lWyB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.149.211
country_id: 1522867
description:
2026-01-12 00:12:59 dovecot_login authenticator failed for H=(comp148-211.2day.kz) [85.29.149.211]:50000: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-01-12 00:13:16 dovecot_login authenticator failed for H=([200.106.49.149]) [200.106.49.149]:39390: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 12 00:15:02 host2 sshd[809351]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.245.175.17
country_id: 6252001
description:
Jan 12 00:15:07 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 120 secs): user=<>, rip=54.245.175.17, lip=66.85.158.91, TLS handshaking: Connection closed, session=<YXBRKCFIBI429a8R>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 12 00:15:43 host2 sshd[810219]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.245.175.17
country_id: 6252001
description:
Jan 12 00:15:13 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=54.245.175.17, lip=66.85.158.91, TLS, session=<0henKCFIsLg29a8R>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.94.120.181
country_id: 6252001
description:
Jan 12 00:15:43 host2 dovecot[3239883]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=35.94.120.181, lip=66.85.158.91, TLS, session=<MxB4KiFIktIjXni1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.247.53.114
country_id: 6252001
description:
Jan 12 00:15:44 host2 dovecot[3239883]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=44.247.53.114, lip=66.85.158.91, TLS, session=<9GSDKiFI0uQs9zVy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.202.57.130
country_id: 6252001
description:
Jan 12 00:15:45 host2 dovecot[3239883]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=54.202.57.130, lip=66.85.158.91, TLS, session=<yIGSKiFIbuU2yjmC>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 54.213.228.205
country_id: 6252001
description:
Jan 12 00:17:22 host2 dovecot[3239883]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=54.213.228.205, lip=66.85.158.91, session=<l8BRMCFInrA21eTN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.187.101.93
country_id: 6252001
description:
Jan 12 00:18:24 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=54.187.101.93, lip=66.85.158.91, session=<xk8MNCFIouI2u2Vd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.43.202.145
country_id: 6252001
description:
Jan 12 00:18:25 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=52.43.202.145, lip=66.85.158.91, session=<TdkfNCFImqo0K8qR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.149.14.182
country_id: 6252001
description:
Jan 12 00:18:26 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=54.149.14.182, lip=66.85.158.91, session=<4kEiNCFITJ82lQ62>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 34.212.106.243
country_id: 6252001
description:
Jan 12 00:18:27 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=34.212.106.243, lip=66.85.158.91, session=<bSg+NCFIyKYi1Grz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.10.173
country_id: 2635167
description:
Jan 12 00:20:05 host2 sshd[814966]: Disconnected from invalid user devops 185.196.10.173 port 34884 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.122.86
country_id: 6252001
description:
Jan 12 00:22:10 host2 sshd[817127]: Disconnected from invalid user botuser1 167.99.122.86 port 47006 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.196.10.173
country_id: 2635167
description:
Jan 12 00:22:41 host2 sshd[817638]: Disconnected from invalid user vps 185.196.10.173 port 41516 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.10.173
country_id: 2635167
description:
Jan 12 00:23:35 host2 sshd[818533]: Disconnected from invalid user git 185.196.10.173 port 38136 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 167.99.122.86
country_id: 6252001
description:
Jan 12 00:23:42 host2 sshd[818685]: Disconnected from invalid user b 167.99.122.86 port 52668 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.253
country_id: 1733045
description:
2026-01-12 00:24:49 dovecot_login authenticator failed for H=([49.124.152.253]) [49.124.152.253]:45536: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.78
country_id: 1733045
description:
2026-01-12 00:25:34 dovecot_login authenticator failed for H=([49.125.201.78]) [49.125.201.78]:37014: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.149.161.131
country_id: 6252001
description:
2026-01-12 00:27:08 dovecot_login authenticator failed for H=c-50-149-161-131.hsd1.tn.comcast.net [50.149.161.131]:54737: 535 Incorrect authentication data (set_id=business@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.58
country_id: 1269750
description:
2026-01-12 00:27:32 dovecot_login authenticator failed for H=(nsg-corporate-113.199.185.122.airtel.in) [122.186.202.58]:36316: 535 Incorrect authentication data (set_id=business)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.132.32.143
country_id: 6252001
description:
2026-01-12 00:30:00 dovecot_login authenticator failed for H=([72.132.32.143]) [72.132.32.143]:46168: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.125.149.205
country_id: 2245662
description:
Jan 12 00:30:51 host2 sshd[826125]: Disconnected from invalid user airflow 154.125.149.205 port 37664 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.246.106
country_id: 1269750
description:
2026-01-12 00:30:15 dovecot_login authenticator failed for H=([128.185.246.106]) [128.185.246.106]:43214: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.202.38.185
country_id: 2658434
description:
2026-01-12 00:30:35 dovecot_login authenticator failed for H=(dyn-cable-cust.185.38.202.213.quicknet.ch) [213.202.38.185]:54064: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-12 00:31:47 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (thememes) [87.103.126.54]:17216: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.109.56.74
country_id: 6252001
description:
2026-01-12 00:33:12 dovecot_login authenticator failed for H=([206.109.56.74]) [206.109.56.74]:35328: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.108.39
country_id: 290557
description:
2026-01-12 00:33:36 dovecot_login authenticator failed for H=([94.204.108.39]) [94.204.108.39]:59599: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.169.44.220
country_id: 732800
description:
Jan 12 00:34:57 host2 sshd[829433]: Disconnected from invalid user sshuser 213.169.44.220 port 38932 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.213.63.12
country_id: 6252001
description:
Jan 12 00:35:36 host2 sshd[830391]: Disconnected from invalid user bitrix 38.213.63.12 port 42844 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 89.44.137.176
country_id: 798549
description:
Jan 12 00:35:40 host2 sshd[830422]: Disconnected from invalid user postgres 89.44.137.176 port 50582 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.125.149.205
country_id: 2245662
description:
Jan 12 00:36:08 host2 sshd[830828]: Disconnected from invalid user deploy 154.125.149.205 port 54081 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.68.37.25
country_id: 2661886
description:
2026-01-12 00:37:17 dovecot_plain authenticator failed for H=78-68-37-25-no2560.tbcn.telia.com (nonts) [78.68.37.25]:40192: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.125.149.205
country_id: 2245662
description:
Jan 12 00:38:27 host2 sshd[832710]: Disconnected from invalid user runner 154.125.149.205 port 49207 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.213.63.12
country_id: 6252001
description:
Jan 12 00:39:11 host2 sshd[833460]: Disconnected from invalid user b 38.213.63.12 port 37990 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.213.63.12
country_id: 6252001
description:
Jan 12 00:40:16 host2 sshd[834670]: Disconnected from invalid user gpadmin 38.213.63.12 port 33480 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 88.249.1.15
country_id: 298795
description:
Jan 12 00:43:49 host2 sshd[837800]: Disconnected from invalid user web 88.249.1.15 port 48126 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 88.249.1.15
country_id: 298795
description:
Jan 12 00:44:39 host2 sshd[838530]: Disconnected from invalid user developer 88.249.1.15 port 41692 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.151.238.195
country_id: 272103
description:
2026-01-12 00:44:50 dovecot_plain authenticator failed for H=(bount) [91.151.238.195]:41201: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 88.249.1.15
country_id: 298795
description:
Jan 12 00:45:26 host2 sshd[839554]: Disconnected from invalid user odoo 88.249.1.15 port 55994 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan 12 00:50:25 host2 pure-ftpd[844847]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 12 00:51:58 host2 sshd[846502]: Disconnected from invalid user admin 2.57.121.112 port 46639 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.36
country_id: 6252001
description:
Jan 12 00:54:03 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.36, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<IiiCsyFI89bN0h8k>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.202.197.108
country_id: 6252001
description:
2026-01-12 00:54:53 dovecot_plain authenticator failed for H=(nossing) [50.202.197.108]:37268: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.50.94.29
country_id: 1605651
description:
2026-01-12 00:55:21 dovecot_login authenticator failed for H=([147.50.94.29]) [147.50.94.29]:58454: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.206
country_id: 1269750
description:
2026-01-12 00:55:48 dovecot_login authenticator failed for H=([125.20.154.97]) [182.95.178.206]:44022: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2026-01-12 00:57:57 dovecot_plain authenticator failed for H=c-73-168-136-150.hsd1.il.comcast.net (oadly) [73.168.136.150]:34634: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.27.139
country_id: 6252001
description:
2026-01-12 01:01:28 dovecot_login authenticator failed for H=c-71-235-27-139.hsd1.vt.comcast.net [71.235.27.139]:59164: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.103.210
country_id: 6252001
description:
Jan 12 01:03:10 host2 sshd[857948]: Disconnected from invalid user teamspeak 107.150.103.210 port 55084 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.64.126.23
country_id: 3175395
description:
2026-01-12 01:03:47 dovecot_login authenticator failed for H=([151.64.126.23]) [151.64.126.23]:59096: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.116.165
country_id: 3144096
description:
2026-01-12 01:03:30 dovecot_login authenticator failed for H=(cm-178.232.116.165.get.no) [178.232.116.165]:58261: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.150.103.210
country_id: 6252001
description:
Jan 12 01:03:41 host2 sshd[858632]: Disconnected from invalid user cs 107.150.103.210 port 46254 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.12.135
country_id: 2077456
description:
2026-01-12 01:04:07 dovecot_login authenticator failed for H=([101.168.12.135]) [101.168.12.135]:58328: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.139.157
country_id: 1269750
description:
Jan 12 01:04:23 host2 sshd[859228]: Disconnected from invalid user user 64.227.139.157 port 53694 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.227.139.157
country_id: 1269750
description:
Jan 12 01:04:58 host2 sshd[859733]: Disconnected from invalid user bitwarden 64.227.139.157 port 48748 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.51.214.98
country_id: 1643084
description:
Jan 12 01:05:37 host2 sshd[860943]: Disconnected from invalid user ts1 202.51.214.98 port 55234 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-12 01:06:07 dovecot_plain authenticator failed for H=(sluvastion) [64.72.74.162]:56598: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.237.94.18
country_id: 6252001
description:
Jan 12 01:06:19 host2 sshd[861612]: Disconnected from invalid user jenkins 35.237.94.18 port 50306 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.33.59.116
country_id: 3469034
description:
Jan 12 01:06:33 host2 sshd[861799]: Disconnected from invalid user postgres 187.33.59.116 port 37752 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.51.214.98
country_id: 1643084
description:
Jan 12 01:06:54 host2 sshd[862173]: Disconnected from invalid user testing 202.51.214.98 port 49558 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.237.94.18
country_id: 6252001
description:
Jan 12 01:08:05 host2 sshd[863608]: Disconnected from invalid user ts3 35.237.94.18 port 32916 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.89.9.41
country_id: 2921044
description:
Jan 12 01:08:14 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=159.89.9.41, lip=66.85.158.91, TLS, session=<hv9E5iFIYIefWQkp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.16.96.250
country_id: 3469034
description:
Jan 12 01:08:51 host2 sshd[864548]: Disconnected from invalid user bitwarden 187.16.96.250 port 33148 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.207.210.23
country_id: 2960313
description:
2026-01-12 01:11:58 dovecot_plain authenticator failed for H=(savere) [88.207.210.23]:61040: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.16.96.250
country_id: 3469034
description:
Jan 12 01:11:40 host2 sshd[867735]: Disconnected from invalid user appuser 187.16.96.250 port 44290 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.16.96.250
country_id: 3469034
description:
Jan 12 01:13:54 host2 sshd[870066]: Disconnected from invalid user odoo13 187.16.96.250 port 33654 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.73.121.209
country_id: 732800
description:
2026-01-12 01:14:11 dovecot_plain authenticator failed for H=(voletes) [62.73.121.209]:38338: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.25.232.7
country_id: 953987
description:
Jan 12 01:14:41 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<amila@euroentertainmentlk.com>, method=PLAIN, rip=41.25.232.7, lip=66.85.158.91, session=<apI1/SFIP9opGegH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2026-01-12 01:20:09 dovecot_login authenticator failed for H=([189.108.156.41]) [187.8.64.94]:43027: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.176.157.57
country_id: 6252001
description:
2026-01-12 01:22:54 dovecot_plain authenticator failed for H=c-73-176-157-57.hsd1.il.comcast.net (begran) [73.176.157.57]:54600: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.70.19.11
country_id: 3469034
description:
2026-01-12 01:25:50 dovecot_login authenticator failed for H=([45.70.19.11]) [45.70.19.11]:57167: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.151.158
country_id: 3144096
description:
2026-01-12 01:26:22 dovecot_login authenticator failed for H=([84.210.151.158]) [84.210.151.158]:59577: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.23.171.169
country_id: 6252001
description:
Jan 12 01:28:59 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=64.23.171.169, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<mfJ9MCJIfuZAF6up>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.195
country_id: 6252001
description:
Jan 12 01:30:42 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.247.195, lip=66.85.158.92, TLS handshaking: Connection closed, session=<1mWcNiJIzvW4affD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.212
country_id: 6252001
description:
Jan 12 01:30:53 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.212, lip=66.85.158.91, TLS handshaking: Connection closed, session=<CuxJNyJIGBJBMQHU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.144
country_id: 1269750
description:
2026-01-12 01:31:23 dovecot_login authenticator failed for H=(nsg-corporate-144.227.187.122.airtel.in) [122.187.227.144]:48679: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.212
country_id: 6252001
description:
Jan 12 01:31:11 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.212, lip=66.85.158.91, TLS handshaking: Connection closed, session=<RNZbOCJI2AhBMQHU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.195
country_id: 6252001
description:
Jan 12 01:31:16 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.247.195, lip=66.85.158.92, TLS: Connection closed, session=<PwClOCJIrmm4affD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.245.172.214
country_id: 1269750
description:
2026-01-12 01:32:14 dovecot_login authenticator failed for H=([115.245.172.214]) [115.245.172.214]:35772: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.22
country_id: 1149361
description:
2026-01-12 01:32:13 dovecot_login authenticator failed for H=([149.54.62.22]) [149.54.62.22]:59730: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.208.46.130
country_id: 1522867
description:
2026-01-12 01:32:38 dovecot_login authenticator failed for H=([37.208.46.130]) [37.208.46.130]:38569: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2026-01-12 01:36:35 dovecot_login authenticator failed for H=syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:53790: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
country_id: 6252001
description:
2026-01-12 01:36:52 dovecot_login authenticator failed for H=c-71-229-1-186.hsd1.al.comcast.net [71.229.1.186]:53790: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.38
country_id: 1269750
description:
2026-01-12 01:36:55 dovecot_login authenticator failed for H=(nsg-static-153.157.72.182.airtel.in) [182.95.229.38]:42118: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.215.125.250
country_id: 192950
description:
2026-01-12 01:37:18 dovecot_login authenticator failed for H=(41.215.125.250.accesskenya.com) [41.215.125.250]:33014: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 31.6.212.12
country_id: 798544
description:
Jan 12 01:39:36 host2 sshd[897128]: Disconnected from invalid user test1 31.6.212.12 port 49738 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 31.6.212.12
country_id: 798544
description:
Jan 12 01:43:23 host2 sshd[901190]: Disconnected from invalid user ts2 31.6.212.12 port 48236 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2026-01-12 01:43:51 dovecot_plain authenticator failed for H=(unnyous) [65.20.133.208]:42660: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 12 01:45:25 host2 sshd[903307]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.33.80.243
country_id: 6252001
description:
Jan 12 01:47:14 host2 dovecot[3239883]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=45.33.80.243, lip=66.85.158.91, session=<zwC/cSJIUoYtIVDz>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 12 01:49:05 host2 sshd[907393]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 12 01:51:31 host2 sshd[909810]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.107.195
country_id: 3469034
description:
Jan 12 01:51:40 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=191.53.107.195, lip=66.85.158.91, TLS, session=<gjF7gCJIkJm/NWvD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 189.90.237.49
country_id: 3469034
description:
Jan 12 01:51:20 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 11 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=189.90.237.49, lip=66.85.158.91, session=<w+G3fyJIzJe9Wu0x>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.251.179.129
country_id: 1522867
description:
2026-01-12 01:56:36 dovecot_login authenticator failed for H=([5.251.179.129]) [5.251.179.129]:36939: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.118.3
country_id: 3865483
description:
2026-01-12 01:56:59 dovecot_login authenticator failed for H=([167.250.118.3]) [167.250.118.3]:39119: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.18.99.10
country_id: 1269750
description:
2026-01-12 01:57:16 dovecot_login authenticator failed for H=([125.18.99.10]) [125.18.99.10]:48362: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.156.38
country_id: 1605651
description:
2026-01-12 01:57:47 dovecot_login authenticator failed for H=mail.sotus.co.th [171.100.156.38]:38718: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.40.122.250
country_id: 2629691
description:
2026-01-12 01:59:22 dovecot_login authenticator failed for H=nova-185-040-122-250.cpe.novanet.is [185.40.122.250]:47779: 535 Incorrect authentication data (set_id=hostmaster@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.90.94
country_id: 1269750
description:
2026-01-12 01:59:35 dovecot_login authenticator failed for H=([182.95.85.106]) [27.123.90.94]:38764: 535 Incorrect authentication data (set_id=hostmaster)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 12 02:00:48 host2 sshd[918961]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 12 02:00:27 host2 sshd[918571]: Disconnected from invalid user admin 2.57.121.112 port 47345 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.110.150
country_id: 660013
description:
2026-01-12 02:00:41 dovecot_login authenticator failed for H=([45.82.110.150]) [45.82.110.150]:54954: 535 Incorrect authentication data (set_id=all@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.58
country_id: 1269750
description:
2026-01-12 02:00:54 dovecot_login authenticator failed for H=(nsg-corporate-113.199.185.122.airtel.in) [122.186.202.58]:58572: 535 Incorrect authentication data (set_id=all)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.155.194.190
country_id: 953987
description:
2026-01-12 02:07:58 dovecot_plain authenticator failed for H=156-155-194-190.ip.internet.co.za (5HJ30XO6291) [156.155.194.190]:56538: 535 Incorrect authentication data (set_id=kasunp@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.155.194.190
country_id: 953987
description:
2026-01-12 02:08:12 dovecot_login authenticator failed for H=156-155-194-190.ip.internet.co.za (R27PCKV70FQ2DWX) [156.155.194.190]:33989: 535 Incorrect authentication data


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.11
country_id: 3865483
description:
Jan 12 02:14:16 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=179.0.251.11, lip=66.85.158.91, TLS, session=<ToIq0SJI5Y+zAPsL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.108.85.40
country_id: 3469034
description:
Jan 12 02:14:40 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<env_eng>, method=PLAIN, rip=187.108.85.40, lip=66.85.158.91, TLS, session=<+o2p0iJI6ry7bFUo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2026-01-12 02:23:31 dovecot_login authenticator failed for H=([94.201.22.158]) [94.201.22.158]:34863: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.208.177.56
country_id: 6252001
description:
2026-01-12 02:23:54 dovecot_login authenticator failed for H=([74.208.177.56]) [74.208.177.56]:50180: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.68.37.25
country_id: 2661886
description:
2026-01-12 02:24:38 dovecot_plain authenticator failed for H=78-68-37-25-no2560.tbcn.telia.com (unfon) [78.68.37.25]:33489: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2026-01-12 02:24:39 dovecot_login authenticator failed for H=bb121-6-81-59.singnet.com.sg [121.6.81.59]:49131: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.142
country_id: 1269750
description:
2026-01-12 02:25:00 dovecot_login authenticator failed for H=([128.185.227.142]) [128.185.227.142]:56898: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.139.77
country_id: 3144096
description:
2026-01-12 02:30:49 dovecot_login authenticator failed for H=([188.124.139.77]) [188.124.139.77]:36512: 535 Incorrect authentication data (set_id=svetlana@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-01-12 02:31:39 dovecot_login authenticator failed for H=(made-again.tmesis.com) [24.187.213.29]:37410: 535 Incorrect authentication data (set_id=svetlana)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 12 02:33:12 host2 sshd[949032]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.189
country_id: 6252001
description:
Jan 12 02:33:37 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.189, lip=66.85.158.91, session=<8CqjFyNIJT5APpy9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.182
country_id: 6252001
description:
Jan 12 02:33:47 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.182, lip=66.85.158.91, TLS: Connection closed, session=<lqw4GCNIsL5APpy2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.23.199.238
country_id: 2921044
description:
2026-01-12 02:40:27 dovecot_login authenticator failed for H=([193.23.199.238]) [193.23.199.238]:57820: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.44
country_id: 1733045
description:
2026-01-12 02:40:44 dovecot_login authenticator failed for H=([49.124.153.44]) [49.124.153.44]:57524: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.189.151
country_id: 798544
description:
2026-01-12 02:40:25 dovecot_plain authenticator failed for H=5.185.189.151.ipv4.public.orange.pl (disnes) [5.185.189.151]:40696: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 116.48.150.115
country_id: 1819730
description:
Jan 12 02:42:29 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=116.48.150.115, lip=66.85.158.91, session=<IEMUNyNI7sR0MJZz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.138
country_id: 1819730
description:
2026-01-12 02:42:27 dovecot_login authenticator failed for H=([223.197.153.138]) [223.197.153.138]:49740: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.212.178
country_id: 732800
description:
Jan 12 02:43:04 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=185.255.212.178, lip=66.85.158.91, TLS, session=<O75QOCNIjbm5/9Sy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-12 02:42:14 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (phers) [87.103.126.54]:9325: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.187.226.12
country_id: 1269750
description:
Jan 12 02:42:44 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=122.187.226.12, lip=66.85.158.91, session=<AJj6NyNI2JR6u+IM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.145.35
country_id: 1269750
description:
2026-01-12 02:42:44 dovecot_login authenticator failed for H=([103.174.145.35]) [103.174.145.35]:52125: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.160.114.72
country_id: 1210997
description:
Jan 12 02:43:17 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<env_eng>, method=PLAIN, rip=182.160.114.72, lip=66.85.158.91, session=<R2kIOiNIctW2oHJI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.89.94.7
country_id: 192950
description:
Jan 12 02:43:22 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<env_eng>, method=PLAIN, rip=41.89.94.7, lip=66.85.158.91, session=<5ppTOiNI0JcpWV4H>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.52
country_id: 6252001
description:
Jan 12 02:46:45 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.52, lip=66.85.158.92, TLS handshaking: Connection closed, session=<nnKWRiNIA5VBMQE0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.220.16.51
country_id: 1269750
description:
2026-01-12 02:48:05 dovecot_login authenticator failed for H=([103.220.16.51]) [103.220.16.51]:47870: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.52
country_id: 6252001
description:
Jan 12 02:47:11 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.52, lip=66.85.158.92, TLS: Connection closed, session=<SAkpSCNI9h9BMQE0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.110.11
country_id: 2661886
description:
2026-01-12 02:48:26 dovecot_login authenticator failed for H=h77-53-110-11.cust.bredband2.com [77.53.110.11]:59292: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.202.197.108
country_id: 6252001
description:
2026-01-12 02:49:20 dovecot_plain authenticator failed for H=(guthmous) [50.202.197.108]:60511: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 12 02:51:20 host2 sshd[966646]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.60.146
country_id: 1269750
description:
2026-01-12 02:53:28 dovecot_login authenticator failed for H=([182.95.25.99]) [182.95.60.146]:59692: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.145.142.243
country_id: 1269750
description:
2026-01-12 02:53:54 dovecot_login authenticator failed for H=([203.145.142.243]) [203.145.142.243]:51596: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.247.137.225
country_id: 2635167
description:
Jan 12 02:54:01 host2 pure-ftpd[969238]: (?@185.247.137.225) [INFO] New connection from 185.247.137.225


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.164.251.182
country_id: 6252001
description:
2026-01-12 02:54:39 dovecot_login authenticator failed for H=216-164-251-182.s9140.c3-0.eas-cbr4.atw-eas.pa.cable.rcncustomer.com [216.164.251.182]:56706: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2026-01-12 02:55:46 dovecot_plain authenticator failed for H=c-98-40-101-10.hsd1.tn.comcast.net (nornfority) [98.40.101.10]:41480: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.136
country_id: 6252001
description:
Jan 12 02:59:53 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.136, lip=66.85.158.92, session=<EYmOdSNIna5APpyI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.132
country_id: 6252001
description:
Jan 12 03:00:05 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.132, lip=66.85.158.92, TLS: Connection closed, session=</jNJdiNIztFAPpyE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.132
country_id: 6252001
description:
Jan 12 03:00:18 host2 dovecot[3239883]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=64.62.156.132, lip=66.85.158.92, session=<SJUHdyNIONBAPpyE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.238.210.226
country_id: 3469034
description:
2026-01-12 03:06:30 dovecot_login authenticator failed for H=(186-201-12-209.customer.tdatabrasil.net.br) [186.238.210.226]:53247: 535 Incorrect authentication data (set_id=abuse@agentallianz.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.145.54
country_id: 1269750
description:
2026-01-12 03:06:58 dovecot_login authenticator failed for H=([128.185.135.33]) [122.185.145.54]:41524: 535 Incorrect authentication data (set_id=abuse@agentallianz.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.235.8
country_id: 1327865
description:
2026-01-12 03:07:22 dovecot_login authenticator failed for H=([103.68.235.8]) [103.68.235.8]:53364: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.132.40.41
country_id: 6252001
description:
2026-01-12 03:08:08 dovecot_login authenticator failed for H=([216.132.40.41]) [216.132.40.41]:50563: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 12 03:10:42 host2 sshd[987294]: Disconnected from invalid user admin 2.57.121.112 port 37764 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.85.104.2
country_id: 6252001
description:
2026-01-12 03:10:45 dovecot_plain authenticator failed for H=(foran) [96.85.104.2]:32810: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.192.74.183
country_id: 6252001
description:
2026-01-12 03:17:43 dovecot_plain authenticator failed for H=c-98-192-74-183.hsd1.ga.comcast.net (prood) [98.192.74.183]:58070: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.74.136.134
country_id: 6252001
description:
2026-01-12 03:19:41 dovecot_plain authenticator failed for H=syn-050-074-136-134.biz.spectrum.com (weeth) [50.74.136.134]:37094: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.140.54
country_id: 1269750
description:
2026-01-12 03:28:27 dovecot_login authenticator failed for H=([125.21.194.121]) [125.23.140.54]:48090: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.97.77.182
country_id: 1269750
description:
2026-01-12 03:29:09 dovecot_login authenticator failed for H=([14.97.77.182]) [14.97.77.182]:44984: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 12 03:29:55 host2 sshd[1007419]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.46
country_id: 1269750
description:
2026-01-12 03:32:01 dovecot_login authenticator failed for H=([125.19.156.46]) [125.19.156.46]:49346: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.40.238
country_id: 1210997
description:
2026-01-12 03:32:42 dovecot_login authenticator failed for H=([49.0.40.238]) [49.0.40.238]:44353: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.44
country_id: 1269750
description:
2026-01-12 03:35:19 dovecot_login authenticator failed for H=([103.147.248.44]) [103.147.248.44]:36444: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.245.38
country_id: 1269750
description:
2026-01-12 03:35:38 dovecot_login authenticator failed for H=([152.52.245.38]) [152.52.245.38]:47958: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.233.235.203
country_id: 2661886
description:
2026-01-12 03:36:33 dovecot_login authenticator failed for H=81-233-235-203-no600.tbcn.telia.com [81.233.235.203]:45416: 535 Incorrect authentication data (set_id=it@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.60.219.89
country_id: 6252001
description:
2026-01-12 03:39:10 dovecot_login authenticator failed for H=(136-60-219-89.googlefiber.net) [136.60.219.89]:58762: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.18
country_id: 1269750
description:
2026-01-12 03:38:29 dovecot_login authenticator failed for H=([61.246.66.225]) [182.95.174.18]:45930: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 12 03:45:03 host2 sshd[1022547]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 2603:3:6101:1900::
country_id: 6252001
description:
[2026-01-12 03:46:14 +0530] info [cpaneld] 2603:3:6101:1900:: - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.99.136.12
country_id: 2921044
description:
Jan 12 03:50:33 host2 pure-ftpd[1029596]: (?@167.99.136.12) [INFO] New connection from 167.99.136.12


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 167.99.136.12
country_id: 2921044
description:
Jan 12 03:50:36 host2 pure-ftpd[1029637]: (?@167.99.136.12) [INFO] New connection from 167.99.136.12


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.154
country_id: 1269750
description:
2026-01-12 04:00:08 dovecot_login authenticator failed for H=([182.95.178.154]) [182.95.178.154]:41808: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.25.232.7
country_id: 953987
description:
Jan 12 04:00:54 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<amila@euroentertainmentlk.com>, method=PLAIN, rip=41.25.232.7, lip=66.85.158.91, session=<7z2pTyRID9YpGegH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.165.182.203
country_id: 6252001
description:
2026-01-12 04:00:26 dovecot_login authenticator failed for H=(173-165-182-203-atlanta.hfc.comcastbusiness.net) [173.165.182.203]:47584: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.197.6.173
country_id: 3017382
description:
2026-01-12 04:04:09 dovecot_login authenticator failed for H=([78.197.6.173]) [78.197.6.173]:62163: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.254.2
country_id: 6252001
description:
Jan 12 04:05:07 host2 sshd[1045248]: Disconnected from invalid user demo 165.154.254.2 port 40446 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.254.2
country_id: 6252001
description:
Jan 12 04:05:52 host2 sshd[1046347]: Disconnected from invalid user student1 165.154.254.2 port 33674 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.252.18
country_id: 1269750
description:
2026-01-12 04:06:41 dovecot_login authenticator failed for H=([61.95.203.89]) [125.20.252.18]:41818: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.6.121.246
country_id: 3469034
description:
2026-01-12 04:07:07 dovecot_login authenticator failed for H=([187.6.121.246]) [187.6.121.246]:55902: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.200.10
country_id: 1269750
description:
2026-01-12 04:16:50 dovecot_login authenticator failed for H=([125.19.175.85]) [122.186.200.10]:51224: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.147.89.158
country_id: 1269750
description:
2026-01-12 04:16:39 dovecot_login authenticator failed for H=([203.147.89.38]) [203.147.89.158]:58648: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 12 04:18:09 host2 sshd[1061799]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.80
country_id: 2328926
description:
Jan 12 04:17:23 host2 sshd[1061071]: Disconnected from invalid user service 102.88.137.80 port 1161 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.16
country_id: 6252001
description:
Jan 12 04:20:51 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.16, lip=66.85.158.92, TLS, session=<55MalyRICP+TuYQQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.40.221
country_id: 1269750
description:
2026-01-12 04:22:00 dovecot_login authenticator failed for H=([122.169.40.221]) [122.169.40.221]:58976: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.80
country_id: 2328926
description:
Jan 12 04:21:58 host2 sshd[1066900]: Disconnected from invalid user botuser1 102.88.137.80 port 49660 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.88.137.80
country_id: 2328926
description:
Jan 12 04:22:35 host2 sshd[1067802]: Disconnected from invalid user administrador 102.88.137.80 port 17590 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2026-01-12 04:26:42 dovecot_plain authenticator failed for H=(toitager) [91.73.188.251]:47053: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.212.19.14
country_id: 2510769
description:
Jan 12 04:29:57 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=188.212.19.14, lip=66.85.158.91, TLS, session=<9jKttiRI2se81BMO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.216.88.83
country_id: 3469034
description:
Jan 12 04:30:18 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<careers>, method=PLAIN, rip=186.216.88.83, lip=66.85.158.91, TLS, session=<lR/QtyRIGYy62FhT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.213
country_id: 6252001
description:
Jan 12 04:35:06 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.213, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<eL4SyiRI1dPN0h/V>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.76.126
country_id: 1149361
description:
2026-01-12 04:36:09 dovecot_login authenticator failed for H=([180.94.76.126]) [180.94.76.126]:44514: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.105.141.172
country_id: 3923057
description:
2026-01-12 04:36:23 dovecot_login authenticator failed for H=static-200-105-141-172.acelerate.net (static-200-105-141-161.acelerate.net) [200.105.141.172]:58218: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.53.38.51
country_id: 6251999
description:
2026-01-12 04:38:28 dovecot_plain authenticator failed for H=(bonous) [24.53.38.51]:54192: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.59.154
country_id: 1269750
description:
2026-01-12 04:40:09 dovecot_login authenticator failed for H=([182.95.25.48]) [182.95.59.154]:41594: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2026-01-12 04:40:22 dovecot_login authenticator failed for H=([193.46.192.20]) [193.46.192.20]:45672: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.10
country_id: 798549
description:
Jan 12 04:48:27 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.10, lip=66.85.158.91, session=<V/vR+SRIzshV2ZUK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.95.24.117
country_id: 2464461
description:
2026-01-12 04:49:14 dovecot_login authenticator failed for H=([193.95.21.147]) [193.95.24.117]:41712: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.118.53
country_id: 3865483
description:
2026-01-12 04:49:27 dovecot_login authenticator failed for H=([167.250.118.53]) [167.250.118.53]:56009: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 85.217.149.13
country_id: 798549
description:
Jan 12 04:50:41 host2 pure-ftpd[1099316]: (?@85.217.149.13) [INFO] New connection from 85.217.149.13


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 85.217.149.13
country_id: 798549
description:
Jan 12 04:50:46 host2 pure-ftpd[1099384]: (?@85.217.149.13) [INFO] New connection from 85.217.149.13


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 118.193.57.185
country_id: 1605651
description:
Jan 12 04:54:04 host2 dovecot[3239883]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=118.193.57.185, lip=66.85.158.91, session=<8HntDSVIMGR2wTm5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 118.193.57.185
country_id: 1605651
description:
Jan 12 04:54:03 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=118.193.57.185, lip=66.85.158.91, session=<7Z3ZDSVIUGN2wTm5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.71
country_id: 6252001
description:
Jan 12 04:55:38 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.71, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<umB9EyVIKsXG6xhH>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.249.55.106
country_id: 2017370
description:
[2026-01-12 04:55:39 +0530] info [cpaneld] 89.249.55.106 - mathsmot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.86
country_id: 1269750
description:
2026-01-12 04:59:54 dovecot_login authenticator failed for H=([27.123.119.191]) [122.184.127.86]:42948: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.123.118
country_id: 1269750
description:
2026-01-12 05:00:22 dovecot_login authenticator failed for H=([122.184.123.118]) [122.184.123.118]:48892: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-01-12 05:01:04 dovecot_plain authenticator failed for H=host-196-47-172-253.afnet.net (scrangule) [196.47.172.253]:59908: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.129.206.200
country_id: 3469034
description:
Jan 12 05:01:10 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=177.129.206.200, lip=66.85.158.91, TLS, session=<2Xs4JiVIx4uxgc7I>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.96
country_id: 3175395
description:
Jan 12 05:01:29 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<env_eng>, method=PLAIN, rip=185.15.171.96, lip=66.85.158.91, TLS, session=<OJZZJyVI3uC5D6tg>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 12 05:03:57 host2 sshd[1111676]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.251
country_id: 6252001
description:
Jan 12 05:04:53 host2 pure-ftpd[1112556]: (?@205.210.31.251) [INFO] New connection from 205.210.31.251


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.195.19.75
country_id: 1269750
description:
2026-01-12 05:06:27 dovecot_login authenticator failed for H=([47.247.80.227]) [14.195.19.75]:60816: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.98.41.27
country_id: 1269750
description:
2026-01-12 05:10:34 dovecot_login authenticator failed for H=([59.98.41.27]) [59.98.41.27]:41178: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.2
country_id: 1269750
description:
2026-01-12 05:11:27 dovecot_login authenticator failed for H=([125.19.156.2]) [125.19.156.2]:57616: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 12 05:13:27 host2 sshd[1120383]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
country_id: 290557
description:
2026-01-12 05:14:56 dovecot_plain authenticator failed for H=(daete) [80.227.147.94]:54989: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.231.35.49
country_id: 798544
description:
Jan 12 05:25:26 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=89.231.35.49, lip=66.85.158.91, TLS, session=<KR4TfSVIQblZ5yMx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.64.71.42
country_id: 3865483
description:
Jan 12 05:25:49 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<env_eng>, method=PLAIN, rip=186.64.71.42, lip=66.85.158.91, TLS, session=<Z4o/fiVIXb66QEcq>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 12 05:28:36 host2 sshd[1134467]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2026-01-12 05:29:00 dovecot_plain authenticator failed for H=c-73-208-81-125.hsd1.in.comcast.net (undst) [73.208.81.125]:47728: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 12 05:29:15 host2 sshd[1135097]: Disconnected from invalid user admin 2.57.121.112 port 21742 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 12 05:33:14 host2 sshd[1138905]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 12 05:35:13 host2 sshd[1140694]: Disconnected from invalid user admin 2.57.121.112 port 58049 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-12 05:35:35 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (aling) [87.103.126.54]:42643: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.167
country_id: 6252001
description:
Jan 12 05:37:41 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.167, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<OM/lqSVINtLN0h+n>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.142.184.55
country_id: 1210997
description:
2026-01-12 05:39:07 dovecot_login authenticator failed for H=([103.133.175.82]) [103.142.184.55]:36135: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.36.204
country_id: 3144096
description:
2026-01-12 05:39:14 dovecot_login authenticator failed for H=([178.232.36.204]) [178.232.36.204]:46421: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.82.20.241
country_id: 1819730
description:
2026-01-12 05:39:28 dovecot_login authenticator failed for H=202-82-20-241.static.imsbiz.com [202.82.20.241]:58542: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.133.238
country_id: 3469034
description:
2026-01-12 05:38:37 dovecot_login authenticator failed for H=(189-56-191-126.customer.tdatabrasil.net.br) [189.44.133.238]:35707: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.202.197.108
country_id: 6252001
description:
2026-01-12 05:45:08 dovecot_plain authenticator failed for H=(undhonral) [50.202.197.108]:49465: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.85.14.208
country_id: 6252001
description:
2026-01-12 06:01:30 dovecot_login authenticator failed for H=([107.85.14.208]) [107.85.14.208]:50072: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.199.118.234
country_id: 1880251
description:
2026-01-12 06:00:44 dovecot_login authenticator failed for H=(448990.cloudwaysapps.com) [128.199.118.234]:40862: 535 Incorrect authentication data (set_id=admin@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.188.98
country_id: 1269750
description:
2026-01-12 06:01:02 dovecot_login authenticator failed for H=([128.185.119.9]) [125.19.188.98]:44086: 535 Incorrect authentication data (set_id=admin@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.116.165
country_id: 3144096
description:
2026-01-12 06:01:18 dovecot_login authenticator failed for H=(cm-178.232.116.165.get.no) [178.232.116.165]:47487: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.140.54
country_id: 1269750
description:
2026-01-12 06:04:09 dovecot_login authenticator failed for H=([125.21.194.121]) [125.23.140.54]:54622: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.254.21
country_id: 1819730
description:
Jan 12 06:05:28 host2 sshd[1171794]: Disconnected from invalid user ts1 152.32.254.21 port 54204 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.161.196.5
country_id: 99237
description:
2026-01-12 06:06:16 dovecot_login authenticator failed for H=([46.161.196.5]) [46.161.196.5]:46358: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.23.140
country_id: 3144096
description:
2026-01-12 06:06:43 dovecot_login authenticator failed for H=(cm-178.232.23.140.get.no) [178.232.23.140]:36173: 535 Incorrect authentication data (set_id=md@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.63
country_id: 99237
description:
2026-01-12 06:06:48 dovecot_login authenticator failed for H=([65.20.174.63]) [65.20.174.63]:56224: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.126.144.30
country_id: 6252001
description:
2026-01-12 06:06:59 dovecot_login authenticator failed for H=ool-457e901e.dyn.optonline.net [69.126.144.30]:52782: 535 Incorrect authentication data (set_id=md)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 12 06:10:58 host2 sshd[1176906]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 158.94.210.79
country_id: 2750405
description:
[2026-01-12 06:11:07 +0530] info [whostmgrd] 158.94.210.79 - kamechot "GET /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.16.7.82
country_id: 6252001
description:
2026-01-12 06:12:18 dovecot_plain authenticator failed for H=c-76-16-7-82.hsd1.il.comcast.net (bleum) [76.16.7.82]:36361: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2026-01-12 06:15:58 dovecot_plain authenticator failed for H=c-68-82-141-145.hsd1.pa.comcast.net (caton) [68.82.141.145]:46902: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2026-01-12 06:16:02 dovecot_plain authenticator failed for H=217-215-74-195-no2620.tbcn.telia.com (tated) [217.215.74.195]:36782: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 12 06:18:59 host2 sshd[1184201]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 45.156.128.73
country_id: 2264397
description:
Jan 12 06:22:11 host2 dovecot[3239883]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=45.156.128.73, lip=66.85.158.92, TLS, session=<2xoDSSZI/aUtnIBJ>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 45.156.128.71
country_id: 2264397
description:
Jan 12 06:22:07 host2 dovecot[3239883]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=45.156.128.71, lip=66.85.158.92, session=<7o3ISCZIf80tnIBH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.128.73
country_id: 2264397
description:
Jan 12 06:22:08 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=45.156.128.73, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<XN/YSCZI84QtnIBJ>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 45.156.128.72
country_id: 2264397
description:
Jan 12 06:22:07 host2 dovecot[3239883]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=45.156.128.72, lip=66.85.158.92, TLS, session=<QLbSSCZIOe0tnIBI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.128.71
country_id: 2264397
description:
Jan 12 06:22:09 host2 dovecot[3239883]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=45.156.128.71, lip=66.85.158.92, session=<azfuSCZIwLMtnIBH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.98.41.27
country_id: 1269750
description:
2026-01-12 06:26:27 dovecot_login authenticator failed for H=([59.98.41.27]) [59.98.41.27]:33355: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.190.141.17
country_id: 6252001
description:
Jan 12 06:28:56 host2 dovecot[3239883]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=146.190.141.17, lip=66.85.158.92, TLS, session=<JBczYSZIVI2Svo0R>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.26
country_id: 1269750
description:
Jan 12 06:29:59 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=103.18.166.26, lip=66.85.158.91, TLS, session=<x7HGYyZIEdpnEqYa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.57.230
country_id: 953987
description:
Jan 12 06:30:20 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<env_eng>, method=PLAIN, rip=102.129.57.230, lip=66.85.158.91, TLS, session=<aWUKZSZIPNxmgTnm>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.249.55.106
country_id: 2017370
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 89.249.55.106 - maximsho "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maximsho (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2026-01-12 06:34:42 dovecot_plain authenticator failed for H=c-98-193-112-85.hsd1.il.comcast.net (fletor) [98.193.112.85]:57560: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.24
country_id: 241170
description:
Jan 12 06:35:44 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.24, lip=66.85.158.91, session=<hk1XeSZI9qjE+2YY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.140.250
country_id: 3469034
description:
2026-01-12 06:37:29 dovecot_login authenticator failed for H=([181.233.140.250]) [181.233.140.250]:44771: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.248.156.49
country_id: 1522867
description:
2026-01-12 06:37:47 dovecot_login authenticator failed for H=([109.248.156.49]) [109.248.156.49]:53024: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2026-01-12 06:39:25 dovecot_plain authenticator failed for H=(sping) [65.20.133.208]:50226: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.169.4.104
country_id: 2635167
description:
Jan 12 06:38:36 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.169.4.104, lip=66.85.158.91, session=<kw3DgyZIQfu5qQRo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.10
country_id: 1269750
description:
2026-01-12 06:38:52 dovecot_login authenticator failed for H=([125.20.249.192]) [27.123.113.10]:47314: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.228
country_id: 99237
description:
2026-01-12 06:39:10 dovecot_login authenticator failed for H=([65.20.205.228]) [65.20.205.228]:60880: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-01-12 06:40:32 dovecot_plain authenticator failed for H=host-196-47-172-253.afnet.net (larativer) [196.47.172.253]:45292: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 12 06:41:11 host2 sshd[1204563]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.143.123
country_id: 298795
description:
2026-01-12 06:42:02 dovecot_plain authenticator failed for H=(nosos) [5.11.143.123]:39402: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.124.158.147
country_id: 99237
description:
Jan 12 06:44:59 host2 sshd[1207990]: Disconnected from invalid user administrator 138.124.158.147 port 50060 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.102.100.198
country_id: 6252001
description:
Jan 12 06:45:32 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.102.100.198, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<wp2KnCZIMsUUZmTG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2026-01-12 06:44:42 dovecot_plain authenticator failed for H=(clacropens) [154.146.240.123]:35332: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.124.158.147
country_id: 99237
description:
Jan 12 06:45:34 host2 sshd[1208958]: Disconnected from invalid user postgres 138.124.158.147 port 44538 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.110
country_id: 6252001
description:
Jan 12 06:49:33 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.110, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<QNDsqiZIw8PN0h9u>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.25.232.7
country_id: 953987
description:
Jan 12 06:51:46 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<amila@euroentertainmentlk.com>, method=PLAIN, rip=41.25.232.7, lip=66.85.158.91, session=<htm0siZI/eApGegH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.49.50.6
country_id: 3686110
description:
Jan 12 06:54:41 host2 sshd[1217109]: Disconnected from invalid user system 181.49.50.6 port 44810 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.49.50.6
country_id: 3686110
description:
Jan 12 06:56:51 host2 sshd[1219194]: Disconnected from invalid user develop 181.49.50.6 port 49154 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2026-01-12 06:57:01 dovecot_plain authenticator failed for H=(unciverms) [103.51.26.198]:51237: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.107.180
country_id: 1269750
description:
2026-01-12 06:57:28 dovecot_login authenticator failed for H=(static.ill.117.250.107.180.bsnl.co.in) [117.250.107.180]:59929: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.126
country_id: 1269750
description:
2026-01-12 06:57:57 dovecot_login authenticator failed for H=(nsg-corporate-190.152.185.122.airtel.in) [182.95.178.126]:43578: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.180.145.27
country_id: 3469034
description:
Jan 12 06:57:57 host2 sshd[1220312]: Disconnected from invalid user b 45.180.145.27 port 32966 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.49.50.6
country_id: 3686110
description:
Jan 12 06:58:18 host2 sshd[1220668]: Disconnected from invalid user webadmin 181.49.50.6 port 43356 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.58
country_id: 6252001
description:
Jan 12 06:58:35 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.58, lip=66.85.158.92, TLS: Connection closed, session=<vrw7yyZIHK+nXpI6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.180.145.27
country_id: 3469034
description:
Jan 12 06:58:37 host2 sshd[1220893]: Disconnected from invalid user webadmin 45.180.145.27 port 33112 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 14.142.136.102
country_id: 1269750
description:
Jan 12 07:01:52 host2 sshd[1224262]: Disconnected from invalid user work 14.142.136.102 port 46494 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.62.239.4
country_id: 732800
description:
2026-01-12 07:05:21 dovecot_plain authenticator failed for H=(colaula) [149.62.239.4]:41402: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 12 07:06:22 host2 sshd[1228600]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 66.240.219.146
country_id: 6252001
description:
Jan 12 07:06:28 host2 pure-ftpd[1228689]: (?@66.240.219.146) [INFO] New connection from 66.240.219.146


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.195.53.129
country_id: 6252001
description:
2026-01-12 07:05:51 dovecot_login authenticator failed for H=([74.195.53.129]) [74.195.53.129]:51408: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.240.219.146
country_id: 6252001
description:
Jan 12 07:06:25 host2 pure-ftpd[1228637]: (?@66.240.219.146) [INFO] New connection from 66.240.219.146


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.76.55.177
country_id: 3175395
description:
2026-01-12 07:07:38 dovecot_login authenticator failed for H=([151.76.55.177]) [151.76.55.177]:33632: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.195
country_id: 3077311
description:
2026-01-12 07:10:30 dovecot_plain authenticator failed for H=([10.7.18.200]) [212.102.39.195]:5156: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.195
country_id: 3077311
description:
2026-01-12 07:10:36 dovecot_login authenticator failed for H=([10.7.18.200]) [212.102.39.195]:5156: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.228
country_id: 6252001
description:
Jan 12 07:10:42 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.228, lip=66.85.158.91, session=<jsOO9iZISvTG6xjk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.210.118
country_id: 1269750
description:
2026-01-12 07:12:15 dovecot_login authenticator failed for H=([152.52.210.118]) [152.52.210.118]:33778: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.72.184.60
country_id: 6252001
description:
2026-01-12 07:12:31 dovecot_login authenticator failed for H=24-72-184-24-72-184-60.cpe.sparklight.net [24.72.184.60]:59108: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.111
country_id: 6252001
description:
Jan 12 07:14:45 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.111, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<au8DBSdII8uTuYRv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.114
country_id: 1269750
description:
2026-01-12 07:15:42 dovecot_login authenticator failed for H=([152.52.238.86]) [182.95.184.114]:54568: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.185.185
country_id: 99237
description:
2026-01-12 07:16:02 dovecot_login authenticator failed for H=([65.20.185.185]) [65.20.185.185]:59771: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.175.39
country_id: 6252001
description:
Jan 12 07:16:41 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=40.124.175.39, lip=66.85.158.91, TLS handshaking: Connection closed, session=<mDPvCydIBNgofK8n>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2026-01-12 07:18:28 dovecot_plain authenticator failed for H=(nossnal) [103.51.26.198]:48870: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-12 07:22:39 dovecot_login authenticator failed for H=(TyZTpM) [158.94.208.110]:54169: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.2
country_id: 1269750
description:
2026-01-12 07:24:04 dovecot_login authenticator failed for H=([125.19.173.202]) [152.52.236.2]:37336: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2026-01-12 07:23:38 dovecot_login authenticator failed for H=(7KWST4TnO) [158.94.208.110]:62385: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.195.251.43
country_id: 3573591
description:
2026-01-12 07:24:40 dovecot_login authenticator failed for H=([186.195.251.43]) [186.195.251.43]:57843: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.248.250.143
country_id: 298795
description:
2026-01-12 07:25:10 dovecot_login authenticator failed for H=(88.248.250.143.static.ttnet.com.tr) [88.248.250.143]:43424: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2026-01-12 07:25:28 dovecot_login authenticator failed for H=([178.150.135.19]) [178.150.135.19]:25544: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-01-12 07:30:04 dovecot_plain authenticator failed for H=host-196-47-172-253.afnet.net (pulgie) [196.47.172.253]:33560: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.74.243.105
country_id: 2510769
description:
Jan 12 07:32:11 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers>, method=PLAIN, rip=185.74.243.105, lip=66.85.158.91, TLS, session=<PexdQidI7665SvNp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.28.53.18
country_id: 690791
description:
Jan 12 07:31:42 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=194.28.53.18, lip=66.85.158.91, TLS, session=<pDWnQCdIsMjCHDUS>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.250.183.241
country_id: 4566966
description:
[2026-01-12 07:34:00 +0530] info [webmaild] 104.250.183.241 - env_eng@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.114
country_id: 6252001
description:
Jan 12 07:40:25 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.114, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<tbfJYCdIccuTuYRy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.204.64.103
country_id: 3489940
description:
2026-01-12 07:41:23 dovecot_plain authenticator failed for H=(CHXEI8NX18) [207.204.64.103]:56652: 535 Incorrect authentication data (set_id=kasunp@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.204.64.103
country_id: 3489940
description:
2026-01-12 07:41:37 dovecot_login authenticator failed for H=(6MB1PQ8V7O8RZW8) [207.204.64.103]:62223: 535 Incorrect authentication data


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.82
country_id: 6252001
description:
Jan 12 07:42:28 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=147.185.132.82, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<M5UmaCdIuteTuYRS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 77.76.184.10
country_id: 732800
description:
Jan 12 07:44:34 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=77.76.184.10, lip=66.85.158.91, TLS, session=<OnixbidIzb5NTLgK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.54.214
country_id: 953987
description:
Jan 12 07:44:55 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<env_eng>, method=PLAIN, rip=102.129.54.214, lip=66.85.158.91, TLS, session=<J1PLbydIzatmgTbW>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.240.219.146
country_id: 6252001
description:
Jan 12 07:51:57 host2 pure-ftpd[1272727]: (?@66.240.219.146) [INFO] New connection from 66.240.219.146


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 66.240.219.146
country_id: 6252001
description:
Jan 12 07:52:05 host2 pure-ftpd[1272882]: (?@66.240.219.146) [INFO] New connection from 66.240.219.146


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.85.104.2
country_id: 6252001
description:
2026-01-12 07:52:54 dovecot_plain authenticator failed for H=(sality) [96.85.104.2]:34962: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.121
country_id: 6252001
description:
2026-01-12 07:56:34 dovecot_login authenticator failed for H=([209.23.72.121]) [209.23.72.121]:58508: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.209.30
country_id: 1269750
description:
2026-01-12 07:57:01 dovecot_login authenticator failed for H=([125.18.43.161]) [128.185.209.30]:50670: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 12 07:58:11 host2 sshd[1279104]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2026-01-12 08:06:26 dovecot_login authenticator failed for H=(nsg-corporate-126.176.185.122.airtel.in) [122.185.176.126]:45472: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.50
country_id: 1269750
description:
2026-01-12 08:11:06 dovecot_login authenticator failed for H=([125.16.246.121]) [182.95.63.50]:49180: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.36.82
country_id: 1210997
description:
2026-01-12 08:10:43 dovecot_login authenticator failed for H=([49.0.36.82]) [49.0.36.82]:35150: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.18.99.38
country_id: 1269750
description:
2026-01-12 08:11:37 dovecot_login authenticator failed for H=([182.95.20.225]) [125.18.99.38]:36212: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.135
country_id: 6252001
description:
Jan 12 08:12:19 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 22 secs): user=<>, rip=162.216.150.135, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<HrPm0idI28Oi2JaH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.196.209.55
country_id: 6252001
description:
2026-01-12 08:12:19 dovecot_plain authenticator failed for H=c-98-196-209-55.hsd1.tx.comcast.net (precaly) [98.196.209.55]:52992: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.135
country_id: 6252001
description:
Jan 12 08:13:12 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 12 secs): user=<>, rip=162.216.150.135, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<Fn4K1idIeOai2JaH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.135
country_id: 6252001
description:
Jan 12 08:14:31 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=162.216.150.135, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<bffB2idIDOWi2JaH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.233.206.154
country_id: 1327865
description:
Jan 12 08:15:50 host2 sshd[1296635]: Disconnected from invalid user runner 103.233.206.154 port 62218 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.145.164
country_id: 2921044
description:
Jan 12 08:16:46 host2 sshd[1297479]: Disconnected from invalid user test 139.59.145.164 port 43706 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.181.23
country_id: 1880251
description:
Jan 12 08:16:42 host2 sshd[1297365]: Disconnected from invalid user sftptest 188.166.181.23 port 53042 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.233.206.154
country_id: 1327865
description:
Jan 12 08:17:09 host2 sshd[1297987]: Disconnected from invalid user sshtest 103.233.206.154 port 37729 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.233.206.154
country_id: 1327865
description:
Jan 12 08:19:24 host2 sshd[1300579]: Disconnected from invalid user sftptest 103.233.206.154 port 50235 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.233.206.154
country_id: 1327865
description:
Jan 12 08:20:29 host2 sshd[1301865]: Disconnected from invalid user alex 103.233.206.154 port 56500 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.145.164
country_id: 2921044
description:
Jan 12 08:20:42 host2 sshd[1302052]: Disconnected from invalid user deployuser 139.59.145.164 port 33394 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 139.59.145.164
country_id: 2921044
description:
Jan 12 08:21:38 host2 sshd[1302716]: Disconnected from invalid user bitrix 139.59.145.164 port 37174 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.135
country_id: 6252001
description:
Jan 12 08:22:25 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.135, lip=66.85.158.92, TLS, session=<oZIL9ydIFPOi2JaH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.129.90.215
country_id: 2921044
description:
2026-01-12 08:22:26 dovecot_login authenticator failed for H=ns3241969.ip-57-129-90.eu [57.129.90.215]:48458: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 86.107.77.201
country_id: 2921044
description:
Jan 12 08:22:49 host2 sshd[1304125]: Disconnected from invalid user devel 86.107.77.201 port 46946 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2026-01-12 08:22:09 dovecot_login authenticator failed for H=([103.50.5.94]) [103.50.5.94]:48107: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2026-01-12 08:24:40 dovecot_plain authenticator failed for H=c-174-161-27-82.hsd1.tn.comcast.net (nonry) [174.161.27.82]:51370: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.142.157
country_id: 3017382
description:
2026-01-12 08:25:50 dovecot_login authenticator failed for H=157.ip-51-75-142.eu [51.75.142.157]:58892: 535 Incorrect authentication data (set_id=all@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.160
country_id: 6252001
description:
Jan 12 08:27:38 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=147.185.132.160, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<vRevCShImN+TuYSg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.130
country_id: 1269750
description:
2026-01-12 08:28:23 dovecot_login authenticator failed for H=([182.95.184.130]) [182.95.184.130]:58654: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.218.2
country_id: 1269750
description:
2026-01-12 08:28:29 dovecot_login authenticator failed for H=([61.246.205.1]) [125.19.218.2]:46438: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2026-01-12 08:28:48 dovecot_login authenticator failed for H=([122.184.124.46]) [122.184.124.46]:60314: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.36
country_id: 2245662
description:
2026-01-12 08:28:51 dovecot_login authenticator failed for H=([213.154.80.21]) [213.154.80.36]:38166: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2026-01-12 08:28:15 dovecot_login authenticator failed for H=(23-30-11-253-static.hfc.comcastbusiness.net) [23.30.11.253]:40518: 535 Incorrect authentication data (set_id=admin@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.28
country_id: 1733045
description:
2026-01-12 08:29:18 dovecot_login authenticator failed for H=([49.124.151.28]) [49.124.151.28]:49280: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.7.200.152
country_id: 1861060
description:
2026-01-12 08:29:32 dovecot_login authenticator failed for H=v157-7-200-152.cwit.static.cnode.io [157.7.200.152]:51542: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.75.93
country_id: 1880251
description:
2026-01-12 08:29:45 dovecot_login authenticator failed for H=([49.245.75.93]) [49.245.75.93]:60406: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.29.26
country_id: 3144096
description:
2026-01-12 08:30:28 dovecot_login authenticator failed for H=(cm-178.232.29.26.get.no) [178.232.29.26]:41321: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.162.102
country_id: 1269750
description:
2026-01-12 08:30:32 dovecot_login authenticator failed for H=([125.19.164.187]) [125.19.162.102]:56412: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.218.57.50
country_id: 3996063
description:
2026-01-12 08:30:43 dovecot_login authenticator failed for H=(customer-187-218-57-50.uninet-ide.com.mx) [187.218.57.50]:19860: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.229
country_id: 337996
description:
2026-01-12 08:31:02 dovecot_login authenticator failed for H=([196.189.124.229]) [196.189.124.229]:35030: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.214.126.1
country_id: 6252001
description:
Jan 12 08:33:48 host2 sshd[1315248]: Disconnected from invalid user dev 162.214.126.1 port 46942 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.160
country_id: 6252001
description:
Jan 12 08:34:43 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.132.160, lip=66.85.158.91, TLS, session=<4pT7IihIxvGTuYSg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.53.133.167
country_id: 1694008
description:
Jan 12 08:35:55 host2 sshd[1317682]: Disconnected from invalid user azureuser 122.53.133.167 port 43404 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.214.126.1
country_id: 6252001
description:
Jan 12 08:36:32 host2 sshd[1318203]: Disconnected from invalid user ftp-test 162.214.126.1 port 59186 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.91.252.38
country_id: 3017382
description:
Jan 12 08:36:10 host2 sshd[1317937]: Disconnected from invalid user sshtest 51.91.252.38 port 47582 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.207.4.157
country_id: 2635167
description:
Jan 12 08:37:27 host2 sshd[1319052]: Disconnected from invalid user mailuser 92.207.4.157 port 48830 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 92.207.4.157
country_id: 2635167
description:
Jan 12 08:38:02 host2 sshd[1319506]: Disconnected from invalid user ansible 92.207.4.157 port 59990 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.53.133.167
country_id: 1694008
description:
Jan 12 08:38:25 host2 sshd[1319785]: Disconnected from invalid user webadmin 122.53.133.167 port 54576 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.91.252.38
country_id: 3017382
description:
Jan 12 08:40:03 host2 sshd[1321417]: Disconnected from invalid user git 51.91.252.38 port 59818 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.245.189.48
country_id: 6252001
description:
Jan 12 08:40:44 host2 sshd[1322094]: Disconnected from invalid user jenkins 157.245.189.48 port 52678 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.91.252.38
country_id: 3017382
description:
Jan 12 08:41:00 host2 sshd[1322315]: Disconnected from invalid user ubuntu 51.91.252.38 port 60958 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 174.138.87.242
country_id: 6252001
description:
Jan 12 08:41:06 host2 sshd[1322436]: Disconnected from invalid user dockeradmin 174.138.87.242 port 57280 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 174.138.87.242
country_id: 6252001
description:
Jan 12 08:41:33 host2 sshd[1322821]: Disconnected from invalid user student1 174.138.87.242 port 58586 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.119.85.181
country_id: 3686110
description:
Jan 12 08:41:36 host2 sshd[1322855]: Disconnected from invalid user webtest 181.119.85.181 port 47790 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.216.25.179
country_id: 1861060
description:
Jan 12 08:42:03 host2 sshd[1323319]: Disconnected from invalid user bitwarden 4.216.25.179 port 59124 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.245.189.48
country_id: 6252001
description:
Jan 12 08:41:13 host2 sshd[1322539]: Disconnected from invalid user mc 157.245.189.48 port 46408 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.108.134
country_id: 1819730
description:
Jan 12 08:43:03 host2 sshd[1324312]: Disconnected from invalid user ark 101.36.108.134 port 60362 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.119.85.181
country_id: 3686110
description:
Jan 12 08:42:15 host2 sshd[1323511]: Disconnected from invalid user develop 181.119.85.181 port 59470 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.16.115.209
country_id: 2921044
description:
Jan 12 08:42:45 host2 sshd[1324096]: Disconnected from invalid user sshtest 94.16.115.209 port 34744 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.216.25.179
country_id: 1861060
description:
Jan 12 08:43:26 host2 sshd[1324882]: Disconnected from invalid user deployadmin 4.216.25.179 port 57114 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 4.216.25.179
country_id: 1861060
description:
Jan 12 08:44:03 host2 sshd[1325525]: Disconnected from invalid user devuser 4.216.25.179 port 46896 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.127.217
country_id: 1512440
description:
2026-01-12 08:43:16 dovecot_login authenticator failed for H=([213.230.127.217]) [213.230.127.217]:39360: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.168.135.187
country_id: 1643084
description:
Jan 12 08:43:20 host2 sshd[1324755]: Disconnected from invalid user test 103.168.135.187 port 52800 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.75.122.7
country_id: 927384
description:
2026-01-12 08:43:49 dovecot_login authenticator failed for H=([41.75.122.7]) [41.75.122.7]:34252: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2026-01-12 08:43:34 dovecot_login authenticator failed for H=([192.34.128.202]) [192.34.128.202]:42476: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.216.25.179
country_id: 1861060
description:
Jan 12 08:44:41 host2 sshd[1326169]: Disconnected from invalid user build 4.216.25.179 port 39854 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.104.187.66
country_id: 719819
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 185.104.187.66 - washeera@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.216.25.179
country_id: 1861060
description:
Jan 12 08:45:20 host2 sshd[1326808]: Disconnected from invalid user rstudio 4.216.25.179 port 45216 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.123
country_id: 1269750
description:
2026-01-12 08:45:48 dovecot_login authenticator failed for H=(nsg-corporate-123.230.187.122.airtel.in) [122.187.230.123]:44341: 535 Incorrect authentication data (set_id=postmaster@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.175
country_id: 732800
description:
2026-01-12 08:46:00 dovecot_login authenticator failed for H=(92.62.243.175.fibermax.bg) [92.62.243.175]:55860: 535 Incorrect authentication data (set_id=postmaster@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.82
country_id: 1269750
description:
2026-01-12 08:46:14 dovecot_login authenticator failed for H=([59.145.212.121]) [182.95.184.82]:33550: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.16.115.209
country_id: 2921044
description:
Jan 12 08:48:21 host2 sshd[1330406]: Disconnected from invalid user ubuntu 94.16.115.209 port 58718 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.43.127.193
country_id: 3175395
description:
Jan 12 08:48:23 host2 sshd[1330424]: Disconnected from invalid user username 151.43.127.193 port 24183 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.252
country_id: 6252001
description:
Jan 12 08:48:36 host2 pure-ftpd[1330858]: (?@205.210.31.252) [INFO] New connection from 205.210.31.252


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 94.16.115.209
country_id: 2921044
description:
Jan 12 08:49:17 host2 sshd[1332189]: Disconnected from invalid user service 94.16.115.209 port 42044 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.108.134
country_id: 1819730
description:
Jan 12 08:49:26 host2 sshd[1332438]: Disconnected from invalid user ftpuser 101.36.108.134 port 33106 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.168.135.187
country_id: 1643084
description:
Jan 12 08:49:39 host2 sshd[1332719]: Disconnected from invalid user sshtest 103.168.135.187 port 44156 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.108.134
country_id: 1819730
description:
Jan 12 08:50:36 host2 sshd[1333694]: Disconnected from invalid user ftptest 101.36.108.134 port 49930 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.93.204.248
country_id: 3469034
description:
Jan 12 08:50:40 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=177.93.204.248, lip=66.85.158.91, TLS, session=<NNT+WihIgtCxXcz4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.168.135.187
country_id: 1643084
description:
Jan 12 08:50:14 host2 sshd[1333374]: Disconnected from invalid user app 103.168.135.187 port 34016 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.223.216.7
country_id: 3996063
description:
Jan 12 08:50:47 host2 sshd[1333962]: Disconnected from invalid user sdtd 189.223.216.7 port 58557 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.4
country_id: 3469034
description:
Jan 12 08:51:02 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<careers>, method=PLAIN, rip=177.44.71.4, lip=66.85.158.91, TLS, session=<X3kxXChIxJqxLEcE>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.223.216.7
country_id: 3996063
description:
Jan 12 08:54:47 host2 sshd[1338208]: Disconnected from invalid user nexus 189.223.216.7 port 48152 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.223.216.7
country_id: 3996063
description:
Jan 12 08:56:41 host2 sshd[1339997]: Disconnected from invalid user dockertest 189.223.216.7 port 41528 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.245.12.201
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 172.245.12.201 - cloudtourssrilan "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.83.135.122
country_id: 6251999
description:
2026-01-12 08:58:58 dovecot_login authenticator failed for H=([24.83.135.122]) [24.83.135.122]:56544: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.63.110
country_id: 3144096
description:
2026-01-12 08:59:22 dovecot_login authenticator failed for H=([84.214.63.110]) [84.214.63.110]:44953: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan 12 09:04:09 host2 sshd[1346651]: Disconnected from invalid user user 2.57.121.25 port 11568 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.191.212.112
country_id: 337996
description:
Jan 12 09:08:40 host2 sshd[1350956]: Disconnected from invalid user ftp-user 196.191.212.112 port 33575 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.229.122.23
country_id: 1819730
description:
Jan 12 09:11:11 host2 sshd[1353724]: Disconnected from invalid user max 83.229.122.23 port 59932 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 83.229.122.23
country_id: 1819730
description:
Jan 12 09:11:54 host2 sshd[1354598]: Disconnected from invalid user odoo13 83.229.122.23 port 41288 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.215.36
country_id: 732800
description:
Jan 12 09:12:41 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=185.255.215.36, lip=66.85.158.91, TLS, session=<xz7MqShIJYa5/9ck>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.98.97.183
country_id: 3077311
description:
Jan 12 09:12:59 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<env_eng>, method=PLAIN, rip=176.98.97.183, lip=66.85.158.91, TLS, session=<D1jhqihIDNOwYmG3>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.188.83.115
country_id: 2921044
description:
Jan 12 09:14:16 host2 sshd[1356783]: Disconnected from invalid user developer 64.188.83.115 port 52630 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan 12 09:14:19 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<+lGlsChIOrYDiUnd>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.191.212.112
country_id: 337996
description:
Jan 12 09:15:57 host2 sshd[1358291]: Disconnected from invalid user sshadmin 196.191.212.112 port 49478 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan 12 09:15:28 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<lZTDtChIxJ0DiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2026-01-12 09:15:48 dovecot_plain authenticator failed for H=c-73-168-136-150.hsd1.il.comcast.net (vercal) [73.168.136.150]:46114: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan 12 09:16:19 host2 dovecot[3239883]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<16jMtyhIeKUDiUnd>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 12 09:17:54 host2 sshd[1360119]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan 12 09:17:37 host2 dovecot[3239883]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<NZNtvChIYN8DiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan 12 09:18:58 host2 dovecot[3239883]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<gnRBwShI0qkDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan 12 09:20:08 host2 dovecot[3239883]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<XV5uxShIZs0DiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2026-01-12 09:22:54 dovecot_plain authenticator failed for H=(tengs) [65.20.153.146]:47350: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan 12 09:22:43 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<YA+lzihIYL4DiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.42.225.40
country_id: 2510769
description:
2026-01-12 09:22:53 dovecot_plain authenticator failed for H=40.red-81-42-225.staticip.rima-tde.net (nemans) [81.42.225.40]:45658: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan 12 09:24:14 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<VmAS1ChIiK8DiUnd>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.137.73.221
country_id: 6252001
description:
Jan 12 09:24:33 host2 dovecot[3239883]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<ci081ShIrusDiUnd>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 12 09:26:58 host2 sshd[1368434]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Jan 12 09:27:04 host2 dovecot[3239883]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<4wI23ihIvJcDiUnd>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 12 09:28:00 host2 sshd[1369624]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.161.96.107
country_id: 6252001
description:
2026-01-12 09:33:14 dovecot_plain authenticator failed for H=c-73-161-96-107.hsd1.mi.comcast.net (makoot) [73.161.96.107]:42474: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.231.6
country_id: 1269750
description:
2026-01-12 09:35:58 dovecot_login authenticator failed for H=([128.185.231.6]) [128.185.231.6]:37936: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.240.219.146
country_id: 6252001
description:
Jan 12 09:37:24 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=66.240.219.146, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<+FMsAylI9MRC8NuS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 113.193.234.210
country_id: 1269750
description:
Jan 12 09:40:36 host2 sshd[1382344]: Disconnected from invalid user github 113.193.234.210 port 22642 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 113.193.234.210
country_id: 1269750
description:
Jan 12 09:43:14 host2 sshd[1384657]: Disconnected from invalid user frappe 113.193.234.210 port 51051 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 12 09:44:40 host2 sshd[1386013]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.253.226
country_id: 1269750
description:
2026-01-12 09:48:19 dovecot_login authenticator failed for H=(abts-kk-static-226.253.166.122.airtelbroadband.in) [122.166.253.226]:54864: 535 Incorrect authentication data (set_id=director@jrdc.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.239.164.207
country_id: 3996063
description:
2026-01-12 09:48:30 dovecot_login authenticator failed for H=([177.239.164.207]) [177.239.164.207]:57685: 535 Incorrect authentication data (set_id=director)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.211.96
country_id: 99237
description:
2026-01-12 09:52:30 dovecot_login authenticator failed for H=([65.20.211.96]) [65.20.211.96]:52939: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.51.135
country_id: 3144096
description:
2026-01-12 09:52:46 dovecot_login authenticator failed for H=(cm-178.232.51.135.get.no) [178.232.51.135]:46485: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2026-01-12 09:53:19 dovecot_plain authenticator failed for H=(snecied) [102.53.15.17]:34129: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 118.193.56.149
country_id: 1605651
description:
Jan 12 10:00:06 host2 dovecot[3239883]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=118.193.56.149, lip=66.85.158.91, session=<IV9aVClI6q52wTiV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 118.193.56.149
country_id: 1605651
description:
Jan 12 10:00:24 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 18 secs): user=<>, rip=118.193.56.149, lip=66.85.158.91, session=<8412VSlI7K52wTiV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.5.238.101
country_id: 3175395
description:
2026-01-12 10:00:35 dovecot_login authenticator failed for H=host-87-5-238-101.retail.telecomitalia.it [87.5.238.101]:38004: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2026-01-12 10:01:18 dovecot_login authenticator failed for H=([196.191.212.236]) [213.55.85.202]:4863: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 118.193.56.149
country_id: 1605651
description:
Jan 12 10:03:52 host2 dovecot[3239883]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=118.193.56.149, lip=66.85.158.92, session=<3dHaYSlI2t92wTiV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 118.193.56.149
country_id: 1605651
description:
Jan 12 10:04:11 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 18 secs): user=<>, rip=118.193.56.149, lip=66.85.158.92, session=<zQT3YilI4N92wTiV>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 101.36.105.121
country_id: 1861060
description:
Jan 12 10:04:36 host2 pure-ftpd[1406836]: (?@101.36.105.121) [INFO] New connection from 101.36.105.121


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.122.125.26
country_id: 6252001
description:
Jan 12 10:04:49 host2 pure-ftpd[1407032]: (?@134.122.125.26) [INFO] New connection from 134.122.125.26


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.192.98
country_id: 6252001
description:
Jan 12 10:06:15 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.65.192.98, lip=66.85.158.92, TLS, session=<or5YailImO0UQcBi>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 146.190.82.181
country_id: 1880251
description:
Jan 12 10:07:04 host2 pure-ftpd[1409425]: (?@146.190.82.181) [INFO] New connection from 146.190.82.181


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.7
country_id: 798549
description:
Jan 12 10:06:10 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.7, lip=66.85.158.91, TLS: Connection closed, session=<2twRailIcINV2ZUH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan 12 10:07:14 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<vbTjbSlIdoYDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan 12 10:09:03 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<rh5ZdClIZLsDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan 12 10:09:18 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: Connection closed, session=<n/1EdSlIfMoDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan 12 10:10:17 host2 dovecot[3239883]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS, session=<6sXJeClIdMcDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.218.49
country_id: 3469034
description:
2026-01-12 10:11:58 dovecot_login authenticator failed for H=([179.184.218.49]) [179.184.218.49]:57567: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.78
country_id: 1269750
description:
2026-01-12 10:11:35 dovecot_login authenticator failed for H=(nsg-corporate-186.152.185.122.airtel.in) [182.95.178.78]:34814: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan 12 10:11:43 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<H8blfSlIkK0DhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan 12 10:12:42 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS, session=<c/FngSlIMt0DhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.40.210.26
country_id: 6252001
description:
Jan 12 10:25:19 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=20.40.210.26, lip=66.85.158.91, TLS, session=<E4aFrilIUoYUKNIa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.154
country_id: 1269750
description:
2026-01-12 10:29:14 dovecot_login authenticator failed for H=(nsg-corporate-1.193.187.122.airtel.in) [182.95.178.154]:42124: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.218.26
country_id: 1269750
description:
2026-01-12 10:29:37 dovecot_login authenticator failed for H=(nsg-corporate-191.126.187.122.airtel.in) [182.66.218.26]:35126: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 136.113.146.40
country_id: 6252001
description:
Jan 12 10:32:08 host2 pure-ftpd[1435046]: (?@136.113.146.40) [INFO] New connection from 136.113.146.40


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.240.219.146
country_id: 6252001
description:
Jan 12 10:40:13 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=66.240.219.146, lip=66.85.158.91, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<r3XP4ylINLNC8NuS>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.102.244.53
country_id: 798544
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 149.102.244.53 - isuru@euroentertainmentlk.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.234.132.204
country_id: 6290252
description:
Jan 12 10:47:41 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=91.234.132.204, lip=66.85.158.91, TLS, session=<MJ2M/SlIIJRb6oTM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.190.167.202
country_id: 3865483
description:
Jan 12 10:48:04 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<careers>, method=PLAIN, rip=186.190.167.202, lip=66.85.158.91, TLS, session=<47qz/ilIt5a6vqfK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2026-01-12 10:48:28 dovecot_plain authenticator failed for H=c-73-197-194-98.hsd1.nj.comcast.net (oofliss) [73.197.194.98]:43910: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 12 10:49:52 host2 sshd[1452421]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-12 10:54:17 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (equerants) [87.103.126.54]:10853: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2026-01-12 10:55:07 dovecot_login authenticator failed for H=([38.226.118.9]) [38.226.118.0]:60990: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.184
country_id: 3144096
description:
2026-01-12 10:55:32 dovecot_login authenticator failed for H=(cm-178.232.153.184.get.no) [178.232.153.184]:57657: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.126.105.42
country_id: 3469034
description:
2026-01-12 11:04:41 dovecot_login authenticator failed for H=187-126-105-42.user.vtal.net.br (187-126-105-145.user.vtal.net.br) [187.126.105.42]:36601: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.244.235
country_id: 6252001
description:
2026-01-12 11:05:00 dovecot_login authenticator failed for H=c-67-172-244-235.hsd1.ut.comcast.net [67.172.244.235]:47590: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.156.1.127
country_id: 3469034
description:
2026-01-12 11:09:11 dovecot_login authenticator failed for H=([38.156.1.127]) [38.156.1.127]:49802: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.115.173.11
country_id: 1269750
description:
2026-01-12 11:09:38 dovecot_login authenticator failed for H=([45.115.173.11]) [45.115.173.11]:53953: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.50.170
country_id: 953987
description:
Jan 12 11:09:45 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=102.129.50.170, lip=66.85.158.91, TLS, session=<1o1YTCpInspmgTKq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 197.220.68.114
country_id: 51537
description:
Jan 12 11:10:05 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<env_eng>, method=PLAIN, rip=197.220.68.114, lip=66.85.158.91, TLS, session=<oCKVTSpIeajF3ERy>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 12 11:11:47 host2 sshd[1475273]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2026-01-12 11:12:25 dovecot_plain authenticator failed for H=c-174-169-224-27.hsd1.vt.comcast.net (regenize) [174.169.224.27]:44942: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.73.135.75
country_id: 3865483
description:
Jan 12 11:16:29 host2 sshd[1480564]: Disconnected from invalid user sshtest 200.73.135.75 port 49508 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.73.135.75
country_id: 3865483
description:
Jan 12 11:18:12 host2 sshd[1482387]: Disconnected from invalid user appuser 200.73.135.75 port 46464 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.73.135.75
country_id: 3865483
description:
Jan 12 11:19:32 host2 sshd[1483643]: Disconnected from invalid user admin1 200.73.135.75 port 40676 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.74
country_id: 1269750
description:
Jan 12 11:21:42 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 26 secs): user=<training>, method=PLAIN, rip=103.18.166.74, lip=66.85.158.91, TLS, session=<owyqdipIE6pnEqZK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.177.113.22
country_id: 3175395
description:
Jan 12 11:21:48 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<training>, method=PLAIN, rip=195.177.113.22, lip=66.85.158.91, TLS, session=<FHs2dypIRbnDsXEW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.173.58.47
country_id: 6252001
description:
2026-01-12 11:21:10 dovecot_plain authenticator failed for H=c-67-173-58-47.hsd1.il.comcast.net (medne) [67.173.58.47]:33692: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.92.243.14
country_id: 6252001
description:
Jan 12 11:21:12 host2 sshd[1485577]: Disconnected from invalid user upload 91.92.243.14 port 37648 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.93.199.143
country_id: 3469034
description:
Jan 12 11:21:12 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<training@v-deploy.com>, method=PLAIN, rip=177.93.199.143, lip=66.85.158.91, TLS, session=<E1xBdSpIxMyxXceP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.145.205.99
country_id: 3469034
description:
Jan 12 11:21:23 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<training@v-deploy.com>, method=PLAIN, rip=192.145.205.99, lip=66.85.158.91, TLS, session=<jgjwdSpIrO3Akc1j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 12 11:22:09 host2 sshd[1486500]: Disconnected from invalid user admin 2.57.121.112 port 27949 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 91.92.243.14
country_id: 6252001
description:
Jan 12 11:22:29 host2 sshd[1486764]: Disconnected from invalid user mc 91.92.243.14 port 58832 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.92.243.14
country_id: 6252001
description:
Jan 12 11:23:06 host2 sshd[1487440]: Disconnected from invalid user b 91.92.243.14 port 43864 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.175.86
country_id: 6252001
description:
Jan 12 11:24:13 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=40.124.175.86, lip=66.85.158.91, TLS handshaking: Connection closed, session=<DGQvgSpIAsAofK9W>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 12 11:24:43 host2 sshd[1488945]: Disconnected from invalid user admin 2.57.121.112 port 37867 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.220.97.188
country_id: 6252001
description:
2026-01-12 11:25:58 dovecot_login authenticator failed for H=c-98-220-97-188.hsd1.il.comcast.net [98.220.97.188]:55218: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 12 11:27:05 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<1+pTiypIpp9100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-01-12 11:28:48 dovecot_plain authenticator failed for H=(sexcarice) [24.187.213.29]:46530: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 12 11:29:35 host2 sshd[1493236]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.188.102.28
country_id: 298795
description:
2026-01-12 11:30:47 dovecot_login authenticator failed for H=([78.188.102.28]) [78.188.102.28]:56530: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.132.133.54
country_id: 1269750
description:
2026-01-12 11:37:00 dovecot_login authenticator failed for H=([61.246.72.73]) [203.132.133.54]:54512: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.67
country_id: 99237
description:
2026-01-12 11:42:01 dovecot_plain authenticator failed for H=(spiridnet) [65.20.129.67]:53860: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 12 11:42:35 host2 sshd[1506290]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2026-01-12 11:42:27 dovecot_login authenticator failed for H=([41.219.149.74]) [41.219.149.74]:10144: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.175.75
country_id: 99237
description:
2026-01-12 11:43:17 dovecot_login authenticator failed for H=([65.20.175.75]) [65.20.175.75]:60485: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.69
country_id: 6252001
description:
Jan 12 11:48:14 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.69, lip=66.85.158.91, TLS, session=<ojEU1ypIpO3G6xhF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.201.12
country_id: 6252001
description:
Jan 12 11:48:28 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.65.201.12, lip=66.85.158.92, TLS handshaking: Connection closed, session=<qqXr1ypI+MQUQckM>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.227.5.135
country_id: 6252001
description:
Jan 12 11:52:51 host2 sshd[1515412]: Disconnected from invalid user tunnel 165.227.5.135 port 36682 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.227.5.135
country_id: 6252001
description:
Jan 12 11:53:23 host2 sshd[1515820]: Disconnected from invalid user devuser 165.227.5.135 port 37994 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.244.74.84
country_id: 2658434
description:
Jan 12 11:53:31 host2 sshd[1515874]: Disconnected from invalid user csserver 104.244.74.84 port 36694 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.244.74.84
country_id: 2658434
description:
Jan 12 11:54:10 host2 sshd[1516512]: Disconnected from invalid user devtest 104.244.74.84 port 47454 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.244.74.84
country_id: 2658434
description:
Jan 12 11:54:46 host2 sshd[1517405]: Disconnected from invalid user socksuser 104.244.74.84 port 58210 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.244.74.84
country_id: 2658434
description:
Jan 12 11:55:23 host2 sshd[1518213]: Disconnected from invalid user teamspeak 104.244.74.84 port 40756 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.158.120.121
country_id: 3017382
description:
Jan 12 12:00:33 host2 sshd[1523233]: Disconnected from invalid user devel 51.158.120.121 port 54772 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.86
country_id: 1269750
description:
2026-01-12 12:03:02 dovecot_login authenticator failed for H=([122.184.127.86]) [122.184.127.86]:55650: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.158.120.121
country_id: 3017382
description:
Jan 12 12:03:29 host2 sshd[1525388]: Disconnected from invalid user m 51.158.120.121 port 48352 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.172.15.103
country_id: 3469034
description:
2026-01-12 12:03:34 dovecot_login authenticator failed for H=(177-172-15-62.user.vivozap.com.br) [177.172.15.103]:8454: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.158.120.121
country_id: 3017382
description:
Jan 12 12:03:59 host2 sshd[1525705]: Disconnected from invalid user dockeradmin 51.158.120.121 port 58904 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.157.40.219
country_id: 6251999
description:
2026-01-12 12:03:11 dovecot_login authenticator failed for H=([104.157.40.219]) [104.157.40.219]:42039: 535 Incorrect authentication data


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.158.120.121
country_id: 3017382
description:
Jan 12 12:04:27 host2 sshd[1526059]: Disconnected from invalid user bot2 51.158.120.121 port 58482 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.39.179
country_id: 6252001
description:
Jan 12 12:09:06 host2 sshd[1529936]: Disconnected from invalid user testsftp 162.240.39.179 port 38182 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 12 12:09:10 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<GaLSIStI/59100Db>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.240.39.179
country_id: 6252001
description:
Jan 12 12:11:20 host2 sshd[1532038]: Disconnected from invalid user rstudio 162.240.39.179 port 44888 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2026-01-12 12:14:33 dovecot_plain authenticator failed for H=(folutial) [94.201.22.158]:47864: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.6
country_id: 290557
description:
2026-01-12 12:14:38 dovecot_plain authenticator failed for H=(umplasses) [5.32.107.6]:44662: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.218.149
country_id: 1880251
description:
Jan 12 12:15:06 host2 sshd[1535245]: Disconnected from invalid user deploytest 152.32.218.149 port 42208 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.218.149
country_id: 1880251
description:
Jan 12 12:16:26 host2 sshd[1536189]: Disconnected from invalid user bot 152.32.218.149 port 50200 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.3.159.149
country_id: 6252001
description:
Jan 12 12:16:35 host2 sshd[1536315]: Disconnected from invalid user dockeradmin 192.3.159.149 port 35200 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.131.195
country_id: 1819730
description:
Jan 12 12:17:54 host2 sshd[1537212]: Disconnected from invalid user dockertest 152.32.131.195 port 52086 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.131.195
country_id: 1819730
description:
Jan 12 12:18:37 host2 sshd[1537900]: Disconnected from invalid user testsftp 152.32.131.195 port 36780 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.3.159.149
country_id: 6252001
description:
Jan 12 12:21:29 host2 sshd[1540965]: Disconnected from invalid user teamspeak 192.3.159.149 port 51782 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 192.3.159.149
country_id: 6252001
description:
Jan 12 12:22:34 host2 sshd[1541870]: Disconnected from invalid user dockertest 192.3.159.149 port 42090 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.3.159.149
country_id: 6252001
description:
Jan 12 12:22:03 host2 sshd[1541525]: Disconnected from invalid user jenkins 192.3.159.149 port 51792 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan 12 12:28:35 host2 sshd[1546920]: Disconnected from invalid user user 2.57.121.25 port 32582 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 158.94.210.79
country_id: 2750405
description:
[2026-01-12 12:31:04 +0530] info [cpaneld] 158.94.210.79 - mohmahawewa "GET /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mohmahawewa (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.181.19.144
country_id: 1527747
description:
2026-01-12 12:32:34 dovecot_login authenticator failed for H=(158.181.19.144.mega.kg) [158.181.19.144]:57352: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.213.98
country_id: 1269750
description:
2026-01-12 12:32:55 dovecot_login authenticator failed for H=([128.185.241.123]) [152.52.213.98]:51098: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 12 12:34:19 host2 sshd[1551645]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.97.155.25
country_id: 6252001
description:
2026-01-12 12:34:36 dovecot_plain authenticator failed for H=c-76-97-155-25.hsd1.ga.comcast.net (apodrou) [76.97.155.25]:39560: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.12.132.157
country_id: 1269750
description:
2026-01-12 12:36:17 dovecot_login authenticator failed for H=(rev.perfectinternet.in) [103.12.132.157]:60676: 535 Incorrect authentication data (set_id=abuse@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 173.254.230.2
country_id: 6252001
description:
Jan 12 12:37:14 host2 sshd[1554503]: Disconnected from invalid user ftp-test 173.254.230.2 port 49820 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 12 12:37:16 host2 sshd[1554509]: Disconnected from invalid user admin 2.57.121.112 port 61929 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.10.138
country_id: 1168579
description:
2026-01-12 12:37:27 dovecot_login authenticator failed for H=(203-128-10-138.braintel.net.pk) [203.128.10.138]:37965: 535 Incorrect authentication data (set_id=abuse)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 173.254.230.2
country_id: 6252001
description:
Jan 12 12:39:21 host2 sshd[1556020]: Disconnected from invalid user dockertest 173.254.230.2 port 49860 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.213.98
country_id: 1269750
description:
2026-01-12 12:39:52 dovecot_login authenticator failed for H=([128.185.241.123]) [152.52.213.98]:47228: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 173.254.230.2
country_id: 6252001
description:
Jan 12 12:41:27 host2 sshd[1558159]: Disconnected from invalid user jenkins 173.254.230.2 port 49898 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.213.175.140
country_id: 2510769
description:
Jan 12 12:43:57 host2 sshd[1560071]: Disconnected from invalid user ftp-test 185.213.175.140 port 18196 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 12 12:44:16 host2 sshd[1560402]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.99.248.133
country_id: 2510769
description:
Jan 12 12:44:38 host2 sshd[1560885]: Disconnected from invalid user socksuser 185.99.248.133 port 43550 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.211.236.187
country_id: 3175395
description:
2026-01-12 12:44:46 dovecot_plain authenticator failed for H=([80.211.236.187]) [80.211.236.187]:57446: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.213.175.140
country_id: 2510769
description:
Jan 12 12:44:56 host2 sshd[1561384]: Disconnected from invalid user devtest 185.213.175.140 port 41110 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.213.175.140
country_id: 2510769
description:
Jan 12 12:44:28 host2 sshd[1560590]: Disconnected from invalid user devtest 185.213.175.140 port 29730 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.35.67
country_id: 953987
description:
Jan 12 12:45:18 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 29 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=102.64.35.67, lip=66.85.158.91, TLS, session=<IvVtoStIBsNmQCND>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.213.175.140
country_id: 2510769
description:
Jan 12 12:45:22 host2 sshd[1561959]: Disconnected from invalid user botuser1 185.213.175.140 port 52490 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.19
country_id: 3469034
description:
Jan 12 12:45:37 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<careers>, method=PLAIN, rip=177.44.71.19, lip=66.85.158.91, TLS, session=<1REhoytIzL2xLEcT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.135.111.5
country_id: 298795
description:
Jan 12 12:47:43 host2 sshd[1564144]: Disconnected from invalid user admin 78.135.111.5 port 49234 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.11.64.178
country_id: 241170
description:
Jan 12 12:47:21 host2 sshd[1563865]: Disconnected from invalid user devtest 212.11.64.178 port 56074 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 212.11.64.178
country_id: 241170
description:
Jan 12 12:48:16 host2 sshd[1564552]: Disconnected from invalid user web 212.11.64.178 port 58900 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.99.248.133
country_id: 2510769
description:
Jan 12 12:49:41 host2 sshd[1565797]: Disconnected from invalid user m 185.99.248.133 port 56626 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.99.248.133
country_id: 2510769
description:
Jan 12 12:50:13 host2 sshd[1566444]: Disconnected from invalid user luis 185.99.248.133 port 58320 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.99.248.133
country_id: 2510769
description:
Jan 12 12:50:49 host2 sshd[1567176]: Disconnected from invalid user jenkins 185.99.248.133 port 35662 [preauth]


