# incident

plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 11:05:45 host2 sshd[2656944]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.181.181
country_id: 1831722
description:
2026-01-10 11:05:36 dovecot_login authenticator failed for H=([36.37.181.181]) [36.37.181.181]:40544: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.110.176.222
country_id: 1694008
description:
2026-01-10 11:05:58 dovecot_login authenticator failed for H=([27.110.176.222]) [27.110.176.222]:38598: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Jan 10 11:05:10 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@venee.lk>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<SSE9AQJIqvUvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 202.93.247.247
country_id: 1643084
description:
Jan 10 11:05:11 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@venee.lk>, method=PLAIN, rip=202.93.247.247, lip=66.85.158.91, session=<kIBNAQJIBoXKXff3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Jan 10 11:06:39 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<JRiMBgJISqZAF6S9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.28
country_id: 290557
description:
Jan 10 11:07:01 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=185.93.89.28, lip=66.85.158.91, session=<1Q/kBwJI4IS5XVkc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Jan 10 11:07:55 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<dHkbCwJIYOCnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.247.20.83
country_id: 1643084
description:
Jan 10 11:08:22 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=103.247.20.83, lip=66.85.158.91, session=<fga5DAJIsMtn9xRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan 10 11:09:13 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<eoy8DwJIQq4vWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan 10 11:09:44 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<aHaZEQJITsAyBvlc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.164.134.19
country_id: 1835841
description:
Jan 10 11:09:53 host2 sshd[2660146]: Disconnected from invalid user user2 43.164.134.19 port 34054 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 202.93.247.247
country_id: 1643084
description:
Jan 10 11:10:24 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=202.93.247.247, lip=66.85.158.91, session=<NhT8EwJIzt/KXff3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan 10 11:10:25 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ceylondigest.com>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<keALFAJI2queRdvj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.10.86.130
country_id: 3895114
description:
Jan 10 11:10:28 host2 sshd[2660859]: Disconnected from invalid user ftpuser 186.10.86.130 port 49994 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.238.191.229
country_id: 6252001
description:
Jan 10 11:12:43 host2 dovecot[1180436]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.238.191.229, lip=66.85.158.91, session=<UNZmHAJIHoED7r/l>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.10.86.130
country_id: 3895114
description:
Jan 10 11:13:13 host2 sshd[2663070]: Disconnected from invalid user ubuntu 186.10.86.130 port 56398 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.164.134.19
country_id: 1835841
description:
Jan 10 11:13:50 host2 sshd[2663455]: Disconnected from invalid user test 43.164.134.19 port 42670 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan 10 11:14:44 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@lankaherbalsolutions.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<hF54IwJIqIQUOAHJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan 10 11:16:51 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<HgwLKwJIGkVniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan 10 11:17:45 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@lankaherbalsolutions.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<e2dILgJI1u0yBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.84.16.145
country_id: 1880251
description:
Jan 10 11:17:25 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ceylondigest.com>, method=PLAIN, rip=47.84.16.145, lip=66.85.158.91, session=<fl0XLQJI2MYvVBCR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 10 11:18:46 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<nH/iMQJIHTB100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan 10 11:18:52 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<yjU7MgJIHpyOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan 10 11:19:58 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@venee.lk>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<OFMnNgJI5JWygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Jan 10 11:19:15 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<dpCfMwJIYNMvT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.68.110.207
country_id: 2921044
description:
Jan 10 11:21:21 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=138.68.110.207, lip=66.85.158.91, session=<d0wlOwJI7NuKRG7P>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Jan 10 11:23:01 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<tDcHQQJIcLOLO0qU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.5.158.211
country_id: 1655842
description:
2026-01-10 11:23:11 dovecot_plain authenticator failed for H=(8N8LN255TCKTWN) [139.5.158.211]:19258: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Jan 10 11:23:57 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<DoFpRAJItrCPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan 10 11:24:04 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<z3HXRAJIJoIz0msW>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 51.210.107.22
country_id: 3017382
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[51.210.107.22] [Remote Port]=[33318] [Authentication Database]=[mail] [Username]=[admin@venee.lk] (10/10 failures) (blocked until [Sun Jan 11 05:54:02 2026 UTC/Sun Jan 11 11:24:02 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan 10 11:25:12 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<p9zUSAJIutRCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan 10 11:26:31 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<1MeVTQJIlOEFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan 10 11:27:27 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<Gn/zUAJIIJGi8KbF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.59.74.148
country_id: 1269750
description:
Jan 10 11:27:46 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<DwAXUgJIOqWLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 141.94.22.51
country_id: 3017382
description:
Jan 10 11:28:24 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=141.94.22.51, lip=66.85.158.91, session=<wiVRVAJI7seNXhYz>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.211
country_id: 2635167
description:
Jan 10 11:28:35 host2 dovecot[1180436]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.211, lip=66.85.158.92, TLS, session=<PxQhVQJIXYpX7LDT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.163.122.133
country_id: 1210997
description:
2026-01-10 11:28:44 dovecot_login authenticator failed for H=([182.163.122.133]) [182.163.122.133]:37801: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.158.14.232
country_id: 1512440
description:
2026-01-10 11:29:05 dovecot_login authenticator failed for H=([195.158.14.232]) [195.158.14.232]:43644: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan 10 11:29:26 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<478PWAJI4tAv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan 10 11:29:58 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<mmfyWQJIIeMz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 141.94.22.51
country_id: 3017382
description:
Jan 10 11:31:04 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=141.94.22.51, lip=66.85.158.91, session=<ZrznXQJIAOSNXhYz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan 10 11:30:34 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<RPgTXAJINuYvTJuG>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.249.32.140
country_id: 3017382
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 173.249.32.140 - vdeploy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan 10 11:33:39 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@melanifinefood.com>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<Dr4iZwJICLKOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Jan 10 11:34:20 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<l++KaQJIVj8vWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan 10 11:35:10 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<Z4OHbAJIm5Yz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan 10 11:35:19 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@venee.lk>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<22EKbQJI0wVniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.247.20.83
country_id: 1643084
description:
Jan 10 11:35:57 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@sobaherbal.com>, method=PLAIN, rip=103.247.20.83, lip=66.85.158.91, session=<YOlWbwJI6N5n9xRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan 10 11:36:35 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@venee.lk>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<ugiVcQJIAutIpyJ4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.105.156.165
country_id: 3923057
description:
Jan 10 11:38:21 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=200.105.156.165, lip=66.85.158.91, session=<rZLzdwJIfOLIaZyl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.247.20.83
country_id: 1643084
description:
Jan 10 11:40:11 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 6 secs): user=<office@lankaherbalsolutions.com>, method=PLAIN, rip=103.247.20.83, lip=66.85.158.91, session=<DWpEfgJIMOFn9xRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan 10 11:40:51 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<4WnRgAJIVBZniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.105.156.165
country_id: 3923057
description:
Jan 10 11:40:51 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@seyawin.com>, method=PLAIN, rip=200.105.156.165, lip=66.85.158.91, session=<xArVgAJIounIaZyl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 97.74.84.186
country_id: 1880251
description:
Jan 10 11:42:05 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@venee.lk>, method=PLAIN, rip=97.74.84.186, lip=66.85.158.91, session=<w+8yhQJImOdhSlS6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan 10 11:42:19 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<HLMVhgJIftQv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan 10 11:42:35 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<LtIShwJIxOAvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Jan 10 11:45:38 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@dataesite.lk>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<K27rkQJIBCGnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan 10 11:46:18 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@rehanseo.online>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<trxVlAJI1LJnmud6>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 103.154.231.122
country_id: 1643084
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[103.154.231.122] [Remote Port]=[45780] [Authentication Database]=[mail] [Username]=[office@rehanseo.online] (10/10 failures) (blocked until [Sun Jan 11 06:16:16 2026 UTC/Sun Jan 11 11:46:16 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.27.203.227
country_id: 3439705
description:
Jan 10 11:46:56 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=179.27.203.227, lip=66.85.158.91, session=<xhKblgJI5IqzG8vj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.135.19.135
country_id: 1819730
description:
Jan 10 11:47:13 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=43.135.19.135, lip=66.85.158.91, session=<iFihlwJIdM4rhxOH>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 5.133.121.104
country_id: 1512440
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[5.133.121.104] [Remote Port]=[58940] [Authentication Database]=[mail] [Username]=[hr@venee.lk] (10/10 failures) (blocked until [Sun Jan 11 06:17:29 2026 UTC/Sun Jan 11 11:47:29 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan 10 11:47:31 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@venee.lk>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<n320mAJIPOYFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Jan 10 11:48:49 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<AzxcnQJIMLBAF6S9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 202.93.247.247
country_id: 1643084
description:
Jan 10 11:48:31 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=202.93.247.247, lip=66.85.158.91, session=<3NRKnAJIxLzKXff3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 105.174.17.50
country_id: 3351879
description:
Jan 10 11:48:35 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=105.174.17.50, lip=66.85.158.91, session=<LfSJnAJIluBprhEy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.27.203.227
country_id: 3439705
description:
Jan 10 11:49:56 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=179.27.203.227, lip=66.85.158.91, session=<OVVSoQJIBp2zG8vj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.158.216
country_id: 2510769
description:
2026-01-10 11:51:05 dovecot_login authenticator failed for H=([207.188.158.216]) [207.188.158.216]:60138: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Jan 10 11:52:17 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ceylondigest.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<XAzCqQJIAlCnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 97.74.84.186
country_id: 1880251
description:
Jan 10 11:52:19 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=97.74.84.186, lip=66.85.158.91, session=<+R3oqQJIgOBhSlS6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan 10 11:53:07 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<mXS7rAJIhIqi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.49
country_id: 290557
description:
Jan 10 11:53:11 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=185.93.89.49, lip=66.85.158.91, session=<iA77rAJI+tu5XVkx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 202.93.247.247
country_id: 1643084
description:
Jan 10 11:53:47 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=202.93.247.247, lip=66.85.158.91, session=<YqghrwJIuILKXff3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan 10 11:53:48 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ceylondigest.com>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<Uq4vrwJIlNaeRdvj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan 10 11:54:23 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@rehanseo.online>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<sn9IsQJI8ucvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan 10 11:54:22 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<aVA3sQJI9uyi8KbF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Jan 10 11:55:09 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<noreply@venee.lk>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<SrTlswJIeo6LO0qU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.158
country_id: 1269750
description:
2026-01-10 11:55:57 dovecot_login authenticator failed for H=([182.95.26.52]) [182.95.185.158]:50182: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 139.59.74.148
country_id: 1269750
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[139.59.74.148] [Remote Port]=[36474] [Authentication Database]=[mail] [Username]=[noreply@venee.lk] (10/10 failures) (blocked until [Sun Jan 11 06:25:07 2026 UTC/Sun Jan 11 11:55:07 2026 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.76
country_id: 2186224
description:
2026-01-10 11:56:15 dovecot_login authenticator failed for H=([121.73.168.76]) [121.73.168.76]:45334: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan 10 11:56:35 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<t9shuQJIvLSi8KbF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan 10 11:58:21 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@sobaherbal.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<0PdzvwJIiKIyBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.27.203.227
country_id: 3439705
description:
Jan 10 11:58:24 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=179.27.203.227, lip=66.85.158.91, session=<p9udvwJI+r2zG8vj>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 179.27.203.227
country_id: 3439705
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[179.27.203.227] [Remote Port]=[48634] [Authentication Database]=[mail] [Username]=[info@ceylondigest.com] (10/10 failures) (blocked until [Sun Jan 11 06:28:22 2026 UTC/Sun Jan 11 11:58:22 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.7.212
country_id: 690791
description:
Jan 10 11:59:06 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=176.103.7.212, lip=66.85.158.91, TLS, session=<d3REwQJIVeWwZwfU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Jan 10 11:59:09 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<JNtPwgJI1tmPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 207.248.113.77
country_id: 3996063
description:
Jan 10 11:59:24 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=207.248.113.77, lip=66.85.158.91, TLS, session=<XnNewgJIc9nP+HFN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan 10 11:59:30 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<9u5/wwJI6t4vTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.45
country_id: 290557
description:
Jan 10 12:00:02 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=185.93.89.45, lip=66.85.158.91, session=<oJl9xQJI+LS5XVkt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan 10 12:01:31 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<YS3DygJIJoRnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan 10 12:01:50 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<hqDmywJIer0FhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Jan 10 12:04:07 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 7 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<nyzC0wJIEsJAF6S9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan 10 12:04:18 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<Z6a31AJIpq6ygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.108.89.210
country_id: 3932488
description:
Jan 10 12:05:02 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=190.108.89.210, lip=66.85.158.91, session=<fj5Z1wJI4p6+bFnS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan 10 12:05:05 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<qPGI1wJI7sRnmud6>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan 10 12:04:15 host2 pure-ftpd[2706374]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 178.128.27.123
country_id: 1880251
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[178.128.27.123] [Remote Port]=[44710] [Authentication Database]=[mail] [Username]=[sales@essenceceylontea.com] (10/10 failures) (blocked until [Sun Jan 11 06:34:16 2026 UTC/Sun Jan 11 12:04:16 2026 LOCAL])


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.14.88.150
country_id: 6252001
description:
Jan 10 12:05:21 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.14.88.150, lip=66.85.158.92, session=<ICue2AJIfsAUDliW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.57.236.167
country_id: 1819730
description:
Jan 10 12:06:24 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=47.57.236.167, lip=66.85.158.91, session=</T423AJI9pEvOeyn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Jan 10 12:06:41 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<y0ZG3QJImLO8putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.27.203.227
country_id: 3439705
description:
Jan 10 12:07:04 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=179.27.203.227, lip=66.85.158.91, session=<1sGi3gJIlqWzG8vj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.188.10
country_id: 3144096
description:
2026-01-10 12:07:55 dovecot_login authenticator failed for H=([178.232.188.10]) [178.232.188.10]:34286: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan 10 12:10:56 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<8zt27AJIoNyygBt7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.83.134.101
country_id: 3469034
description:
2026-01-10 12:10:11 dovecot_login authenticator failed for H=(179.83.135.1.dynamic.adsl.gvt.net.br) [179.83.134.101]:53067: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.84.34.85
country_id: 1210997
description:
2026-01-10 12:10:23 dovecot_login authenticator failed for H=(ppp075.bol-online.com) [202.84.34.85]:49946: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan 10 12:12:00 host2 pure-ftpd[2714497]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.44
country_id: 1269750
description:
2026-01-10 12:13:07 dovecot_login authenticator failed for H=([103.147.248.44]) [103.147.248.44]:49228: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.108.89.210
country_id: 3932488
description:
Jan 10 12:14:18 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@venee.lk>, method=PLAIN, rip=190.108.89.210, lip=66.85.158.91, session=<ePZ8+AJIAKi+bFnS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.177.88.3
country_id: 3624060
description:
2026-01-10 12:14:21 dovecot_login authenticator failed for H=([186.177.88.3]) [186.177.88.3]:57616: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.227.252.2
country_id: 1269750
description:
2026-01-10 12:14:10 dovecot_login authenticator failed for H=(abts-tn-dynamic-2.252.227.110.airtelbroadband.in) [110.227.252.2]:59322: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan 10 12:15:21 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<mhJB/AJITKcvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.231.254.192
country_id: 1819730
description:
Jan 10 12:16:06 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ceylondigest.com>, method=PLAIN, rip=103.231.254.192, lip=66.85.158.91, session=<2jLz/gJIlOZn5/7A>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.21
country_id: 1733045
description:
2026-01-10 12:16:14 dovecot_login authenticator failed for H=([49.124.152.21]) [49.124.152.21]:60162: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.69.31.253
country_id: 3469034
description:
2026-01-10 12:16:27 dovecot_login authenticator failed for H=(177-069-031-253.static.ctbctelecom.com.br) [177.69.31.253]:46612: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan 10 12:16:31 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ceylondigest.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<77RzAANI8uxnpBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.247
country_id: 1269750
description:
2026-01-10 12:17:00 dovecot_login authenticator failed for H=(nsg-corporate-247.228.187.122.airtel.in) [122.187.228.247]:49074: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.208.46.130
country_id: 1522867
description:
2026-01-10 12:17:33 dovecot_login authenticator failed for H=([37.208.46.130]) [37.208.46.130]:53008: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.247.77.115
country_id: 1269750
description:
2026-01-10 12:18:38 dovecot_login authenticator failed for H=([103.220.16.51]) [117.247.77.115]:42456: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.248.243.181
country_id: 2542007
description:
2026-01-10 12:18:49 dovecot_plain authenticator failed for H=(llacums) [41.248.243.181]:47312: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.185.212
country_id: 6252001
description:
Jan 10 12:19:06 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=40.124.185.212, lip=66.85.158.91, session=<JLzECQNIWokofLnU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.44.54
country_id: 1269750
description:
2026-01-10 12:19:14 dovecot_login authenticator failed for H=(static.bb.alp.61.2.44.54.bsnl.in) [61.2.44.54]:56948: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan 10 12:19:39 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<fC+hCwNI/McyBvlc>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 12:21:16 host2 sshd[2724942]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan 10 12:22:12 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<EgHGFANISqMUOAHJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan 10 12:25:20 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@sobaherbal.com>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<rNPoHwNIPLmOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan 10 12:27:33 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@venee.lk>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<t6/nJwNIEKMz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan 10 12:27:36 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<Z0IMKANI/MuygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.213.223
country_id: 99237
description:
Jan 10 12:28:08 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=65.20.213.223, lip=66.85.158.91, TLS, session=<B6MSKQNI86pBFNXf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.60.48
country_id: 2300660
description:
Jan 10 12:28:29 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=41.139.60.48, lip=66.85.158.91, TLS, session=<Z9kxKgNIhbkpizww>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.229.246
country_id: 6252001
description:
Jan 10 12:29:14 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@kiriaswanu.com>, method=PLAIN, rip=162.240.229.246, lip=66.85.158.91, session=<hdTpLQNIXsyi8OX2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Jan 10 12:29:27 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@bostonlanka.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<5XqrLgNIWpGLO0qU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.132.133.54
country_id: 1269750
description:
2026-01-10 12:30:58 dovecot_login authenticator failed for H=(dsl-del-dynamic-073.72.246.61.airtelbroadband.in) [203.132.133.54]:33368: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.126
country_id: 1269750
description:
2026-01-10 12:31:25 dovecot_login authenticator failed for H=([125.17.198.33]) [182.95.178.126]:49392: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Jan 10 12:32:15 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<VsqpOANIeIsvT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.229.246
country_id: 6252001
description:
Jan 10 12:32:21 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@seyawin.com>, method=PLAIN, rip=162.240.229.246, lip=66.85.158.91, session=<Y/X4OANIKtei8OX2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.25.232.7
country_id: 953987
description:
Jan 10 12:32:55 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<amila@euroentertainmentlk.com>, method=PLAIN, rip=41.25.232.7, lip=66.85.158.91, session=<ndsYOwNIuekpGegH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan 10 12:33:30 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@essenceceylontea.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<7g4lPQNI4Okz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Jan 10 12:34:14 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@essenceceylontea.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<IDXJPwNIMq6LO0qU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.178
country_id: 1269750
description:
2026-01-10 12:34:24 dovecot_login authenticator failed for H=([182.95.222.178]) [182.95.222.178]:35982: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.182.65.40
country_id: 3017382
description:
2026-01-10 12:34:33 dovecot_login authenticator failed for H=40.ip-217-182-65.eu [217.182.65.40]:38642: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan 10 12:34:37 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<0YwuQQNIpKdCdMzo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.157.219.158
country_id: 6252001
description:
2026-01-10 12:36:12 dovecot_plain authenticator failed for H=c-76-157-219-158.hsd1.il.comcast.net (profulatic) [76.157.219.158]:35194: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan 10 12:36:46 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<uYvYSANIHsIFhXlo>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 125.20.16.22
country_id: 1269750
description:
Jan 10 12:38:20 host2 sshd[2739297]: Disconnected from invalid user ubuntu 125.20.16.22 port 19100 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan 10 12:38:46 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<zRnTTwNIbJ8z0msW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.4.68.73
country_id: 1210997
description:
2026-01-10 12:39:34 dovecot_login authenticator failed for H=(210.4.68-73.bdcom.com) [210.4.68.73]:51632: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.78
country_id: 1733045
description:
2026-01-10 12:39:58 dovecot_login authenticator failed for H=([49.124.151.78]) [49.124.151.78]:48178: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan 10 12:40:22 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<p/q2VQNIxt2Oq2dI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2026-01-10 12:42:16 dovecot_plain authenticator failed for H=c-174-169-224-27.hsd1.vt.comcast.net (coprify) [174.169.224.27]:54400: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.83.145.39
country_id: 6252001
description:
Jan 10 12:43:50 host2 dovecot[1180436]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.83.145.39, lip=66.85.158.91, session=<JPU+YgNIyNQDU5En>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 10 12:46:26 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 6 secs): user=<office@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<zMotawNITo1100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan 10 12:49:45 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<JGZIdwNIONAvWfaQ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 12:51:30 host2 sshd[2750800]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-01-10 12:51:34 dovecot_plain authenticator failed for H=host-196-47-172-253.afnet.net (stionite) [196.47.172.253]:59471: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Jan 10 12:51:30 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 7 secs): user=<support@dataesite.lk>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<jPs8fQNIHtqnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.45
country_id: 290557
description:
Jan 10 12:52:11 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=185.93.89.45, lip=66.85.158.91, session=<ZZnzfwNIuuK5XVkt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.88
country_id: 6252001
description:
Jan 10 12:53:42 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.88, lip=66.85.158.91, session=<MU6MhQNImvqTuYRY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan 10 12:55:11 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<29ysigNIGIpnmud6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 10 12:56:50 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: Connection closed, session=<l0a8kANIiOQDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 105.174.17.50
country_id: 3351879
description:
Jan 10 12:57:50 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=105.174.17.50, lip=66.85.158.91, session=<DDMrlANIPzVprhEy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 10 12:57:10 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: Connection closed, session=<pxvzkQNImMIDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 10 12:58:08 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<2gNhlQNI8pIDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan 10 12:58:38 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<d3UMlwNIbIAFhXlo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.35.53
country_id: 3144096
description:
2026-01-10 12:58:42 dovecot_login authenticator failed for H=([46.212.35.53]) [46.212.35.53]:58329: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.170.59
country_id: 99237
description:
2026-01-10 12:58:54 dovecot_login authenticator failed for H=([65.20.170.59]) [65.20.170.59]:57248: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 10 12:59:59 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<VUAAnANISM4DhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.27.203.227
country_id: 3439705
description:
Jan 10 13:00:25 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=179.27.203.227, lip=66.85.158.91, session=<n5xonQNIIouzG8vj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 10 13:00:09 host2 dovecot[1180436]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<2FaSnANI5O0DhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Jan 10 13:01:46 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@venee.lk>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<2gs/ogNInMuLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan 10 13:01:52 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@rehanseo.online>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<85mbogNIeIovWfaQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 10 13:02:05 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<XXt+owNI9pUDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 10 13:02:15 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<j5YXpANIsqkDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan 10 13:02:26 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@kiriaswanu.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<YmyepANInuGi8KbF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 10 13:03:51 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<1cnPqQNIRogDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan 10 13:04:40 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@dataesite.lk>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<OqmjrANISk6i8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.97.23
country_id: 1861060
description:
2026-01-10 13:05:37 dovecot_login authenticator failed for H=www.shirakami.or.jp [203.192.97.23]:39078: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.251.249.72
country_id: 2300660
description:
2026-01-10 13:08:28 dovecot_login authenticator failed for H=([197.251.249.72]) [197.251.249.72]:47403: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.27.203.227
country_id: 3439705
description:
Jan 10 13:09:00 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=179.27.203.227, lip=66.85.158.91, session=<J6cXvANIDrqzG8vj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.255.26
country_id: 2661886
description:
2026-01-10 13:08:13 dovecot_login authenticator failed for H=94-255-255-26.cust.bredband2.com [94.255.255.26]:47672: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 128.203.200.175
country_id: 6251999
description:
Jan 10 13:10:27 host2 pure-ftpd[2767302]: (?@128.203.200.175) [INFO] New connection from 128.203.200.175


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan 10 13:10:37 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<T3jnwQNIROZnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2026-01-10 13:11:28 dovecot_login authenticator failed for H=([128.185.39.145]) [128.185.214.78]:54152: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan 10 13:11:39 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<xY+SxQNIsLSygBt7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.106
country_id: 1269750
description:
2026-01-10 13:11:56 dovecot_login authenticator failed for H=([152.52.244.106]) [152.52.244.106]:51472: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-01-10 13:12:20 dovecot_plain authenticator failed for H=(vicalis) [24.187.213.29]:59278: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Jan 10 13:12:26 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@sobaherbal.com>, method=PLAIN, rip=157.230.24.207, lip=66.85.158.91, session=<enhoyANI6oed5hjP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan 10 13:12:59 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<RW5cygNIEOgFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.49
country_id: 290557
description:
Jan 10 13:14:27 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=185.93.89.49, lip=66.85.158.91, session=<b3ebzwNIIJ+5XVkx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 202.93.247.247
country_id: 1643084
description:
Jan 10 13:14:38 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=202.93.247.247, lip=66.85.158.91, session=<UXU80ANIDoTKXff3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan 10 13:14:34 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<DC8N0ANIisMv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan 10 13:14:11 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<m+ejzgNIyqpnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2026-01-10 13:16:07 dovecot_login authenticator failed for H=([38.226.118.9]) [38.226.118.0]:59522: 535 Incorrect authentication data (set_id=abuse)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Jan 10 13:15:35 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<fsmk0wNIFqS8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.246.166
country_id: 798544
description:
2026-01-10 13:15:54 dovecot_login authenticator failed for H=89-67-246-166.dynamic.play.pl [89.67.246.166]:38103: 535 Incorrect authentication data (set_id=abuse@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.57.236.167
country_id: 1819730
description:
Jan 10 13:16:38 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=47.57.236.167, lip=66.85.158.91, session=<F+Nn1wNIIq0vOeyn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 141.94.22.51
country_id: 3017382
description:
Jan 10 13:18:24 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=141.94.22.51, lip=66.85.158.91, session=<bfmt3QNI/LONXhYz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan 10 13:18:24 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<hr@venee.lk>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<5yKa3QNITptIpyJ4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan 10 13:18:30 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<m/YP3gNIwoeygBt7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.60.143.30
country_id: 3175395
description:
2026-01-10 13:19:07 dovecot_login authenticator failed for H=([151.60.143.30]) [151.60.143.30]:45809: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan 10 13:19:29 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<eM2T4QNIGulnpBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.174.182.38
country_id: 2077456
description:
2026-01-10 13:19:56 dovecot_login authenticator failed for H=203-174-182-38.ade.static-ipl.aapt.com.au [203.174.182.38]:35226: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.31
country_id: 1733045
description:
2026-01-10 13:23:36 dovecot_login authenticator failed for H=([49.124.153.31]) [49.124.153.31]:59684: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan 10 13:23:07 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<C56Z7gNIqJgvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.108.89.210
country_id: 3932488
description:
Jan 10 13:24:11 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@venee.lk>, method=PLAIN, rip=190.108.89.210, lip=66.85.158.91, session=<o8Nv8gNIlI2+bFnS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.105.156.165
country_id: 3923057
description:
Jan 10 13:25:08 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<office@seyawin.com>, method=PLAIN, rip=200.105.156.165, lip=66.85.158.91, session=<xDS69QNIGJjIaZyl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.93.50.90
country_id: 1821275
description:
Jan 10 13:25:57 host2 sshd[2780488]: Disconnected from invalid user ranju 182.93.50.90 port 41920 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.157.219.158
country_id: 6252001
description:
2026-01-10 13:27:32 dovecot_plain authenticator failed for H=c-76-157-219-158.hsd1.il.comcast.net (ophie) [76.157.219.158]:43560: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.82
country_id: 1269750
description:
2026-01-10 13:28:50 dovecot_login authenticator failed for H=([59.145.212.121]) [182.95.184.82]:40940: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.28
country_id: 290557
description:
Jan 10 13:28:11 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=185.93.89.28, lip=66.85.158.91, session=<W82yAARIoKu5XVkc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan 10 13:30:18 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<DD5HCARIyocyBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan 10 13:30:30 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<paEGCQRIwNsUOAHJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2026-01-10 13:31:03 dovecot_plain authenticator failed for H=(extes) [23.30.11.253]:34876: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2026-01-10 13:31:07 dovecot_plain authenticator failed for H=(upeway) [75.97.190.237]:53581: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan 10 13:31:43 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<lCJVDQRIWISOq2dI>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 142.171.103.72
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[142.171.103.72] [Remote Port]=[33880] [Authentication Database]=[mail] [Username]=[info@sobaherbal.com] (10/10 failures) (blocked until [Sun Jan 11 08:01:41 2026 UTC/Sun Jan 11 13:31:41 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan 10 13:31:22 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@venee.lk>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<CbkfDARIf9Iz0msW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.93.50.90
country_id: 1821275
description:
Jan 10 13:32:38 host2 sshd[2785528]: Disconnected from invalid user lalit 182.93.50.90 port 43562 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.27.203.227
country_id: 3439705
description:
Jan 10 13:33:43 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=179.27.203.227, lip=66.85.158.91, session=<026JFARIDpezG8vj>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.247.137.203
country_id: 2635167
description:
Jan 10 13:34:10 host2 pure-ftpd[2786722]: (?@185.247.137.203) [INFO] New connection from 185.247.137.203


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.93.50.90
country_id: 1821275
description:
Jan 10 13:34:57 host2 sshd[2787382]: Disconnected from invalid user sudhir 182.93.50.90 port 49248 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.224.242.137
country_id: 2635167
description:
2026-01-10 13:35:33 dovecot_login authenticator failed for H=([109.224.242.136]) [109.224.242.137]:34682: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan 10 13:35:37 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<TtRUGwRI0sCygBt7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.8.218.251
country_id: 2661886
description:
2026-01-10 13:36:03 dovecot_login authenticator failed for H=(251.218.8.81.sta.ac-net.se) [81.8.218.251]:50156: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.69.161.214
country_id: 6252001
description:
2026-01-10 13:36:19 dovecot_login authenticator failed for H=([208.69.161.214]) [208.69.161.214]:57556: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.18.99.10
country_id: 1269750
description:
2026-01-10 13:36:37 dovecot_login authenticator failed for H=([125.18.99.10]) [125.18.99.10]:46484: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Jan 10 13:36:53 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<cr/bHwRI1MKLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan 10 13:37:26 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<CuTRIQRIeMcz0msW>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 50.6.249.92
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[50.6.249.92] [Remote Port]=[35142] [Authentication Database]=[mail] [Username]=[admin@lankaherbalsolutions.com] (10/10 failures) (blocked until [Sun Jan 11 08:07:57 2026 UTC/Sun Jan 11 13:37:57 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan 10 13:37:59 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<UPPHIwRIRokyBvlc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-10 13:38:37 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (furets) [87.103.126.54]:16813: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan 10 13:39:26 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<bMD4KARInumeRdvj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2026-01-10 13:39:39 dovecot_plain authenticator failed for H=c-68-60-77-128.hsd1.mi.comcast.net (abler) [68.60.77.128]:39094: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.231.254.192
country_id: 1819730
description:
Jan 10 13:40:02 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ceylondigest.com>, method=PLAIN, rip=103.231.254.192, lip=66.85.158.91, session=<fG0bKwRIsJln5/7A>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan 10 13:40:27 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<RNORLARIks+i8KbF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Jan 10 13:41:01 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@venee.lk>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<FRaiLgRI6L9AF6S9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan 10 13:41:30 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<INNdMARIQJEv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.80.9
country_id: 3144096
description:
2026-01-10 13:41:32 dovecot_login authenticator failed for H=([178.232.80.9]) [178.232.80.9]:36103: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Jan 10 13:41:49 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<Nmh0MQRI5LKLO0qU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.18.99.38
country_id: 1269750
description:
2026-01-10 13:41:08 dovecot_login authenticator failed for H=([182.95.20.225]) [125.18.99.38]:52150: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan 10 13:42:49 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<5vsSNQRIxYEz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan 10 13:44:59 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<z/bOPARIsK1CdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan 10 13:46:34 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<s1RzQgRIHNWOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan 10 13:48:01 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<K2amRwRIcJgFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Jan 10 13:52:30 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 7 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<ZQ1hVwRInopAF6S9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Jan 10 13:52:37 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<4escWARIVOYvT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 168.205.223.170
country_id: 3469034
description:
Jan 10 13:56:07 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=168.205.223.170, lip=66.85.158.91, TLS, session=<WqWyYwRIMouozd+q>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Jan 10 13:55:29 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<lPhbYgRIdMOnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.27.203.227
country_id: 3439705
description:
Jan 10 13:56:22 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=179.27.203.227, lip=66.85.158.91, session=<dq6IZQRIPpizG8vj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.193.129.122
country_id: 6290252
description:
Jan 10 13:56:25 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=62.193.129.122, lip=66.85.158.91, TLS, session=<6SXPZARIVJo+wYF6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan 10 13:56:45 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<o0/iZgRIHqlIpyJ4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan 10 13:57:43 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<dg9ZagRICLQvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Jan 10 13:58:30 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<PD4qbQRIouynYwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2026-01-10 13:58:55 dovecot_plain authenticator failed for H=c-73-13-220-220.hsd1.de.comcast.net (embos) [73.13.220.220]:58242: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 141.94.22.51
country_id: 3017382
description:
Jan 10 14:00:49 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=141.94.22.51, lip=66.85.158.91, session=<jpdndQRIBr+NXhYz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.68.110.207
country_id: 2921044
description:
Jan 10 14:01:00 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=138.68.110.207, lip=66.85.158.91, session=<9/ATdgRIXq2KRG7P>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.156.238.162
country_id: 3686110
description:
Jan 10 14:02:48 host2 sshd[2809543]: Disconnected from invalid user user 190.156.238.162 port 57580 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.40.122.250
country_id: 2629691
description:
2026-01-10 14:03:40 dovecot_login authenticator failed for H=nova-185-040-122-250.cpe.novanet.is [185.40.122.250]:45716: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.108.89.210
country_id: 3932488
description:
Jan 10 14:03:56 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=190.108.89.210, lip=66.85.158.91, session=<pj2XgARInJu+bFnS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.124.75
country_id: 1269750
description:
2026-01-10 14:03:23 dovecot_login authenticator failed for H=(aes-static-075.124.17.125.airtel.in) [125.17.124.75]:51868: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 202.93.247.247
country_id: 1643084
description:
Jan 10 14:03:52 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@venee.lk>, method=PLAIN, rip=202.93.247.247, lip=66.85.158.91, session=<pANXgARI2IzKXff3>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 92.27.101.99
country_id: 2635167
description:
Jan 10 14:03:59 host2 sshd[2810383]: Disconnected from invalid user debian 92.27.101.99 port 34960 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan 10 14:04:55 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@rehanseo.online>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<cZ4OhARI/MBnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.156.238.162
country_id: 3686110
description:
Jan 10 14:04:10 host2 sshd[2810507]: Disconnected from invalid user claude 190.156.238.162 port 54580 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.84.16.145
country_id: 1880251
description:
Jan 10 14:05:23 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@ceylondigest.com>, method=PLAIN, rip=47.84.16.145, lip=66.85.158.91, session=<pvi+hQRIFMUvVBCR>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 162.240.166.197
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[162.240.166.197] [Remote Port]=[52348] [Authentication Database]=[mail] [Username]=[support@sobaherbal.com] (10/10 failures) (blocked until [Sun Jan 11 08:35:26 2026 UTC/Sun Jan 11 14:05:26 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan 10 14:05:28 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<oF8ThgRIfMyi8KbF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2026-01-10 14:05:09 dovecot_plain authenticator failed for H=(coliks) [94.201.22.158]:50930: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.156.238.162
country_id: 3686110
description:
Jan 10 14:06:38 host2 sshd[2812335]: Disconnected from invalid user user 190.156.238.162 port 49230 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.86.94.251
country_id: 2921044
description:
Jan 10 14:07:07 host2 sshd[2812763]: Disconnected from invalid user frappe 172.86.94.251 port 43264 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.49
country_id: 290557
description:
Jan 10 14:06:23 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=185.93.89.49, lip=66.85.158.91, session=<+apUiQRI4qi5XVkx>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 14:07:26 host2 sshd[2813012]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan 10 14:07:48 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<IYZmjgRIpo0yBvlc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.2
country_id: 1149361
description:
2026-01-10 14:08:06 dovecot_login authenticator failed for H=([149.54.62.2]) [149.54.62.2]:51197: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 105.174.17.50
country_id: 3351879
description:
Jan 10 14:08:07 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=105.174.17.50, lip=66.85.158.91, session=<QIR6jwRIrB5prhEy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 10 14:07:37 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<Hc6/jQRIPFF100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.66.34.121
country_id: 1643084
description:
Jan 10 14:07:44 host2 sshd[2813349]: Disconnected from invalid user ftpuser 157.66.34.121 port 43092 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.122
country_id: 1269750
description:
2026-01-10 14:08:33 dovecot_login authenticator failed for H=([125.17.205.185]) [182.95.178.122]:38626: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.45
country_id: 290557
description:
Jan 10 14:08:55 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=185.93.89.45, lip=66.85.158.91, session=<9glokgRITte5XVkt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.162
country_id: 1269750
description:
2026-01-10 14:08:57 dovecot_login authenticator failed for H=([152.52.192.162]) [152.52.192.162]:55760: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan 10 14:09:06 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@venee.lk>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<7lUKkwRIBpwFhXlo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.95.24.117
country_id: 2464461
description:
2026-01-10 14:08:40 dovecot_login authenticator failed for H=([193.95.21.147]) [193.95.24.117]:34254: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 23.94.112.185
country_id: 6252001
description:
Jan 10 14:08:48 host2 sshd[2814249]: Disconnected from invalid user azureuser 23.94.112.185 port 40480 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.219.68.189
country_id: 3865483
description:
2026-01-10 14:09:11 dovecot_login authenticator failed for H=([201.219.68.189]) [201.219.68.189]:40932: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan 10 14:09:19 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<Fc3MkwRIgNCi8KbF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 10 14:09:21 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<kWbskwRIlJh100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.48
country_id: 290557
description:
Jan 10 14:09:22 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=185.93.89.48, lip=66.85.158.91, session=<4d4DlARIWoW5XVkw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan 10 14:10:00 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@rehanseo.online>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<U0RDlgRI5rkvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.27.203.227
country_id: 3439705
description:
Jan 10 14:11:05 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=179.27.203.227, lip=66.85.158.91, session=<uJcqmgRIGrOzG8vj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Jan 10 14:10:12 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<ee/8lgRI0uSLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.47
country_id: 290557
description:
Jan 10 14:10:57 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=185.93.89.47, lip=66.85.158.91, session=<hueumQRInuO5XVkv>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.114.147.217
country_id: 1655842
description:
Jan 10 14:10:58 host2 sshd[2816111]: Disconnected from invalid user claude 103.114.147.217 port 55494 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.114.147.217
country_id: 1655842
description:
Jan 10 14:11:37 host2 sshd[2816549]: Disconnected from invalid user frappe 103.114.147.217 port 37140 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.46
country_id: 290557
description:
Jan 10 14:11:43 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=185.93.89.46, lip=66.85.158.91, session=<oJpsnARI5pe5XVku>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan 10 14:12:22 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<N9y1ngRIpLKi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.105.156.165
country_id: 3923057
description:
Jan 10 14:12:09 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@kiriaswanu.com>, method=PLAIN, rip=200.105.156.165, lip=66.85.158.91, session=<0ur7nQRI9s/IaZyl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.126.144.30
country_id: 6252001
description:
2026-01-10 14:13:12 dovecot_plain authenticator failed for H=ool-457e901e.dyn.optonline.net (rosive) [69.126.144.30]:61515: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.67.155.180
country_id: 298795
description:
Jan 10 14:13:51 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=45.67.155.180, lip=66.85.158.91, TLS, session=<v1kjowRIUM0tQ5u0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.135.19.135
country_id: 1819730
description:
Jan 10 14:13:58 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<finance@ceylondigest.com>, method=PLAIN, rip=43.135.19.135, lip=66.85.158.91, session=<gMJSpARIAtUrhxOH>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 157.66.34.121
country_id: 1643084
description:
Jan 10 14:14:09 host2 sshd[2818285]: Disconnected from invalid user vpn 157.66.34.121 port 49006 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.96.199.203
country_id: 3865483
description:
Jan 10 14:14:11 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=186.96.199.203, lip=66.85.158.91, TLS, session=<xJpEpARIIMi6YMfL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.10
country_id: 1269750
description:
2026-01-10 14:16:40 dovecot_login authenticator failed for H=([128.185.241.106]) [182.95.54.10]:33834: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.229.42
country_id: 1269750
description:
2026-01-10 14:17:00 dovecot_login authenticator failed for H=([152.52.238.53]) [152.52.229.42]:39272: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.27.203.227
country_id: 3439705
description:
Jan 10 14:19:40 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=179.27.203.227, lip=66.85.158.91, session=<KhzSuARIeuezG8vj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan 10 14:20:32 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<cPrquwRIDt5nmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.46.144
country_id: 1819730
description:
2026-01-10 14:24:03 dovecot_login authenticator failed for H=144.46.246.220.static.netvigator.com [220.246.46.144]:55844: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan 10 14:23:21 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@essenceceylontea.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<JD4DxgRIKKIFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan 10 14:24:12 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<IG0LyQRI1qhnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.134.120
country_id: 1269750
description:
2026-01-10 14:24:16 dovecot_login authenticator failed for H=(abts-mum-static-120.134.179.122.airtelbroadband.in) [122.179.134.120]:52271: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Jan 10 14:25:10 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<u4CFzARIPIG8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.70
country_id: 1269750
description:
2026-01-10 14:25:15 dovecot_login authenticator failed for H=([125.17.70.25]) [125.20.251.70]:54554: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.123.118
country_id: 1269750
description:
2026-01-10 14:25:27 dovecot_login authenticator failed for H=([122.184.123.118]) [122.184.123.118]:45386: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.209.80
country_id: 933860
description:
Jan 10 14:26:00 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=41.216.209.80, lip=66.85.158.91, TLS, session=<INp0zgRIj50p2NFQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.245.250.137
country_id: 3469034
description:
Jan 10 14:26:19 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=170.245.250.137, lip=66.85.158.91, TLS, session=<zyK1zwRIeqCq9fqJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.57.236.167
country_id: 1819730
description:
Jan 10 14:27:56 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=47.57.236.167, lip=66.85.158.91, session=<itVX1gRIcuUvOeyn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.233.21.109
country_id: 272103
description:
2026-01-10 14:30:17 dovecot_login authenticator failed for H=([109.233.21.109]) [109.233.21.109]:59236: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2026-01-10 14:30:32 dovecot_login authenticator failed for H=([128.185.39.145]) [128.185.214.78]:44676: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan 10 14:31:09 host2 pure-ftpd[2830783]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan 10 14:31:13 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<kt0o4gRIIrkvWfaQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.242.142
country_id: 1269750
description:
2026-01-10 14:32:18 dovecot_login authenticator failed for H=([125.19.172.137]) [182.78.242.142]:51340: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.23.199.238
country_id: 2921044
description:
2026-01-10 14:33:07 dovecot_login authenticator failed for H=([193.23.199.238]) [193.23.199.238]:51512: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.112.146
country_id: 1269750
description:
2026-01-10 14:34:31 dovecot_login authenticator failed for H=([182.95.85.103]) [182.95.112.146]:56316: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.124.202
country_id: 1269750
description:
2026-01-10 14:34:41 dovecot_login authenticator failed for H=([182.95.124.202]) [182.95.124.202]:38602: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.170
country_id: 99237
description:
2026-01-10 14:34:51 dovecot_login authenticator failed for H=([65.20.251.170]) [65.20.251.170]:43747: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.251.121.70
country_id: 1861060
description:
2026-01-10 14:35:02 dovecot_login authenticator failed for H=works.ssc-gr.info [160.251.121.70]:49014: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan 10 14:36:10 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<noreply@venee.lk>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<Y1PO8wRI6sIz0msW>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 14:37:43 host2 sshd[2835905]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan 10 14:37:58 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<znFN+gRIaumOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan 10 14:38:05 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<Usi3+gRICNcyBvlc>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan 10 14:38:41 host2 pure-ftpd[2836596]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.226.197.43
country_id: 2264397
description:
Jan 10 14:39:38 host2 dovecot[1180436]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=185.226.197.43, lip=66.85.158.92, session=<Af1XAAVIi4S54sUr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.226.197.42
country_id: 2264397
description:
Jan 10 14:39:39 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_read failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 1 secs): user=<>, rip=185.226.197.42, lip=66.85.158.92, TLS: SSL_read failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<A8JrAAVIPNq54sUq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.226.197.43
country_id: 2264397
description:
Jan 10 14:39:42 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.226.197.43, lip=66.85.158.92, TLS, session=<HpadAAVId7q54sUr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.226.197.45
country_id: 2264397
description:
Jan 10 14:39:49 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.226.197.45, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher, session=<DMUKAQVIWY654sUt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan 10 14:40:12 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<Axc/AgVIAMcUOAHJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan 10 14:42:05 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@essenceceylontea.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<CmMGCQVIX5sz0msW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.178
country_id: 1269750
description:
2026-01-10 14:42:57 dovecot_login authenticator failed for H=([182.79.95.139]) [152.52.246.178]:41966: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.242.142
country_id: 1269750
description:
2026-01-10 14:42:12 dovecot_login authenticator failed for H=([125.19.172.137]) [182.78.242.142]:32964: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.57.80.193
country_id: 6252001
description:
2026-01-10 14:42:25 dovecot_plain authenticator failed for H=c-73-57-80-193.hsd1.fl.comcast.net (diked) [73.57.80.193]:45386: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.94.102
country_id: 290557
description:
2026-01-10 14:42:38 dovecot_login authenticator failed for H=([87.200.94.102]) [87.200.94.102]:53312: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.31.74
country_id: 1522867
description:
2026-01-10 14:43:26 dovecot_plain authenticator failed for H=2.135.31.74.dynamic.telecom.kz (subcal) [2.135.31.74]:52815: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Jan 10 14:45:05 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<j/bAEwVInMSLO0qU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.34.221
country_id: 1210997
description:
2026-01-10 14:44:15 dovecot_login authenticator failed for H=(113-11-34-221-smile.com.bd) [113.11.34.221]:51280: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.151.228.170
country_id: 1522867
description:
2026-01-10 14:44:29 dovecot_login authenticator failed for H=37.151.228.170.dynamic.telecom.kz [37.151.228.170]:39052: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan 10 14:47:22 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@bostonlanka.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<Y3XhGwVI5L4z0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.45
country_id: 290557
description:
Jan 10 14:47:22 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=185.93.89.45, lip=66.85.158.91, session=<Q2LgGwVI4te5XVkt>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 10 14:49:34 host2 sshd[2846848]: Disconnected from invalid user admin 2.57.121.112 port 57781 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Jan 10 14:49:57 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<jwceJQVIkLaLO0qU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.175.225
country_id: 6252001
description:
Jan 10 14:50:18 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=40.124.175.225, lip=66.85.158.91, session=<WtqIJgVIxqgofK/h>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.14.93.239
country_id: 6252001
description:
Jan 10 14:51:59 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.14.93.239, lip=66.85.158.92, session=<pCKHLAVI9oMUDl3v>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan 10 14:52:30 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<3htDLgVIVMeOq2dI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.185
country_id: 6252001
description:
Jan 10 14:54:12 host2 dovecot[1180436]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=71.6.146.185, lip=66.85.158.92, session=<jQBxNAVIBspHBpK5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan 10 14:56:04 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<6NYBOwVIVrYFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan 10 14:56:47 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<EiiRPQVIXMhCdMzo>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.223.28.152
country_id: 2510769
description:
[2026-01-10 14:56:13 +0530] info [webmaild] 82.223.28.152 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.177.191.168
country_id: 357994
description:
2026-01-10 14:57:47 dovecot_plain authenticator failed for H=(fulfize) [154.177.191.168]:35722: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.65.177.158
country_id: 6252001
description:
Jan 10 14:58:33 host2 pure-ftpd[2855903]: (?@20.65.177.158) [INFO] New connection from 20.65.177.158


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.84.211.204
country_id: 6252001
description:
Jan 10 15:00:13 host2 sshd[2857265]: Disconnected from invalid user lalit 50.84.211.204 port 47042 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 50.84.211.204
country_id: 6252001
description:
Jan 10 15:01:16 host2 sshd[2858110]: Disconnected from invalid user mu 50.84.211.204 port 41436 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Jan 10 15:04:03 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<KyqSVwVIGIenYwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2026-01-10 15:04:53 dovecot_plain authenticator failed for H=c-73-196-144-25.hsd1.nj.comcast.net (arkeed) [73.196.144.25]:35738: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan 10 15:05:39 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@anandaobauae.org>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<U0pKXQVIWqkvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan 10 15:14:36 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@rehanseo.online>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<Y0pHfQVIYqBnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.64
country_id: 1880251
description:
Jan 10 15:15:06 host2 sshd[2869948]: Disconnected from invalid user deployerer 45.78.223.64 port 48390 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.53.124
country_id: 6252001
description:
Jan 10 15:16:07 host2 sshd[2870933]: Disconnected from invalid user user1 209.141.53.124 port 42292 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 193.8.113.26
country_id: 2510769
description:
Jan 10 15:15:31 host2 sshd[2870472]: Disconnected from invalid user teamspeak 193.8.113.26 port 44014 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan 10 15:16:55 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<4FuWhQVIqsui8KbF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.143.72
country_id: 298795
description:
2026-01-10 15:17:01 dovecot_plain authenticator failed for H=(brypoloid) [5.11.143.72]:49002: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 105.174.17.50
country_id: 3351879
description:
Jan 10 15:16:33 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=105.174.17.50, lip=66.85.158.91, session=<89VAhAVI3tFprhEy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan 10 15:16:34 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@venee.lk>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<Z2tThAVImOkFhXlo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2026-01-10 15:17:27 dovecot_plain authenticator failed for H=c-73-145-107-251.hsd1.mi.comcast.net (dizedle) [73.145.107.251]:46668: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.19.147
country_id: 6252001
description:
Jan 10 15:17:30 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=18.97.19.147, lip=66.85.158.92, TLS handshaking: Connection closed, session=<fPjFhwVIBJ8SYROT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.128.144
country_id: 3469034
description:
Jan 10 15:17:59 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=191.53.128.144, lip=66.85.158.91, TLS, session=<8XhtiAVI372/NYCQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.17.124.171
country_id: 690791
description:
Jan 10 15:18:16 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=185.17.124.171, lip=66.85.158.91, TLS, session=<onyViQVIIuO5EXyr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Jan 10 15:19:03 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@bostonlanka.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<F4EzjQVICr6LO0qU>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.141.53.124
country_id: 6252001
description:
Jan 10 15:18:20 host2 sshd[2872621]: Disconnected from invalid user administrador 209.141.53.124 port 46962 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan 10 15:19:12 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@venee.lk>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<llW6jQVIJJmygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 105.174.17.50
country_id: 3351879
description:
Jan 10 15:20:22 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=105.174.17.50, lip=66.85.158.91, session=<j3vpkQVIg7FprhEy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan 10 15:20:56 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<Nxj0kwVIroEyBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.25.232.7
country_id: 953987
description:
Jan 10 15:20:21 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<amila@euroentertainmentlk.com>, method=PLAIN, rip=41.25.232.7, lip=66.85.158.91, session=<g9nWkQVIfvYpGegH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan 10 15:20:35 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<SbmukgVI+sJCdMzo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.250.47
country_id: 1605651
description:
Jan 10 15:20:59 host2 sshd[2874814]: Disconnected from invalid user frappe 118.194.250.47 port 45352 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan 10 15:22:05 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<J/oRmAVIBNKOq2dI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2026-01-10 15:21:22 dovecot_plain authenticator failed for H=c-98-40-101-10.hsd1.tn.comcast.net (tatiparco) [98.40.101.10]:60670: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.217.130.86
country_id: 3996063
description:
Jan 10 15:21:22 host2 sshd[2875165]: Disconnected from invalid user user 189.217.130.86 port 3723 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 97.74.84.186
country_id: 1880251
description:
Jan 10 15:21:30 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=97.74.84.186, lip=66.85.158.91, session=<ZJLXlQVI5J5hSlS6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.194.250.47
country_id: 1605651
description:
Jan 10 15:21:36 host2 sshd[2875348]: Disconnected from invalid user test 118.194.250.47 port 51758 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2026-01-10 15:22:59 dovecot_plain authenticator failed for H=c-71-224-169-28.hsd1.pa.comcast.net (cirker) [71.224.169.28]:36354: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Jan 10 15:23:27 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@dataesite.lk>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<9WHwnAVI5g6nYwhf>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 167.99.8.95
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[167.99.8.95] [Remote Port]=[3814] [Authentication Database]=[mail] [Username]=[finance@dataesite.lk] (10/10 failures) (blocked until [Sun Jan 11 09:53:25 2026 UTC/Sun Jan 11 15:23:25 2026 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.65.140.218
country_id: 3017382
description:
2026-01-10 15:24:03 dovecot_login authenticator failed for H=82-65-140-218.subs.proxad.net [82.65.140.218]:51164: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.191.8.27
country_id: 3017382
description:
2026-01-10 15:24:55 dovecot_login authenticator failed for H=([176.191.8.27]) [176.191.8.27]:39208: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.64
country_id: 1880251
description:
Jan 10 15:24:53 host2 sshd[2877738]: Disconnected from invalid user testuser 45.78.223.64 port 42994 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan 10 15:26:29 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<QanOpwVICJOOq2dI>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.253.205
country_id: 1819730
description:
Jan 10 15:28:49 host2 sshd[2880857]: Disconnected from invalid user claude 152.32.253.205 port 56018 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.26.36.195
country_id: 1819730
description:
Jan 10 15:29:12 host2 sshd[2881101]: Disconnected from invalid user user2 118.26.36.195 port 42700 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.254.137.144
country_id: 1605651
description:
Jan 10 15:31:42 host2 sshd[2883489]: Disconnected from invalid user vpn 27.254.137.144 port 43282 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan 10 15:33:59 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<Ni6gwgVICKgFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan 10 15:34:33 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@essenceceylontea.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<9yKtxAVIqqQz0msW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.37.215.112
country_id: 3175395
description:
Jan 10 15:34:41 host2 sshd[2885849]: Disconnected from invalid user test 151.37.215.112 port 32215 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.163
country_id: 3175395
description:
Jan 10 15:34:58 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=185.197.9.163, lip=66.85.158.91, TLS, session=<D8pBxQVIl6i5xQmj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.243.92.24
country_id: 2510769
description:
Jan 10 15:35:16 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=185.243.92.24, lip=66.85.158.91, TLS, session=<eBlUxgVI3ba581wY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.93.60.253
country_id: 3865483
description:
2026-01-10 15:35:22 dovecot_login authenticator failed for H=([181.93.60.253]) [181.93.60.253]:54194: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.30
country_id: 290557
description:
Jan 10 15:35:15 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=185.93.89.30, lip=66.85.158.91, session=<J/0oxwVIUKO5XVke>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.227.185.238
country_id: 1269750
description:
Jan 10 15:35:24 host2 sshd[2886582]: Disconnected from invalid user testuser 43.227.185.238 port 40082 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2026-01-10 15:35:34 dovecot_login authenticator failed for H=(c-50-188-204-213.unallocated.comcastbusiness.net) [50.188.204.213]:57814: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-01-10 15:37:05 dovecot_login authenticator failed for H=([197.219.228.242]) [197.219.228.242]:36034: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.26.36.195
country_id: 1819730
description:
Jan 10 15:36:13 host2 sshd[2887269]: Disconnected from invalid user steam 118.26.36.195 port 54978 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.29
country_id: 290557
description:
Jan 10 15:36:17 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=185.93.89.29, lip=66.85.158.91, session=<T43cygVINLa5XVkd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.59.39.85
country_id: 1269750
description:
2026-01-10 15:37:04 dovecot_plain authenticator failed for H=(6S73LVD8) [152.59.39.85]:52866: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.68.110.207
country_id: 2921044
description:
Jan 10 15:37:04 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<noreply@rehanseo.online>, method=PLAIN, rip=138.68.110.207, lip=66.85.158.91, session=<cZyazQVImomKRG7P>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.158.10
country_id: 99237
description:
2026-01-10 15:37:28 dovecot_login authenticator failed for H=([65.20.158.10]) [65.20.158.10]:43306: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.59.39.85
country_id: 1269750
description:
2026-01-10 15:37:10 dovecot_login authenticator failed for H=(6S73LVD8) [152.59.39.85]:52866: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan 10 15:37:14 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<WTo+zgVIYr0z0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.27
country_id: 290557
description:
Jan 10 15:38:59 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=185.93.89.27, lip=66.85.158.91, session=<aZSD1AVIHJm5XVkb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan 10 15:38:49 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@essenceceylontea.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<cwfs0wVI/sCygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.68.110.207
country_id: 2921044
description:
Jan 10 15:40:05 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<noreply@anandaobauae.org>, method=PLAIN, rip=138.68.110.207, lip=66.85.158.91, session=<us9j2AVIRLSKRG7P>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan 10 15:39:42 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@venee.lk>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<hD0V1wVIjcwz0msW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.186.104.101
country_id: 6252001
description:
2026-01-10 15:41:26 dovecot_login authenticator failed for H=wsip-184-186-104-101.lv.lv.cox.net [184.186.104.101]:47652: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Jan 10 15:42:03 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<6AN83wVI/qkvT1jH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-10 15:43:01 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (siathorism) [87.103.126.54]:50088: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.28
country_id: 290557
description:
Jan 10 15:42:08 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=185.93.89.28, lip=66.85.158.91, session=<6d/G3wVIQJa5XVkc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.108.39
country_id: 290557
description:
2026-01-10 15:42:16 dovecot_login authenticator failed for H=([94.204.108.39]) [94.204.108.39]:33450: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan 10 15:44:40 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@rehanseo.online>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<BlnY6AVIPsQvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan 10 15:44:41 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<aObS6AVILIsvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.175.201.167
country_id: 3469034
description:
2026-01-10 15:46:06 dovecot_login authenticator failed for H=200.175.201.167.dynamic.dialup.gvt.net.br (corporate.static.gvt.net.br) [200.175.201.167]:44618: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.122
country_id: 1269750
description:
2026-01-10 15:46:28 dovecot_login authenticator failed for H=([128.185.253.122]) [128.185.253.122]:39622: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan 10 15:46:56 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<rjHx8AVIotcUOAHJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.148.174.234
country_id: 2017370
description:
2026-01-10 15:47:39 dovecot_login authenticator failed for H=([31.148.174.234]) [31.148.174.234]:55236: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.138.181
country_id: 1819730
description:
2026-01-10 15:48:01 dovecot_login authenticator failed for H=(m121-202-138-181.smartone.com) [121.202.138.181]:41300: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.27.203.227
country_id: 3439705
description:
Jan 10 15:49:05 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=179.27.203.227, lip=66.85.158.91, session=<wJia+AVI+ruzG8vj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.192.123.12
country_id: 6252001
description:
2026-01-10 15:50:01 dovecot_plain authenticator failed for H=(oonce) [199.192.123.12]:54152: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.57.236.167
country_id: 1819730
description:
Jan 10 15:50:11 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=47.57.236.167, lip=66.85.158.91, session=<23N5/AVIQr4vOeyn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan 10 15:50:31 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=</BvF/QVItNcFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.27.203.227
country_id: 3439705
description:
Jan 10 15:50:33 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=179.27.203.227, lip=66.85.158.91, session=<nh3l/QVIEsuzG8vj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.225.186
country_id: 1269750
description:
2026-01-10 15:52:02 dovecot_login authenticator failed for H=([203.145.139.81]) [128.185.225.186]:33688: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan 10 15:52:09 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=</teVAwZImLlnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.158
country_id: 1269750
description:
2026-01-10 15:52:15 dovecot_login authenticator failed for H=([125.19.175.68]) [152.52.236.158]:52026: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 15:53:33 host2 sshd[2901766]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.37.215.112
country_id: 3175395
description:
Jan 10 15:53:21 host2 sshd[2901629]: Disconnected from invalid user postgres 151.37.215.112 port 32572 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.129.74.123
country_id: 2921044
description:
Jan 10 15:54:16 host2 sshd[2902469]: Disconnected from invalid user ec2-user 57.129.74.123 port 64722 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.181.196.96
country_id: 3469034
description:
2026-01-10 15:55:18 dovecot_login authenticator failed for H=([45.181.196.96]) [45.181.196.96]:43333: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.25.59.5
country_id: 3469034
description:
2026-01-10 15:55:52 dovecot_login authenticator failed for H=(ip-177-25-59-5.user.vivozap.com.br) [177.25.59.5]:45721: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 57.129.74.123
country_id: 2921044
description:
Jan 10 15:55:54 host2 sshd[2904031]: Disconnected from invalid user ubuntu 57.129.74.123 port 37269 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Jan 10 15:56:08 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<4TfWEQZIRJGPbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.129.74.123
country_id: 2921044
description:
Jan 10 15:56:24 host2 sshd[2904363]: Disconnected from invalid user claude 57.129.74.123 port 48551 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.169.200.254
country_id: 3469034
description:
Jan 10 15:56:28 host2 sshd[2904427]: Disconnected from invalid user claude 45.169.200.254 port 48594 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan 10 15:58:35 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<zQaYGgZISL2i8KbF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Jan 10 15:58:23 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.116.22, lip=66.85.158.92, TLS: Connection closed, session=<Bon5GQZIVKSLonQW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.169.200.254
country_id: 3469034
description:
Jan 10 15:58:23 host2 sshd[2905829]: Disconnected from invalid user ec2-user 45.169.200.254 port 54290 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.83.145.39
country_id: 6252001
description:
Jan 10 15:59:30 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.83.145.39, lip=66.85.158.91, TLS, session=<rND7HQZIJuEDU5En>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan 10 16:00:11 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<jTBKIAZI+Jpnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.222.41.185
country_id: 1269750
description:
2026-01-10 16:00:57 dovecot_login authenticator failed for H=(static.ill.117.247.82.240.bsnl.co.in) [117.222.41.185]:37952: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 135.237.127.112
country_id: 6252001
description:
Jan 10 16:01:37 host2 pure-ftpd[2908497]: (?@135.237.127.112) [INFO] New connection from 135.237.127.112


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.73.3
country_id: 1819730
description:
2026-01-10 16:01:50 dovecot_login authenticator failed for H=42-200-73-3.static.imsbiz.com [42.200.73.3]:56883: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 52.172.177.191
country_id: 1269750
description:
Jan 10 16:02:06 host2 sshd[2908820]: Disconnected from invalid user deploy 52.172.177.191 port 58824 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.172.177.191
country_id: 1269750
description:
Jan 10 16:01:29 host2 sshd[2908350]: Disconnected from invalid user ftpuser 52.172.177.191 port 60532 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.172.177.191
country_id: 1269750
description:
Jan 10 16:02:44 host2 sshd[2909341]: Disconnected from invalid user mailadmin 52.172.177.191 port 33126 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.28
country_id: 2635167
description:
Jan 10 16:03:59 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.28, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<kdkALgZIi4m594kc>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.158
country_id: 2635167
description:
Jan 10 16:03:57 host2 dovecot[1180436]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.158, lip=66.85.158.91, TLS, session=<9HHuLQZI556594me>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.37
country_id: 2635167
description:
Jan 10 16:04:32 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.37, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<NjH8LwZIebtX7LAl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.202.197.108
country_id: 6252001
description:
2026-01-10 16:04:36 dovecot_plain authenticator failed for H=(alman) [50.202.197.108]:38860: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Jan 10 16:04:44 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@venee.lk>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<ScidMAZI/uOLO0qU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.9
country_id: 2635167
description:
Jan 10 16:05:05 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.9, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<jKX7MQZIGb+594kJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan 10 16:04:20 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<oBorLwZIGKIvWfaQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.22
country_id: 2635167
description:
Jan 10 16:05:39 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.22, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Ir8CNAZIzcFX7LAW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.31
country_id: 2635167
description:
Jan 10 16:06:13 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.31, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<xiL+NQZIQ4e594kf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.33
country_id: 2635167
description:
Jan 10 16:06:46 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.33, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<+3f3NwZI44RX7LAh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.20
country_id: 2635167
description:
Jan 10 16:07:19 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.20, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<bdj0OQZIecC594kU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.14
country_id: 2635167
description:
Jan 10 16:07:52 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.14, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<5hLwOwZI5atX7LAO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.16
country_id: 2635167
description:
Jan 10 16:08:25 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (disconnected before auth was ready, waited 0 secs): user=<>, rip=87.236.176.16, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<5oDpPQZILchX7LAQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Jan 10 16:08:48 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<BSwbPwZIIoKPbtX3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.36
country_id: 2635167
description:
Jan 10 16:08:59 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.36, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<YtPkPwZIa4K594kk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Jan 10 16:08:14 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<noreply@essenceceylontea.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<RSYQPQZITpyLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.68.110.207
country_id: 2921044
description:
Jan 10 16:10:28 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<noreply@seyawin.com>, method=PLAIN, rip=138.68.110.207, lip=66.85.158.91, session=<oKn3RAZIBNOKRG7P>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan 10 16:12:31 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<I7prTAZIKsEvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Jan 10 16:14:19 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@sivagnanamfoundation.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<G+LHUgZIAtO8putr>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 72.240.125.133
country_id: 6252001
description:
Jan 10 16:15:14 host2 sshd[2919329]: Disconnected from invalid user ubuntu 72.240.125.133 port 36792 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan 10 16:16:05 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<85opWQZIyJ1nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan 10 16:17:48 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<aLJKXwZIzIOygBt7>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.81.23.49
country_id: 2750405
description:
Jan 10 16:19:10 host2 sshd[2922290]: Disconnected from invalid user user1 45.81.23.49 port 60882 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.211.55.20
country_id: 2328926
description:
Jan 10 16:19:46 host2 sshd[2922815]: Disconnected from invalid user deploy 197.211.55.20 port 41888 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan 10 16:20:30 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<NLn1aAZIAIEFhXlo>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.211.55.20
country_id: 2328926
description:
Jan 10 16:21:42 host2 sshd[2924646]: Disconnected from invalid user admin 197.211.55.20 port 34790 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan 10 16:22:52 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<D+hvcQZIWMaOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Jan 10 16:23:07 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<amVacgZIHJmLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan 10 16:22:33 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<OCQwcAZI/OwyBvlc>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 16:23:48 host2 sshd[2926362]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.97.132
country_id: 1269750
description:
2026-01-10 16:23:58 dovecot_login authenticator failed for H=(abts-mum-static-132.97.169.122.airtelbroadband.in) [122.169.97.132]:48929: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 105.174.17.50
country_id: 3351879
description:
Jan 10 16:24:08 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=105.174.17.50, lip=66.85.158.91, session=<e8TxdQZIWoxprhEy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan 10 16:24:15 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@venee.lk>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<+XNgdgZIpqKygBt7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.208.177.56
country_id: 6252001
description:
2026-01-10 16:24:18 dovecot_login authenticator failed for H=([74.208.177.56]) [74.208.177.56]:33856: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan 10 16:25:59 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<LEKHfAZIAJBCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Jan 10 16:26:08 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<Ax4hfQZIvp6nYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan 10 16:27:21 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<U2F/gQZIoqqOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 97.74.84.186
country_id: 1880251
description:
Jan 10 16:27:36 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@mathsmotorcysle.xyz>, method=PLAIN, rip=97.74.84.186, lip=66.85.158.91, session=<WRteggZIRrZhSlS6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.204.63.118
country_id: 2300660
description:
Jan 10 16:29:37 host2 sshd[2931034]: Disconnected from invalid user testftp 41.204.63.118 port 36458 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.204.63.118
country_id: 2300660
description:
Jan 10 16:30:17 host2 sshd[2931760]: Disconnected from invalid user postgres 41.204.63.118 port 34448 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2026-01-10 16:34:26 dovecot_plain authenticator failed for H=(forateddle) [102.53.15.180]:2883: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.184.78
country_id: 6252001
description:
2026-01-10 16:35:04 dovecot_login authenticator failed for H=([74.196.184.78]) [74.196.184.78]:36446: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.237.58.117
country_id: 1269750
description:
Jan 10 16:35:05 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=103.237.58.117, lip=66.85.158.91, TLS, session=<LXIOnAZI69tn7Tp1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.219.98.56
country_id: 798544
description:
Jan 10 16:35:22 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=178.219.98.56, lip=66.85.158.91, TLS, session=<FNREnQZICd+y22I4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.237.173.220
country_id: 6252001
description:
Jan 10 16:35:26 host2 dovecot[1180436]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.237.173.220, lip=66.85.158.92, session=<7lt8ngZI9JMD7a3c>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.227
country_id: 1819730
description:
2026-01-10 16:35:30 dovecot_login authenticator failed for H=227.42.246.220.static.netvigator.com [220.246.42.227]:54105: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.172.76.147
country_id: 6252001
description:
Jan 10 16:37:13 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=54.172.76.147, lip=66.85.158.92, TLS, session=<CHnbpAZI3JA2rEyT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan 10 16:39:00 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<A6shqwZIyJAFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.68.110.207
country_id: 2921044
description:
Jan 10 16:38:13 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@rehanseo.online>, method=PLAIN, rip=138.68.110.207, lip=66.85.158.91, session=<yGlXqAZIVquKRG7P>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2026-01-10 16:40:17 dovecot_plain authenticator failed for H=c-73-13-220-220.hsd1.de.comcast.net (ferifise) [73.13.220.220]:46738: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2026-01-10 16:41:55 dovecot_login authenticator failed for H=([152.52.93.84]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.49
country_id: 290557
description:
Jan 10 16:41:59 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=185.93.89.49, lip=66.85.158.91, session=<B1LTtQZIwpy5XVkx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.68.110.207
country_id: 2921044
description:
Jan 10 16:41:16 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=138.68.110.207, lip=66.85.158.91, session=<NlJBswZItLCKRG7P>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.126
country_id: 1269750
description:
2026-01-10 16:41:40 dovecot_login authenticator failed for H=([27.123.114.126]) [27.123.114.126]:48004: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.44.220.67
country_id: 3469034
description:
Jan 10 16:42:25 host2 sshd[2941591]: Disconnected from invalid user server 177.44.220.67 port 37550 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.48
country_id: 290557
description:
Jan 10 16:42:50 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=185.93.89.48, lip=66.85.158.91, session=</m7QuAZImrm5XVkw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.47
country_id: 290557
description:
Jan 10 16:42:59 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=185.93.89.47, lip=66.85.158.91, session=<snhluQZIoLK5XVkv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.49
country_id: 290557
description:
Jan 10 16:43:18 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=185.93.89.49, lip=66.85.158.91, session=<xP99ugZIrpi5XVkx>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.44.220.67
country_id: 3469034
description:
Jan 10 16:43:35 host2 sshd[2942443]: Disconnected from invalid user ftpuser 177.44.220.67 port 55678 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.47
country_id: 290557
description:
Jan 10 16:44:19 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=185.93.89.47, lip=66.85.158.91, session=<ZgEqvgZIQpG5XVkv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan 10 16:44:22 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@essenceceylontea.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<YiJbvgZI+rmygBt7>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.44.220.67
country_id: 3469034
description:
Jan 10 16:45:04 host2 sshd[2943746]: Disconnected from invalid user testuser 177.44.220.67 port 53680 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.48
country_id: 290557
description:
Jan 10 16:44:09 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=185.93.89.48, lip=66.85.158.91, session=<zHuVvQZIhre5XVkw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.45
country_id: 290557
description:
Jan 10 16:46:03 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=185.93.89.45, lip=66.85.158.91, session=<jw5gxAZIYK+5XVkt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan 10 16:45:15 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<tKWhwQZIEJADgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.46
country_id: 290557
description:
Jan 10 16:45:21 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=185.93.89.46, lip=66.85.158.91, session=<OW7YwQZIYIS5XVku>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.44.220.67
country_id: 3469034
description:
Jan 10 16:45:46 host2 sshd[2944637]: Disconnected from invalid user claude 177.44.220.67 port 38570 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan 10 16:46:12 host2 dovecot[1180436]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<ABIGxQZI4sIDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.44.220.67
country_id: 3469034
description:
Jan 10 16:46:28 host2 sshd[2945337]: Disconnected from invalid user test1 177.44.220.67 port 51684 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.46
country_id: 290557
description:
Jan 10 16:46:39 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=185.93.89.46, lip=66.85.158.91, session=<oMyGxgZIauy5XVku>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.6.202.106
country_id: 6252001
description:
Jan 10 16:46:53 host2 sshd[2945584]: Disconnected from invalid user server 50.6.202.106 port 46792 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.45
country_id: 290557
description:
Jan 10 16:47:24 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@bostonlanka.com>, method=PLAIN, rip=185.93.89.45, lip=66.85.158.91, session=<I9ovyQZIkLu5XVkt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.30
country_id: 290557
description:
Jan 10 16:47:41 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=185.93.89.30, lip=66.85.158.91, session=<Rsg2ygZI8uq5XVke>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan 10 16:47:54 host2 dovecot[1180436]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<FmcaywZIltoDgmBb>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 72.79.42.117
country_id: 6252001
description:
Jan 10 16:48:04 host2 sshd[2946504]: Disconnected from invalid user user2 72.79.42.117 port 44052 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.29
country_id: 290557
description:
Jan 10 16:48:33 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=185.93.89.29, lip=66.85.158.91, session=<CZNFzQZIiLS5XVkd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan 10 16:48:46 host2 dovecot[1180436]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=</1gszgZI4tgDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan 10 16:48:56 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@rehanseo.online>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<eryszgZIiqQvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.30
country_id: 290557
description:
Jan 10 16:49:01 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=185.93.89.30, lip=66.85.158.91, session=<3y/5zgZIZtC5XVke>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 50.6.202.106
country_id: 6252001
description:
Jan 10 16:49:27 host2 sshd[2947369]: Disconnected from invalid user testuser 50.6.202.106 port 47262 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan 10 16:49:30 host2 dovecot[1180436]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<cqXP0AZIvL4DgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.29
country_id: 290557
description:
Jan 10 16:49:53 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=185.93.89.29, lip=66.85.158.91, session=<CUER0gZIAJO5XVkd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.83.181.181
country_id: 6252001
description:
2026-01-10 16:50:38 dovecot_plain authenticator failed for H=c-68-83-181-181.hsd1.pa.comcast.net (derpors) [68.83.181.181]:51732: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.27
country_id: 290557
description:
Jan 10 16:51:03 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=185.93.89.27, lip=66.85.158.91, session=<nTpB1gZIvOu5XVkb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan 10 16:50:21 host2 dovecot[1180436]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<QlnU0wZIYtMDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.62.239.4
country_id: 732800
description:
2026-01-10 16:50:23 dovecot_plain authenticator failed for H=(menes) [149.62.239.4]:40750: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan 10 16:50:33 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@lankaherbalsolutions.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=</mFv1AZIjIYUOAHJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan 10 16:51:22 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<5sV11wZIrqADgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2026-01-10 16:51:30 dovecot_plain authenticator failed for H=217-215-74-195-no2620.tbcn.telia.com (ovenoning) [217.215.74.195]:50686: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.130.96.91
country_id: 6252001
description:
Jan 10 16:51:42 host2 dovecot[1180436]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<XY+t2AZIkKMDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.28
country_id: 290557
description:
Jan 10 16:51:10 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=185.93.89.28, lip=66.85.158.91, session=<Eeet1gZIhry5XVkc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan 10 16:52:18 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<uonQ2gZIoIkDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.27
country_id: 290557
description:
Jan 10 16:52:24 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=185.93.89.27, lip=66.85.158.91, session=<3W4H2wZIhpy5XVkb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.28
country_id: 290557
description:
Jan 10 16:52:31 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=185.93.89.28, lip=66.85.158.91, session=<Ytx+2wZIoJ+5XVkc>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.130.96.91
country_id: 6252001
description:
Jan 10 16:52:36 host2 dovecot[1180436]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<UiXp2wZIEpwDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.215.95.14
country_id: 6252001
description:
2026-01-10 16:53:19 dovecot_plain authenticator failed for H=(ancove) [50.215.95.14]:54696: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan 10 16:53:52 host2 pure-ftpd[2950724]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan 10 16:53:59 host2 dovecot[1180436]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<kTDe4AZIkKUDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.27.203.227
country_id: 3439705
description:
Jan 10 16:54:33 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=179.27.203.227, lip=66.85.158.91, session=<y6C44gZIYoGzG8vj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Jan 10 16:54:48 host2 dovecot[1180436]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<TpjC4wZIloYDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.27.203.227
country_id: 3439705
description:
Jan 10 16:56:02 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=179.27.203.227, lip=66.85.158.91, session=<XfcO6AZIoL2zG8vj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan 10 16:55:37 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<v5GK5gZIbo8FhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.57.236.167
country_id: 1819730
description:
Jan 10 16:57:04 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=47.57.236.167, lip=66.85.158.91, session=<Q4G86wZIescvOeyn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan 10 16:57:16 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<D0Bw7AZIOrJnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Jan 10 16:58:44 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@nsteeleng.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<Qoe28QZIKpePbtX3>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 158.174.210.161
country_id: 2661886
description:
Jan 10 17:00:04 host2 sshd[2956295]: Disconnected from invalid user user 158.174.210.161 port 2979 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan 10 17:02:06 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@kiriaswanu.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<25G9/QZIaLGi8KbF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.174.210.161
country_id: 2661886
description:
Jan 10 17:01:18 host2 sshd[2957305]: Disconnected from invalid user frappe 158.174.210.161 port 6289 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2026-01-10 17:01:26 dovecot_login authenticator failed for H=([27.123.119.235]) [122.185.176.126]:41950: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.23.140
country_id: 3144096
description:
2026-01-10 17:01:38 dovecot_login authenticator failed for H=([178.232.23.140]) [178.232.23.140]:42914: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan 10 17:01:40 host2 pure-ftpd[2957586]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.93.89.49
country_id: 290557
description:
Jan 10 17:02:27 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=185.93.89.49, lip=66.85.158.91, session=<Drn3/gZIWp25XVkx>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 4.211.84.189
country_id: 3017382
description:
Jan 10 17:02:45 host2 sshd[2958481]: Disconnected from invalid user testuser 4.211.84.189 port 44574 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.211.84.189
country_id: 3017382
description:
Jan 10 17:03:21 host2 sshd[2959013]: Disconnected from invalid user user2 4.211.84.189 port 49970 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.93.89.48
country_id: 290557
description:
Jan 10 17:03:36 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=185.93.89.48, lip=66.85.158.91, session=<2zgWAwdIOt+5XVkw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.47
country_id: 290557
description:
Jan 10 17:03:49 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=185.93.89.47, lip=66.85.158.91, session=<eOHhAwdIlIC5XVkv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan 10 17:05:26 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<zXCpCQdIRoZnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.46
country_id: 290557
description:
Jan 10 17:05:49 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=185.93.89.46, lip=66.85.158.91, session=<ocoOCwdIdoW5XVku>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.45
country_id: 290557
description:
Jan 10 17:06:57 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=185.93.89.45, lip=66.85.158.91, session=<KjgWDwdIjri5XVkt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.93.89.30
country_id: 290557
description:
Jan 10 17:08:26 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=185.93.89.30, lip=66.85.158.91, session=<MJZfFAdIUty5XVke>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan 10 17:09:01 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<wPd6FgdImr8vWfaQ>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.212
country_id: 2635167
description:
Jan 10 17:09:28 host2 dovecot[1180436]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.212, lip=66.85.158.91, TLS, session=<Tso5GAdI3+hX7LDU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Jan 10 17:09:22 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@venee.lk>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<QAC7FwdIluSLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.29
country_id: 290557
description:
Jan 10 17:09:25 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=185.93.89.29, lip=66.85.158.91, session=<8nTtFwdIWtW5XVkd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.28
country_id: 290557
description:
Jan 10 17:12:07 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=185.93.89.28, lip=66.85.158.91, session=<rMeZIQdI0MC5XVkc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Jan 10 17:11:41 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<R00GIAdIbuqPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.27
country_id: 290557
description:
Jan 10 17:11:40 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=185.93.89.27, lip=66.85.158.91, session=<QFHwHwdInNu5XVkb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.68.110.207
country_id: 2921044
description:
Jan 10 17:11:51 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=138.68.110.207, lip=66.85.158.91, session=<ihyXIAdIuNyKRG7P>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.191.124.201
country_id: 1269750
description:
2026-01-10 17:13:20 dovecot_login authenticator failed for H=([160.191.124.201]) [160.191.124.201]:59054: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.173
country_id: 1733045
description:
2026-01-10 17:13:45 dovecot_login authenticator failed for H=([49.124.154.173]) [49.124.154.173]:59406: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.222
country_id: 3996063
description:
2026-01-10 17:15:51 dovecot_login authenticator failed for H=([177.236.146.222]) [177.236.146.222]:47748: 535 Incorrect authentication data (set_id=reception@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.144
country_id: 3017382
description:
Jan 10 17:15:50 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.196.152.144, lip=66.85.158.92, session=<4Pf5LgdIP7JbxJiQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.146
country_id: 3017382
description:
Jan 10 17:16:00 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.196.152.146, lip=66.85.158.92, session=<mNeXLwdIPctbxJiS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.162
country_id: 1269750
description:
2026-01-10 17:16:18 dovecot_login authenticator failed for H=([125.19.171.114]) [152.52.192.162]:47526: 535 Incorrect authentication data (set_id=reception)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.160
country_id: 3017382
description:
Jan 10 17:16:22 host2 dovecot[1180436]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=91.196.152.160, lip=66.85.158.92, session=<cHbdMAdIz9FbxJig>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.149
country_id: 3017382
description:
Jan 10 17:16:25 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.149, lip=66.85.158.92, session=<zQYQMQdI0cBbxJiV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan 10 17:17:18 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<zPkdNAdIEuEvWfaQ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.57.216.142
country_id: 1168579
description:
Jan 10 17:18:08 host2 sshd[2971497]: Disconnected from invalid user postgres 154.57.216.142 port 11524 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.55.71
country_id: 6252001
description:
Jan 10 17:19:05 host2 sshd[2972140]: Disconnected from invalid user erpnext 198.98.55.71 port 60132 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.57.216.142
country_id: 1168579
description:
Jan 10 17:20:49 host2 sshd[2973740]: Disconnected from invalid user frappe 154.57.216.142 port 57746 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan 10 17:21:35 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@rehanseo.online>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<xZ1qQwdIxMNnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.254
country_id: 6252001
description:
2026-01-10 17:21:51 dovecot_login authenticator failed for H=([209.23.72.254]) [209.23.72.254]:36588: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.231.114
country_id: 1269750
description:
2026-01-10 17:22:05 dovecot_login authenticator failed for H=([182.95.20.113]) [128.185.231.114]:59350: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Jan 10 17:21:09 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<EJ7YQQdIkoC8putr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.57.216.142
country_id: 1168579
description:
Jan 10 17:21:28 host2 sshd[2974330]: Disconnected from invalid user user2 154.57.216.142 port 2716 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2026-01-10 17:22:12 dovecot_plain authenticator failed for H=(mible) [91.73.188.251]:44979: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2026-01-10 17:22:14 dovecot_plain authenticator failed for H=c-98-227-25-115.hsd1.il.comcast.net (stiong) [98.227.25.115]:48492: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.55.71
country_id: 6252001
description:
Jan 10 17:23:14 host2 sshd[2975573]: Disconnected from invalid user user2 198.98.55.71 port 48472 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan 10 17:24:05 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<qj9aTAdItqKygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan 10 17:24:18 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<950kTQdIfNGOq2dI>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.98.55.71
country_id: 6252001
description:
Jan 10 17:24:54 host2 sshd[2976612]: Disconnected from invalid user deploy 198.98.55.71 port 44926 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan 10 17:25:47 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<VZprUgdI9s8FhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan 10 17:25:53 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<fVHMUgdI1J4yBvlc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2026-01-10 17:25:10 dovecot_plain authenticator failed for H=c-24-127-53-61.hsd1.mi.comcast.net (cagerriage) [24.127.53.61]:33684: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.117.57.134
country_id: 1643084
description:
Jan 10 17:26:39 host2 sshd[2978144]: Disconnected from invalid user ftpuser 103.117.57.134 port 55990 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.238.191.229
country_id: 6252001
description:
Jan 10 17:27:43 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.238.191.229, lip=66.85.158.91, TLS, session=<pBx0WQdIDo4D7r/l>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.68.107.91
country_id: 1168579
description:
Jan 10 17:27:48 host2 sshd[2979108]: Disconnected from invalid user ubuntu 111.68.107.91 port 48254 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Jan 10 17:28:04 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<5t6dWgdIjo6LO0qU>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.117.57.134
country_id: 1643084
description:
Jan 10 17:29:00 host2 sshd[2979902]: Disconnected from invalid user erpnext 103.117.57.134 port 53810 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan 10 17:28:52 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<n4V3XQdIup6Oq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 105.174.17.50
country_id: 3351879
description:
Jan 10 17:28:55 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=105.174.17.50, lip=66.85.158.91, session=<5TyiXQdIAsxprhEy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.172.76.147
country_id: 6252001
description:
Jan 10 17:29:16 host2 dovecot[1180436]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=54.172.76.147, lip=66.85.158.92, session=<vYYNXwdIIqU2rEyT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan 10 17:30:37 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@venee.lk>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<XM22YwdI3pWygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Jan 10 17:31:07 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<auqDZQdIojunYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan 10 17:32:14 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 9 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<z44YaQdIKqVCdMzo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.127.128
country_id: 3144096
description:
2026-01-10 17:38:03 dovecot_login authenticator failed for H=(cm-46.212.127.128.get.no) [46.212.127.128]:42166: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 97.74.84.186
country_id: 1880251
description:
Jan 10 17:38:25 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=97.74.84.186, lip=66.85.158.91, session=<iQGgfwdIFrJhSlS6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.222.113.194
country_id: 1269750
description:
2026-01-10 17:38:37 dovecot_login authenticator failed for H=(static.ill.117.247.82.240.bsnl.co.in) [117.222.113.194]:33400: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 111.68.107.91
country_id: 1168579
description:
Jan 10 17:40:05 host2 sshd[2988579]: Disconnected from invalid user postgres 111.68.107.91 port 60686 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2026-01-10 17:39:45 dovecot_plain authenticator failed for H=c-73-197-236-163.hsd1.nj.comcast.net (tanalpal) [73.197.236.163]:55342: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.68.110.207
country_id: 2921044
description:
Jan 10 17:39:55 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@rehanseo.online>, method=PLAIN, rip=138.68.110.207, lip=66.85.158.91, session=<BwMAhQdIQKWKRG7P>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 17:40:21 host2 sshd[2988883]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2026-01-10 17:40:16 dovecot_login authenticator failed for H=(138.219.244.10.static.softdados.net) [177.128.209.48]:53354: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.224.62.206
country_id: 2464461
description:
2026-01-10 17:40:34 dovecot_login authenticator failed for H=([41.224.62.206]) [41.224.62.206]:47828: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2026-01-10 17:40:49 dovecot_plain authenticator failed for H=c-98-193-112-85.hsd1.il.comcast.net (cizer) [98.193.112.85]:55902: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.68.110.207
country_id: 2921044
description:
Jan 10 17:43:01 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=138.68.110.207, lip=66.85.158.91, session=<xCMQkAdIcNyKRG7P>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 10 17:42:18 host2 sshd[2990470]: Disconnected from invalid user admin 2.57.121.112 port 56332 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan 10 17:44:29 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@venee.lk>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<049LlQdIdLMFhXlo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.109.38.143
country_id: 6252001
description:
2026-01-10 17:48:53 dovecot_login authenticator failed for H=143.38.109.208.host.secureserver.net [208.109.38.143]:41586: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.60.144.54
country_id: 2510769
description:
2026-01-10 17:49:22 dovecot_login authenticator failed for H=([47.60.144.54]) [47.60.144.54]:58548: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 144.76.56.36
country_id: 2921044
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 144.76.56.36 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan 10 17:50:59 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<9TaPrAdInJeygBt7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.148.174.234
country_id: 2017370
description:
2026-01-10 17:51:44 dovecot_login authenticator failed for H=([31.148.174.234]) [31.148.174.234]:56946: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan 10 17:54:17 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@rehanseo.online>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<g29ZuAdISIovWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan 10 17:55:06 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<7EJEuwdIhr0UOAHJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.27.203.227
country_id: 3439705
description:
Jan 10 18:01:41 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@nsteeleng.com>, method=PLAIN, rip=179.27.203.227, lip=66.85.158.91, session=<J2bO0gdIHMyzG8vj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan 10 18:01:19 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<eiF/0QdI4NIFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.27.203.227
country_id: 3439705
description:
Jan 10 18:03:13 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=179.27.203.227, lip=66.85.158.91, session=<76BN2AdI3sSzG8vj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-10 18:03:15 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (typer) [87.103.126.54]:21207: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan 10 18:03:15 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<tIF12AdITJxnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.131.63
country_id: 99237
description:
2026-01-10 18:04:37 dovecot_login authenticator failed for H=([65.20.131.63]) [65.20.131.63]:44573: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.118
country_id: 1269750
description:
2026-01-10 18:04:49 dovecot_login authenticator failed for H=([182.95.119.118]) [182.95.119.118]:34244: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.57.236.167
country_id: 1819730
description:
Jan 10 18:04:53 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=47.57.236.167, lip=66.85.158.91, session=<TqI03gdIptAvOeyn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Jan 10 18:06:12 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<mXX54gdIIsMvT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan 10 18:06:29 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<pwYI5AdIBJ6i8KbF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.25.232.7
country_id: 953987
description:
Jan 10 18:07:58 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<amila@euroentertainmentlk.com>, method=PLAIN, rip=41.25.232.7, lip=66.85.158.91, session=<KsxQ6QdIgcwpGegH>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 18:11:07 host2 sshd[3019503]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.173.58.47
country_id: 6252001
description:
2026-01-10 18:10:52 dovecot_plain authenticator failed for H=c-67-173-58-47.hsd1.il.comcast.net (suffer) [67.173.58.47]:53146: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 18:12:03 host2 sshd[3020293]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan 10 18:11:30 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<ovHw9QdIqpNnmud6>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 138.68.110.207
country_id: 2921044
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[138.68.110.207] [Remote Port]=[40888] [Authentication Database]=[mail] [Username]=[office@seyawin.com] (10/10 failures) (blocked until [Sun Jan 11 12:43:43 2026 UTC/Sun Jan 11 18:13:43 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Jan 10 18:14:35 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<oSX+AAhIar2LO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.68.110.207
country_id: 2921044
description:
Jan 10 18:13:45 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@seyawin.com>, method=PLAIN, rip=138.68.110.207, lip=66.85.158.91, session=<iOH9/QdIuJ+KRG7P>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan 10 18:14:32 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@seyawin.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<jjPNAAhIvoAvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.49
country_id: 290557
description:
Jan 10 18:16:09 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=185.93.89.49, lip=66.85.158.91, session=<6XyUBghIfIm5XVkx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.48
country_id: 290557
description:
Jan 10 18:17:43 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=185.93.89.48, lip=66.85.158.91, session=<YGMwDAhIdrK5XVkw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Jan 10 18:18:08 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<lyKlDQhIdqSLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.47
country_id: 290557
description:
Jan 10 18:18:39 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=185.93.89.47, lip=66.85.158.91, session=<BoN6DwhINsa5XVkv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.46
country_id: 290557
description:
Jan 10 18:19:48 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=185.93.89.46, lip=66.85.158.91, session=<zoWlEwhIOLi5XVku>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.192.123.12
country_id: 6252001
description:
2026-01-10 18:20:59 dovecot_plain authenticator failed for H=(pares) [199.192.123.12]:35674: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.190.155.43
country_id: 6252001
description:
2026-01-10 18:20:26 dovecot_plain authenticator failed for H=(unetopany) [76.190.155.43]:55162: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.30
country_id: 290557
description:
Jan 10 18:23:06 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=185.93.89.30, lip=66.85.158.91, session=<zTB0HwhILom5XVke>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.45
country_id: 290557
description:
Jan 10 18:22:10 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=185.93.89.45, lip=66.85.158.91, session=<xisPHAhIfJe5XVkt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.72.87.7
country_id: 3469034
description:
2026-01-10 18:22:29 dovecot_login authenticator failed for H=177-72-87-7.static.as262543.net.br [177.72.87.7]:50350: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan 10 18:22:58 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@anandaobauae.org>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<vYz2HghI/oUvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.29
country_id: 290557
description:
Jan 10 18:24:26 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=185.93.89.29, lip=66.85.158.91, session=<X1MtJAhISqW5XVkd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.27
country_id: 290557
description:
Jan 10 18:25:42 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=185.93.89.27, lip=66.85.158.91, session=<0U29KAhInrG5XVkb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.248.7
country_id: 798544
description:
Jan 10 18:26:22 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 13 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=109.125.248.7, lip=66.85.158.91, session=<GmJvKghIW5htffgH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.30.150
country_id: 226074
description:
Jan 10 18:26:39 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=196.0.30.150, lip=66.85.158.91, TLS, session=<FUQcKwhI16nEAB6W>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.217.12.152
country_id: 690791
description:
Jan 10 18:26:39 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=91.217.12.152, lip=66.85.158.91, TLS, session=<9SJEKwhIH8hb2QyY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.249.134
country_id: 3865483
description:
Jan 10 18:27:01 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<hr>, method=PLAIN, rip=179.0.249.134, lip=66.85.158.91, TLS, session=<HhxtLAhIBJ6zAPmG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.28
country_id: 290557
description:
Jan 10 18:27:22 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=185.93.89.28, lip=66.85.158.91, session=<j+amLghIeOq5XVkc>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 54.37.131.169
country_id: 3017382
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 54.37.131.169 - vdeploy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.92.146.210
country_id: 1819730
description:
Jan 10 18:30:53 host2 sshd[3039665]: Disconnected from invalid user hemant 34.92.146.210 port 42906 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.92.146.210
country_id: 1819730
description:
Jan 10 18:32:53 host2 sshd[3041779]: Disconnected from invalid user indira 34.92.146.210 port 48236 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.92.146.210
country_id: 1819730
description:
Jan 10 18:32:12 host2 sshd[3041230]: Disconnected from invalid user sanjib 34.92.146.210 port 34902 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.166
country_id: 1269750
description:
2026-01-10 18:34:20 dovecot_login authenticator failed for H=([182.95.181.166]) [182.95.181.166]:60614: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2026-01-10 18:34:39 dovecot_login authenticator failed for H=42-200-70-134.static.imsbiz.com [42.200.70.134]:55688: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.92.146.210
country_id: 1819730
description:
Jan 10 18:35:31 host2 sshd[3044018]: Disconnected from invalid user ramachandra 34.92.146.210 port 45236 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.114
country_id: 1269750
description:
2026-01-10 18:39:16 dovecot_login authenticator failed for H=(aes-static-065.58.246.61.airtel.in) [182.95.184.114]:57962: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.30.212.99
country_id: 298795
description:
2026-01-10 18:39:36 dovecot_login authenticator failed for H=([176.30.212.99]) [176.30.212.99]:46070: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.74.136.134
country_id: 6252001
description:
2026-01-10 18:43:21 dovecot_plain authenticator failed for H=syn-050-074-136-134.biz.spectrum.com (overesmary) [50.74.136.134]:59540: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan 10 18:43:52 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<contact@seyawin.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<VSiYaQhI5pkUOAHJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan 10 18:45:05 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<qakHbghIxLVm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan 10 18:45:19 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@nsteeleng.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<kTnebghI1K5CdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Jan 10 18:45:59 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<8tg6cQhIIuIv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan 10 18:46:09 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<NarbcQhIfMRIpyJ4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 105.174.17.50
country_id: 3351879
description:
Jan 10 18:46:19 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=105.174.17.50, lip=66.85.158.91, session=<0C5hcghILIBprhEy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan 10 18:46:23 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<BZOmcghIzsQv/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan 10 18:46:29 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<P3kQcwhIaNgvWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Jan 10 18:47:42 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<MuJTdwhITr28putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Jan 10 18:47:51 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<XC7zdwhISu2l0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 141.94.22.51
country_id: 3017382
description:
Jan 10 18:50:04 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<help@essenceceylontea.com>, method=PLAIN, rip=141.94.22.51, lip=66.85.158.91, session=<IxjDfwhIRreNXhYz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan 10 18:49:16 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<postfix@seyawin.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<usrcfAhICLqi8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2026-01-10 18:49:31 dovecot_plain authenticator failed for H=(syctacks) [50.217.40.11]:48726: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2026-01-10 18:49:36 dovecot_plain authenticator failed for H=(conate) [65.20.205.197]:54506: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 105.174.17.50
country_id: 3351879
description:
Jan 10 18:52:16 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@bostonlanka.com>, method=PLAIN, rip=105.174.17.50, lip=66.85.158.91, session=<t1e+hwhIs35prhEy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2026-01-10 18:52:42 dovecot_plain authenticator failed for H=c-73-197-194-98.hsd1.nj.comcast.net (ticies) [73.197.194.98]:54244: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.222.24.142
country_id: 241170
description:
Jan 10 18:52:50 host2 sshd[3061210]: Disconnected from invalid user gulshan 154.222.24.142 port 36022 [preauth]


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 85.217.149.12
country_id: 798549
description:
Jan 10 18:53:42 host2 pure-ftpd[3062163]: (?@85.217.149.12) [INFO] New connection from 85.217.149.12


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-10 18:53:51 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (lantics) [87.103.126.54]:24942: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan 10 18:53:21 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@venee.lk>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<otGNiwhIztkv/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.68.110.207
country_id: 2921044
description:
Jan 10 18:53:22 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=138.68.110.207, lip=66.85.158.91, session=<SpmviwhIkt2KRG7P>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Jan 10 18:53:31 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@essenceceylontea.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<ed8vjAhIuBu2uHYF>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 85.217.149.12
country_id: 798549
description:
Jan 10 18:53:38 host2 pure-ftpd[3062089]: (?@85.217.149.12) [INFO] New connection from 85.217.149.12


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.49
country_id: 290557
description:
Jan 10 18:54:43 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=185.93.89.49, lip=66.85.158.91, session=<AACDkAhI8sK5XVkx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan 10 18:54:39 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<a744kAhIMrdm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan 10 18:55:09 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<lhH1kQhIjMQv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.48
country_id: 290557
description:
Jan 10 18:56:24 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=185.93.89.48, lip=66.85.158.91, session=<y0h4lghIrt65XVkw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 10 18:56:39 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<FY9mlwhIL5R100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Jan 10 18:56:53 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@venee.lk>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<l7FCmAhICqC8putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 135.235.33.79
country_id: 6252001
description:
Jan 10 18:57:28 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@seyawin.com>, method=PLAIN, rip=135.235.33.79, lip=66.85.158.91, session=<VnhUmghI+MeH6yFP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.105.156.165
country_id: 3923057
description:
Jan 10 18:57:57 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@rehanseo.online>, method=PLAIN, rip=200.105.156.165, lip=66.85.158.91, session=<RJETnAhICNTIaZyl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan 10 18:57:58 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<+YAdnAhIbNBnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.47
country_id: 290557
description:
Jan 10 18:58:44 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=185.93.89.47, lip=66.85.158.91, session=<T3rfnghITpC5XVkv>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.222.24.142
country_id: 241170
description:
Jan 10 18:58:21 host2 sshd[3067235]: Disconnected from invalid user rajeev 154.222.24.142 port 59416 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.46
country_id: 290557
description:
Jan 10 18:58:31 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=185.93.89.46, lip=66.85.158.91, session=<UxEPnghIRuO5XVku>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.29.26
country_id: 3144096
description:
2026-01-10 19:00:16 dovecot_login authenticator failed for H=(cm-178.232.29.26.get.no) [178.232.29.26]:36409: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan 10 19:00:28 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@ceylondigest.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<ZaIQpQhImoRCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.30
country_id: 290557
description:
Jan 10 19:02:06 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=185.93.89.30, lip=66.85.158.91, session=<EJrrqghI1oe5XVke>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.185
country_id: 6252001
description:
Jan 10 19:02:44 host2 dovecot[1180436]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=71.6.146.185, lip=66.85.158.91, session=<iVVMrQhI6uZHBpK5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.45
country_id: 290557
description:
Jan 10 19:02:55 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sivagnanamfoundation.com>, method=PLAIN, rip=185.93.89.45, lip=66.85.158.91, session=<2r7UrQhIMqG5XVkt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.54
country_id: 3144096
description:
2026-01-10 19:05:00 dovecot_login authenticator failed for H=(54-170-97-62.cust.smartcall.no) [62.97.170.54]:37980: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.29
country_id: 290557
description:
Jan 10 19:05:05 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=185.93.89.29, lip=66.85.158.91, session=<fLaLtQhI3uO5XVkd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.51
country_id: 3144096
description:
2026-01-10 19:05:12 dovecot_login authenticator failed for H=(51-170-97-62.cust.smartcall.no) [62.97.170.51]:54645: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.161.114.113
country_id: 2017370
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 195.161.114.113 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.28
country_id: 290557
description:
Jan 10 19:06:47 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=185.93.89.28, lip=66.85.158.91, session=<2/iouwhIBs+5XVkc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.233.118.22
country_id: 3469034
description:
Jan 10 19:09:34 host2 sshd[3077994]: Disconnected from invalid user frappe 186.233.118.22 port 34876 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.216.33.31
country_id: 1269750
description:
2026-01-10 19:09:46 dovecot_login authenticator failed for H=([117.216.33.31]) [117.216.33.31]:50966: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.233.235.203
country_id: 2661886
description:
2026-01-10 19:10:02 dovecot_login authenticator failed for H=81-233-235-203-no600.tbcn.telia.com [81.233.235.203]:32820: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-01-10 19:10:20 dovecot_login authenticator failed for H=([24.187.213.29]) [24.187.213.29]:39894: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.186.81.8
country_id: 3469034
description:
2026-01-10 19:10:57 dovecot_login authenticator failed for H=([45.186.81.8]) [45.186.81.8]:47315: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.95.121.178
country_id: 3175395
description:
Jan 10 19:12:57 host2 sshd[3081242]: Disconnected from invalid user user 5.95.121.178 port 54506 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.210.77.100
country_id: 3996063
description:
Jan 10 19:12:27 host2 sshd[3080784]: Disconnected from invalid user user1 187.210.77.100 port 34846 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.184.50.251
country_id: 3686110
description:
Jan 10 19:14:43 host2 sshd[3083257]: Disconnected from invalid user secret 201.184.50.251 port 49352 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.233.118.22
country_id: 3469034
description:
Jan 10 19:15:19 host2 sshd[3084119]: Disconnected from invalid user test1 186.233.118.22 port 58816 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.100.64.148
country_id: 289688
description:
Jan 10 19:15:24 host2 sshd[3084172]: Disconnected from invalid user steam 78.100.64.148 port 13911 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.210.77.100
country_id: 3996063
description:
Jan 10 19:15:40 host2 sshd[3084419]: Disconnected from invalid user vpn 187.210.77.100 port 57530 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.233.118.22
country_id: 3469034
description:
Jan 10 19:16:02 host2 sshd[3084788]: Disconnected from invalid user frappe 186.233.118.22 port 34326 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 78.100.64.148
country_id: 289688
description:
Jan 10 19:16:05 host2 sshd[3084871]: Disconnected from invalid user frappe 78.100.64.148 port 37560 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.233.118.22
country_id: 3469034
description:
Jan 10 19:17:25 host2 sshd[3086263]: Disconnected from invalid user frappe 186.233.118.22 port 44244 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 5.95.121.178
country_id: 3175395
description:
Jan 10 19:17:34 host2 sshd[3086419]: Disconnected from invalid user frappe 5.95.121.178 port 41208 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.125.175.117
country_id: 1643084
description:
2026-01-10 19:18:31 dovecot_plain authenticator failed for H=(P756S1ACH72QLPV) [103.125.175.117]:64607: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.142
country_id: 1269750
description:
2026-01-10 19:18:48 dovecot_login authenticator failed for H=([182.79.202.89]) [182.95.230.142]:44136: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 103.125.175.117
country_id: 1643084
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Remote IP Address]=[103.125.175.117] [Authentication Database]=[mail] (5/5 failures) (blocked until [Sat Jan 10 14:03:46 2026 UTC/Sat Jan 10 19:33:46 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.49
country_id: 290557
description:
Jan 10 19:18:50 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=185.93.89.49, lip=66.85.158.91, session=<5P/C5ghIrs65XVkx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.168
country_id: 2186224
description:
2026-01-10 19:18:22 dovecot_login authenticator failed for H=([121.73.163.168]) [121.73.163.168]:48288: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.210.77.100
country_id: 3996063
description:
Jan 10 19:18:26 host2 sshd[3087383]: Disconnected from invalid user user 187.210.77.100 port 36716 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.210.77.100
country_id: 3996063
description:
Jan 10 19:19:44 host2 sshd[3088603]: Disconnected from invalid user deployerer 187.210.77.100 port 50374 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.48
country_id: 290557
description:
Jan 10 19:20:32 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=185.93.89.48, lip=66.85.158.91, session=<oD/O7AhICoW5XVkw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.46
country_id: 290557
description:
Jan 10 19:22:41 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=185.93.89.46, lip=66.85.158.91, session=<2HGK9AhIeOC5XVku>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.47
country_id: 290557
description:
Jan 10 19:22:58 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=185.93.89.47, lip=66.85.158.91, session=<Z6KA9QhI3tK5XVkv>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan 10 19:25:40 host2 pure-ftpd[3095267]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.236.66
country_id: 6252001
description:
2026-01-10 19:26:06 dovecot_plain authenticator failed for H=c-73-213-236-66.hsd1.va.comcast.net (rellary) [73.213.236.66]:57438: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.30
country_id: 290557
description:
Jan 10 19:26:24 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=185.93.89.30, lip=66.85.158.91, session=<HKXNAQlIurC5XVke>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 19:28:06 host2 sshd[3098167]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.45
country_id: 290557
description:
Jan 10 19:27:28 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=185.93.89.45, lip=66.85.158.91, session=<BIuWBQlIyue5XVkt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.188.252.208
country_id: 6252001
description:
2026-01-10 19:28:21 dovecot_plain authenticator failed for H=c-73-188-252-208.hsd1.pa.comcast.net (andaess) [73.188.252.208]:51582: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.29
country_id: 290557
description:
Jan 10 19:29:30 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=185.93.89.29, lip=66.85.158.91, session=<HEXjDAlIRre5XVkd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.28
country_id: 290557
description:
Jan 10 19:31:20 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=185.93.89.28, lip=66.85.158.91, session=<TxdsEwlIgsu5XVkc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 10 19:32:02 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<CJv0FQlIgdd100Db>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan 10 19:33:58 host2 pure-ftpd[3104551]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-01-10 19:36:13 dovecot_plain authenticator failed for H=(flatic) [102.53.15.56]:38885: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.206
country_id: 1269750
description:
2026-01-10 19:38:12 dovecot_login authenticator failed for H=([125.20.154.97]) [182.95.178.206]:44396: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 10 19:39:34 host2 sshd[3110201]: Disconnected from invalid user admin 2.57.121.112 port 48001 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.76
country_id: 2635167
description:
Jan 10 19:41:19 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.76, lip=66.85.158.91, TLS handshaking: Connection closed, session=<K+hMNwlIC7+594lM>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.250
country_id: 2635167
description:
Jan 10 19:40:39 host2 dovecot[1180436]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.250, lip=66.85.158.91, TLS, session=<HdHnNAlIYZxX7LD6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.79
country_id: 2635167
description:
Jan 10 19:40:45 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.79, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<Z0NCNQlIy99X7LBP>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 19:41:28 host2 sshd[3112501]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.92
country_id: 2635167
description:
Jan 10 19:41:53 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.92, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<EnBIOQlIXYBX7LBc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.239.152.5
country_id: 357994
description:
2026-01-10 19:43:06 dovecot_plain authenticator failed for H=(keephio) [41.239.152.5]:36376: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.108
country_id: 2635167
description:
Jan 10 19:42:26 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.108, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<26xDOwlIHb+594ls>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.104
country_id: 2635167
description:
Jan 10 19:42:59 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.104, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<GRI/PQlIA8G594lo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.104
country_id: 2635167
description:
Jan 10 19:43:32 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.104, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<IHk4PwlIr86594lo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.107
country_id: 2635167
description:
Jan 10 19:44:06 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.107, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<7+Q1QQlIkZBX7LBr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2026-01-10 19:44:39 dovecot_login authenticator failed for H=([178.250.191.189]) [178.250.191.189]:36808: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.92
country_id: 2635167
description:
Jan 10 19:44:39 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.92, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<BDsxQwlIe8O594lc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.85
country_id: 2635167
description:
Jan 10 19:45:12 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.85, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<JJgqRQlIdbO594lV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.151.136
country_id: 1819730
description:
2026-01-10 19:44:22 dovecot_login authenticator failed for H=136.151.48.116.static.netvigator.com [116.48.151.136]:56956: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.108
country_id: 2635167
description:
Jan 10 19:45:45 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.108, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<hd4lRwlIxdK594ls>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.177.9.119
country_id: 3865483
description:
2026-01-10 19:48:20 dovecot_login authenticator failed for H=(181-177-9-119.fiberway.com.ar) [181.177.9.119]:60134: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.228.160
country_id: 149590
description:
2026-01-10 19:48:54 dovecot_login authenticator failed for H=([41.59.228.160]) [41.59.228.160]:52470: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.49
country_id: 290557
description:
Jan 10 19:53:00 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=185.93.89.49, lip=66.85.158.91, session=<F0voYAlI2sO5XVkx>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.220.163.89
country_id: 2661886
description:
Jan 10 19:55:04 host2 sshd[3126620]: Disconnecting invalid user admin 62.220.163.89 port 40750: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 62.220.163.89
country_id: 2661886
description:
Jan 10 19:54:48 host2 sshd[3126367]: error: maximum authentication attempts exceeded for root from 62.220.163.89 port 49982 ssh2 [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 62.220.163.89
country_id: 2661886
description:
Jan 10 19:54:48 host2 sshd[3126367]: Disconnecting authenticating user root 62.220.163.89 port 49982: Too many authentication failures [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.48
country_id: 290557
description:
Jan 10 19:54:49 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=185.93.89.48, lip=66.85.158.91, session=<alByZwlIYpi5XVkw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 173.66.67.131
country_id: 6252001
description:
Jan 10 19:56:05 host2 dovecot[1180436]: imap-login: Disconnected: Aborted login by logging out (auth failed, 1 attempts in 3 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=173.66.67.131, lip=66.85.158.91, TLS, session=<11/tawlIbIGtQkOD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.46
country_id: 290557
description:
Jan 10 19:57:05 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=185.93.89.46, lip=66.85.158.91, session=<3PuFbwlIYJq5XVku>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-10 19:57:19 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (mindes) [87.103.126.54]:2061: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.47
country_id: 290557
description:
Jan 10 19:57:21 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=185.93.89.47, lip=66.85.158.91, session=<DnB4cAlIvqy5XVkv>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.249.84.18
country_id: 1733045
description:
Jan 10 20:00:18 host2 sshd[3132287]: Disconnected from invalid user naga 103.249.84.18 port 49074 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.253.226
country_id: 1269750
description:
2026-01-10 20:01:08 dovecot_login authenticator failed for H=(abts-kk-static-226.253.166.122.airtelbroadband.in) [122.166.253.226]:37610: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.201.62
country_id: 1269750
description:
2026-01-10 20:00:49 dovecot_login authenticator failed for H=(nsg-corporate-226.215.186.122.airtel.in) [122.186.201.62]:41620: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 161.97.175.65
country_id: 3017382
description:
[2026-01-10 20:00:52 +0530] info [cpaneld] 161.97.175.65 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.30
country_id: 290557
description:
Jan 10 20:00:56 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=185.93.89.30, lip=66.85.158.91, session=<x/JHfQlIFLq5XVke>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.188.98
country_id: 1269750
description:
2026-01-10 20:00:58 dovecot_login authenticator failed for H=([125.19.165.242]) [125.19.188.98]:41008: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.45
country_id: 290557
description:
Jan 10 20:02:29 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=185.93.89.45, lip=66.85.158.91, session=<UM3cgglI6q+5XVkt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Jan 10 20:03:25 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<8FEuhglIjee2uHYF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.29
country_id: 290557
description:
Jan 10 20:04:30 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=185.93.89.29, lip=66.85.158.91, session=<xyoWiglI7Ku5XVkd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.249.84.18
country_id: 1733045
description:
Jan 10 20:04:41 host2 sshd[3136644]: Disconnected from invalid user rajakumar 103.249.84.18 port 34238 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.174.5.146
country_id: 6252001
description:
Jan 10 20:05:40 host2 sshd[3137735]: Disconnected from invalid user postgres 172.174.5.146 port 35734 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.249.84.18
country_id: 1733045
description:
Jan 10 20:05:26 host2 sshd[3137490]: Disconnected from invalid user mahammad 103.249.84.18 port 46438 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.28
country_id: 290557
description:
Jan 10 20:06:32 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 7 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=185.93.89.28, lip=66.85.158.91, session=<s+gCkQlI1KK5XVkc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 10 20:06:42 host2 sshd[3138825]: Disconnected from invalid user admin 2.57.121.112 port 19784 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.174.5.146
country_id: 6252001
description:
Jan 10 20:07:49 host2 sshd[3140083]: Disconnected from invalid user test1 172.174.5.146 port 54543 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-10 20:08:08 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (tonveringe) [87.103.126.54]:8331: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.249.84.18
country_id: 1733045
description:
Jan 10 20:08:11 host2 sshd[3140484]: Disconnected from invalid user sikandar 103.249.84.18 port 41938 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 10 20:07:26 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<AASUlAlIqph100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.142.197.35
country_id: 6252001
description:
2026-01-10 20:08:38 dovecot_login authenticator failed for H=([166.142.197.35]) [166.142.197.35]:60694: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.40.45.223
country_id: 1861060
description:
2026-01-10 20:08:49 dovecot_login authenticator failed for H=p4095-ipbfpfx02osakakita.osaka.ocn.ne.jp [60.40.45.223]:59285: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.88.186
country_id: 1269750
description:
Jan 10 20:08:21 host2 sshd[3140639]: Disconnected from invalid user testuser 68.183.88.186 port 46302 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.174.5.146
country_id: 6252001
description:
Jan 10 20:08:24 host2 sshd[3140714]: Disconnected from invalid user ubuntu 172.174.5.146 port 61132 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.88.186
country_id: 1269750
description:
Jan 10 20:09:42 host2 sshd[3142037]: Disconnected from invalid user testuser 68.183.88.186 port 40378 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2026-01-10 20:09:59 dovecot_login authenticator failed for H=([65.20.205.197]) [65.20.205.197]:59973: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.206
country_id: 1269750
description:
2026-01-10 20:09:40 dovecot_login authenticator failed for H=([27.123.105.41]) [182.95.52.206]:34698: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.91.50
country_id: 1269750
description:
2026-01-10 20:11:20 dovecot_login authenticator failed for H=(nsg-corporate-50.91.186.122.airtel.in) [122.186.91.50]:55328: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.183.88.186
country_id: 1269750
description:
Jan 10 20:10:22 host2 sshd[3142856]: Disconnected from invalid user sftptest 68.183.88.186 port 51532 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.158
country_id: 1269750
description:
2026-01-10 20:11:38 dovecot_login authenticator failed for H=([182.95.185.158]) [182.95.185.158]:36300: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2026-01-10 20:15:27 dovecot_login authenticator failed for H=([152.52.234.134]) [125.20.245.182]:37098: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.58
country_id: 3996063
description:
2026-01-10 20:15:51 dovecot_login authenticator failed for H=([177.236.146.58]) [177.236.146.58]:45052: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.49
country_id: 290557
description:
Jan 10 20:18:17 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@rehanseo.online>, method=PLAIN, rip=185.93.89.49, lip=66.85.158.91, session=<Sy9RuwlI1pe5XVkx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.121.175.220
country_id: 3579143
description:
2026-01-10 20:20:13 dovecot_login authenticator failed for H=([93.121.175.220]) [93.121.175.220]:41260: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2026-01-10 20:20:30 dovecot_login authenticator failed for H=([152.52.93.84]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.48
country_id: 290557
description:
Jan 10 20:20:35 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=185.93.89.48, lip=66.85.158.91, session=<SJyawwlI/OG5XVkw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.118.49.18
country_id: 1269750
description:
2026-01-10 20:20:41 dovecot_login authenticator failed for H=([45.118.49.18]) [45.118.49.18]:50684: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.46
country_id: 290557
description:
Jan 10 20:22:57 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=185.93.89.46, lip=66.85.158.91, session=<IwfwywlI1tu5XVku>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.166.123
country_id: 1605651
description:
2026-01-10 20:23:04 dovecot_login authenticator failed for H=([106.0.166.123]) [106.0.166.123]:50342: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.47
country_id: 290557
description:
Jan 10 20:23:15 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=185.93.89.47, lip=66.85.158.91, session=<NVwSzQlIjpy5XVkv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.64.126.23
country_id: 3175395
description:
2026-01-10 20:23:49 dovecot_login authenticator failed for H=([151.64.126.23]) [151.64.126.23]:50452: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.30
country_id: 290557
description:
Jan 10 20:26:29 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=185.93.89.30, lip=66.85.158.91, session=<CCC02AlIdqq5XVke>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-01-10 20:27:06 dovecot_login authenticator failed for H=([197.219.228.242]) [197.219.228.242]:44652: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.250.1
country_id: 3469034
description:
2026-01-10 20:27:33 dovecot_login authenticator failed for H=(ticons.static.gvt.net.br) [177.207.250.1]:50155: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-01-10 20:27:32 dovecot_login authenticator failed for H=([103.168.241.32]) [103.168.241.32]:56936: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.91.135.181
country_id: 6252001
description:
2026-01-10 20:27:59 dovecot_login authenticator failed for H=([70.91.135.181]) [70.91.135.181]:53286: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.159.105.2
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 50.159.105.2 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.107.70
country_id: 3469034
description:
2026-01-10 20:29:03 dovecot_login authenticator failed for H=(72-107-226-38.edgetelecom.com.br) [38.226.107.70]:51010: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.45
country_id: 290557
description:
Jan 10 20:28:35 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@rehanseo.online>, method=PLAIN, rip=185.93.89.45, lip=66.85.158.91, session=<boYt4AlIFN+5XVkt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2026-01-10 20:29:13 dovecot_login authenticator failed for H=([38.226.118.9]) [38.226.118.0]:38300: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.29
country_id: 290557
description:
Jan 10 20:30:30 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=185.93.89.29, lip=66.85.158.91, session=<COIQ5wlIgtu5XVkd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.4
country_id: 99237
description:
2026-01-10 20:30:43 dovecot_plain authenticator failed for H=(nobbently) [65.20.133.4]:33042: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.101.146
country_id: 1269750
description:
2026-01-10 20:32:51 dovecot_login authenticator failed for H=(aes-static-217.70.22.125.airtel.in) [27.123.101.146]:33046: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2026-01-10 20:32:30 dovecot_login authenticator failed for H=h-155-4-31-215.a2204.priv.bahnhof.se [155.4.31.215]:50992: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.28
country_id: 290557
description:
Jan 10 20:32:35 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@rehanseo.online>, method=PLAIN, rip=185.93.89.28, lip=66.85.158.91, session=<Gwt37glITru5XVkc>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 20:40:00 host2 sshd[3174138]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 10 20:42:42 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<00ysEgpIosF100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.200.10
country_id: 1269750
description:
2026-01-10 20:44:34 dovecot_login authenticator failed for H=([125.19.175.85]) [122.186.200.10]:32886: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.118.34.108
country_id: 1269750
description:
Jan 10 20:44:15 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 25 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=45.118.34.108, lip=66.85.158.91, TLS, session=<3YHVFgpIT9EtdiJs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.18
country_id: 1269750
description:
2026-01-10 20:44:17 dovecot_login authenticator failed for H=([182.95.58.18]) [182.95.58.18]:41838: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.207.35.136
country_id: 6290252
description:
Jan 10 20:44:31 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 15 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=109.207.35.136, lip=66.85.158.91, TLS, session=<MKljGApI/s5tzyOI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.152.52.203
country_id: 6252001
description:
Jan 10 20:50:24 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=104.152.52.203, lip=66.85.158.91, TLS: Connection closed, session=<BYxSLgpIbZVomDTL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 10 20:51:12 host2 sshd[3186053]: Disconnected from invalid user admin 2.57.121.112 port 21498 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.239.152.5
country_id: 357994
description:
2026-01-10 20:55:05 dovecot_plain authenticator failed for H=(releverym) [41.239.152.5]:34614: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 223.197.248.209
country_id: 1819730
description:
Jan 10 20:58:00 host2 sshd[3193513]: Disconnected from invalid user server 223.197.248.209 port 57664 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.175.206.22
country_id: 1643084
description:
Jan 10 21:00:49 host2 sshd[3196455]: Disconnected from invalid user test 103.175.206.22 port 38558 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 223.197.248.209
country_id: 1819730
description:
Jan 10 21:00:51 host2 sshd[3196543]: Disconnected from invalid user claude 223.197.248.209 port 49405 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.130.176.136
country_id: 6252001
description:
2026-01-10 21:00:55 dovecot_login authenticator failed for H=mobile-166-130-176-136.mycingular.net [166.130.176.136]:54763: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 223.197.248.209
country_id: 1819730
description:
Jan 10 21:00:11 host2 sshd[3195680]: Disconnected from invalid user deployerer 223.197.248.209 port 43649 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.104
country_id: 1880251
description:
Jan 10 21:00:13 host2 sshd[3195737]: Disconnected from invalid user frappe 45.78.230.104 port 60328 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.101.36.159
country_id: 2963597
description:
2026-01-10 21:00:38 dovecot_login authenticator failed for H=(089-101-036159.customer.vmie.ie) [89.101.36.159]:40676: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.25.232.7
country_id: 953987
description:
Jan 10 21:01:41 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<amila@euroentertainmentlk.com>, method=PLAIN, rip=41.25.232.7, lip=66.85.158.91, session=<uUeQVgpIQ8YpGegH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.145.143.163
country_id: 1269750
description:
Jan 10 21:01:12 host2 sshd[3196901]: Disconnected from invalid user ubuntu 203.145.143.163 port 60700 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 203.145.143.163
country_id: 1269750
description:
Jan 10 21:02:34 host2 sshd[3198072]: Disconnected from invalid user ftpuser 203.145.143.163 port 55202 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.175.206.22
country_id: 1643084
description:
Jan 10 21:02:42 host2 sshd[3198149]: Disconnected from invalid user user1 103.175.206.22 port 42136 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.145.143.163
country_id: 1269750
description:
Jan 10 21:03:14 host2 sshd[3198727]: Disconnected from invalid user user1 203.145.143.163 port 38340 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.126.84.154
country_id: 1694008
description:
Jan 10 21:03:58 host2 sshd[3199350]: Disconnected from invalid user appuser 45.126.84.154 port 48396 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.104
country_id: 1880251
description:
Jan 10 21:04:06 host2 sshd[3199497]: Disconnected from invalid user steam 45.78.230.104 port 55184 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.46
country_id: 6252001
description:
Jan 10 21:04:37 host2 pure-ftpd[3200094]: (?@147.185.132.46) [INFO] New connection from 147.185.132.46


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.17.124.159
country_id: 690791
description:
Jan 10 21:04:46 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@jrdc.lk>, method=PLAIN, rip=185.17.124.159, lip=66.85.158.91, TLS, session=<Qjx+YApIc6K5EXyf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.196.143.250
country_id: 3469034
description:
Jan 10 21:04:46 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@jrdc.lk>, method=PLAIN, rip=200.196.143.250, lip=66.85.158.91, TLS, session=<aV+GYApIpevIxI/6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.58.115.135
country_id: 1269750
description:
Jan 10 21:05:05 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=103.58.115.135, lip=66.85.158.91, TLS, session=<7DuiYQpIZaRnOnOH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.130.170.24
country_id: 3469034
description:
Jan 10 21:05:07 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=177.130.170.24, lip=66.85.158.91, TLS, session=<C03XYQpINOGxgqoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 197.234.206.11
country_id: 953987
description:
Jan 10 21:05:08 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=197.234.206.11, lip=66.85.158.91, TLS, session=<vGjdYQpIgtnF6s4L>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.131.243
country_id: 690791
description:
Jan 10 21:04:42 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@jrdc.lk>, method=PLAIN, rip=37.221.131.243, lip=66.85.158.91, TLS, session=<NCt6YApIop8l3YPz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 111.223.2.42
country_id: 1269750
description:
Jan 10 21:04:47 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@jrdc.lk>, method=PLAIN, rip=111.223.2.42, lip=66.85.158.91, TLS, session=<ayWLYApIOLhv3wIq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.30.83.58
country_id: 1269750
description:
Jan 10 21:04:57 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 29 secs): user=<info@jrdc.lk>, method=PLAIN, rip=103.30.83.58, lip=66.85.158.91, TLS, session=<qvKjYApIv9hnHlM6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.249.64
country_id: 3865483
description:
Jan 10 21:05:10 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=179.0.249.64, lip=66.85.158.91, TLS, session=<nrjvYQpI+8OzAPlA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.11.206
country_id: 690791
description:
Jan 10 21:05:16 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=176.103.11.206, lip=66.85.158.91, TLS, session=<wdp2YgpI+KiwZwvO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.49
country_id: 290557
description:
Jan 10 21:05:19 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=185.93.89.49, lip=66.85.158.91, session=<eqCEYwpI0oK5XVkx>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.126.84.154
country_id: 1694008
description:
Jan 10 21:05:37 host2 sshd[3201170]: Disconnected from invalid user frappe 45.126.84.154 port 37858 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 152.32.133.174
country_id: 1819730
description:
Jan 10 21:06:36 host2 pure-ftpd[3202504]: (?@152.32.133.174) [INFO] New connection from 152.32.133.174


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.45.37
country_id: 1227603
description:
Jan 10 21:07:03 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: read(size=509) failed: Connection reset by peer (no auth attempts in 4 secs): user=<>, rip=175.157.45.37, lip=66.85.158.91, TLS handshaking: read(size=509) failed: Connection reset by peer, session=<TFrnaQpIYlOvnS0l>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2026-01-10 21:07:21 dovecot_plain authenticator failed for H=c-68-40-189-43.hsd1.mi.comcast.net (antion) [68.40.189.43]:54046: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.104
country_id: 1880251
description:
Jan 10 21:08:27 host2 sshd[3204276]: Disconnected from invalid user test 45.78.230.104 port 40848 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.48
country_id: 290557
description:
Jan 10 21:08:36 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=185.93.89.48, lip=66.85.158.91, session=<FvVHbwpI7MC5XVkw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2026-01-10 21:09:53 dovecot_login authenticator failed for H=(187-51-252-236.customer.tdatabrasil.net.br) [186.201.54.90]:54815: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 21:10:31 host2 sshd[3206617]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.231.6
country_id: 1269750
description:
2026-01-10 21:10:22 dovecot_login authenticator failed for H=([125.20.231.225]) [128.185.231.6]:47460: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.46
country_id: 290557
description:
Jan 10 21:11:01 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=185.93.89.46, lip=66.85.158.91, session=<vWfudwpIArC5XVku>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.230.104
country_id: 1880251
description:
Jan 10 21:11:34 host2 sshd[3207662]: Disconnected from invalid user deploy 45.78.230.104 port 35824 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.47
country_id: 290557
description:
Jan 10 21:11:24 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=185.93.89.47, lip=66.85.158.91, session=<oOlMeQpI8Ni5XVkv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.96.62.29
country_id: 1269750
description:
2026-01-10 21:13:24 dovecot_login authenticator failed for H=([59.96.62.29]) [59.96.62.29]:40196: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.93
country_id: 99237
description:
2026-01-10 21:13:54 dovecot_login authenticator failed for H=([65.20.250.93]) [65.20.250.93]:40491: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-10 21:14:10 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (logric) [87.103.126.54]:43096: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.30
country_id: 290557
description:
Jan 10 21:14:14 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=185.93.89.30, lip=66.85.158.91, session=<s0Z5gwpImrS5XVke>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 185.93.89.30
country_id: 290557
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[185.93.89.30] [Remote Port]=[46234] [Authentication Database]=[mail] [Username]=[info@lankaherbalsolutions.com] (10/10 failures) (blocked until [Sun Jan 11 15:44:12 2026 UTC/Sun Jan 11 21:14:12 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.45
country_id: 290557
description:
Jan 10 21:17:21 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=185.93.89.45, lip=66.85.158.91, session=<CNKcjgpICpO5XVkt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 10 21:18:37 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<xEcOkwpIPpd100Db>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 185.93.89.29
country_id: 290557
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[185.93.89.29] [Remote Port]=[49720] [Authentication Database]=[mail] [Username]=[admin@lankaherbalsolutions.com] (10/10 failures) (blocked until [Sun Jan 11 15:49:17 2026 UTC/Sun Jan 11 21:19:17 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.29
country_id: 290557
description:
Jan 10 21:19:19 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=185.93.89.29, lip=66.85.158.91, session=<2/CklQpIOMK5XVkd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.61.10.176
country_id: 3865483
description:
Jan 10 21:20:32 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=179.61.10.176, lip=66.85.158.91, TLS, session=<Mt36mApIHJqzPQqw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.118.34.222
country_id: 1269750
description:
Jan 10 21:20:53 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=45.118.34.222, lip=66.85.158.91, TLS, session=<bmFBmgpI2totdiLe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.68.226.171
country_id: 3017382
description:
2026-01-10 21:20:55 dovecot_login authenticator failed for H=vps-b674cd8d.vps.ovh.net [51.68.226.171]:42834: 535 Incorrect authentication data (set_id=postmaster@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.74.122
country_id: 1149361
description:
2026-01-10 21:21:16 dovecot_login authenticator failed for H=([180.94.74.122]) [180.94.74.122]:45751: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.28
country_id: 290557
description:
Jan 10 21:21:34 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=185.93.89.28, lip=66.85.158.91, session=<gTuwnQpIroq5XVkc>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 185.93.89.28
country_id: 290557
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[185.93.89.28] [Remote Port]=[35502] [Authentication Database]=[mail] [Username]=[hr@lankaherbalsolutions.com] (10/10 failures) (blocked until [Sun Jan 11 15:51:32 2026 UTC/Sun Jan 11 21:21:32 2026 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.86.102
country_id: 1269750
description:
2026-01-10 21:41:27 dovecot_login authenticator failed for H=([182.79.86.102]) [182.79.86.102]:36030: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.182
country_id: 1733045
description:
2026-01-10 21:42:05 dovecot_login authenticator failed for H=([49.124.155.182]) [49.124.155.182]:55022: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.106
country_id: 1269750
description:
2026-01-10 21:42:26 dovecot_login authenticator failed for H=([182.95.20.55]) [182.95.228.106]:59982: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2026-01-10 21:49:52 dovecot_plain authenticator failed for H=c-174-169-224-27.hsd1.vt.comcast.net (hemanate) [174.169.224.27]:47738: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.236.66
country_id: 6252001
description:
2026-01-10 21:52:57 dovecot_plain authenticator failed for H=c-73-213-236-66.hsd1.va.comcast.net (dinabled) [73.213.236.66]:33290: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.23.189.160
country_id: 6252001
description:
Jan 10 21:53:34 host2 sshd[3252223]: Disconnected from invalid user secret 64.23.189.160 port 47600 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 10 21:53:45 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<lAzGEAtIuoB100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.248
country_id: 2186224
description:
2026-01-10 21:54:28 dovecot_login authenticator failed for H=([121.73.162.248]) [121.73.162.248]:36898: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.73.194.22
country_id: 6252001
description:
[2026-01-10 21:54:30 +0530] info [cpaneld] 173.73.194.22 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 151.199.253.116
country_id: 6252001
description:
[2026-01-10 21:54:34 +0530] info [cpaneld] 151.199.253.116 - tradeceyloncom "GET /login/?login_only=1&user=tradeceyloncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyloncom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.84.211.186
country_id: 6252001
description:
[2026-01-10 21:54:44 +0530] info [cpaneld] 72.84.211.186 - tradece "GET /login/?login_only=1&user=tradece&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.113.223.143
country_id: 6252001
description:
[2026-01-10 21:54:48 +0530] info [cpaneld] 207.113.223.143 - trad "GET /login/?login_only=1&user=trad&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trad (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.43.97.155
country_id: 6252001
description:
[2026-01-10 21:54:42 +0530] info [cpaneld] 73.43.97.155 - tradecey "GET /login/?login_only=1&user=tradecey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradecey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.14.175.184
country_id: 6252001
description:
[2026-01-10 21:54:46 +0530] info [cpaneld] 69.14.175.184 - tradec "GET /login/?login_only=1&user=tradec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.14.97.56
country_id: 6252001
description:
[2026-01-10 21:54:28 +0530] info [cpaneld] 73.14.97.56 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.19.64.204
country_id: 6252001
description:
[2026-01-10 21:54:37 +0530] info [cpaneld] 98.19.64.204 - tradeceylo "GET /login/?login_only=1&user=tradeceylo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceylo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.16.7
country_id: 6252001
description:
[2026-01-10 21:54:51 +0530] info [cpaneld] 172.56.16.7 - tr "GET /login/?login_only=1&user=tr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.67.197.128
country_id: 6252001
description:
[2026-01-10 21:54:49 +0530] info [cpaneld] 173.67.197.128 - tra "GET /login/?login_only=1&user=tra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tra (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.215.203
country_id: 1819730
description:
Jan 10 21:55:04 host2 sshd[3253929]: Disconnected from invalid user teamspeak 152.32.215.203 port 58866 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.213.35.157
country_id: 6252001
description:
[2026-01-10 21:54:33 +0530] info [whostmgrd] 72.213.35.157 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.96.222.201
country_id: 6252001
description:
[2026-01-10 21:54:31 +0530] info [cpaneld] 99.96.222.201 - tradeceylon "GET /login/?login_only=1&user=tradeceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.79.64.28
country_id: 6252001
description:
[2026-01-10 21:54:40 +0530] info [cpaneld] 72.79.64.28 - tradeceyl "GET /login/?login_only=1&user=tradeceyl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.100.246.10
country_id: 6252001
description:
[2026-01-10 21:54:47 +0530] info [cpaneld] 73.100.246.10 - trade "GET /login/?login_only=1&user=trade&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trade (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.12.135
country_id: 2077456
description:
2026-01-10 21:55:15 dovecot_login authenticator failed for H=([101.168.12.135]) [101.168.12.135]:58892: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.169.44.220
country_id: 732800
description:
Jan 10 21:56:23 host2 sshd[3255688]: Disconnected from invalid user user2 213.169.44.220 port 40730 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.251.179.129
country_id: 1522867
description:
2026-01-10 21:56:29 dovecot_login authenticator failed for H=([5.251.179.129]) [5.251.179.129]:47789: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.36.82
country_id: 1210997
description:
2026-01-10 21:57:48 dovecot_login authenticator failed for H=([49.0.36.82]) [49.0.36.82]:36408: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 21:58:23 host2 sshd[3257887]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.0.88
country_id: 3144096
description:
2026-01-10 21:58:44 dovecot_login authenticator failed for H=(cm-78.156.0.88.get.no) [78.156.0.88]:47027: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.23.189.160
country_id: 6252001
description:
Jan 10 21:59:04 host2 sshd[3258862]: Disconnected from invalid user admin 64.23.189.160 port 58276 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2026-01-10 21:58:19 dovecot_login authenticator failed for H=(1522312565.colombiatel.co) [152.231.25.64]:45491: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.215.203
country_id: 1819730
description:
Jan 10 22:00:32 host2 sshd[3260329]: Disconnected from invalid user report 152.32.215.203 port 38118 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 98.220.49.70
country_id: 6252001
description:
Jan 10 22:03:07 host2 dovecot[3239883]: imap-login: Disconnected: Aborted login by logging out (auth failed, 1 attempts in 3 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=98.220.49.70, lip=66.85.158.91, TLS, session=<Ez86MgtIhMhi3DFG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 10 22:02:18 host2 sshd[3262266]: Disconnected from invalid user admin 2.57.121.112 port 14175 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan 10 22:02:27 host2 pure-ftpd[3262434]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 22:06:10 host2 sshd[3268448]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2026-01-10 22:08:58 dovecot_plain authenticator failed for H=(surbocally) [23.30.11.253]:40554: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan 10 22:10:33 host2 pure-ftpd[3283915]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.226.88.121
country_id: 2661886
description:
2026-01-10 22:19:35 dovecot_plain authenticator failed for H=81-226-88-121-no600.tbcn.telia.com (shicoon) [81.226.88.121]:59038: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 22:26:30 host2 sshd[3300352]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 54.174.168.242
country_id: 6252001
description:
Jan 10 22:27:16 host2 pure-ftpd[3301289]: (?@54.174.168.242) [INFO] New connection from 54.174.168.242


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.208.46.130
country_id: 1522867
description:
2026-01-10 22:28:49 dovecot_login authenticator failed for H=([37.208.46.130]) [37.208.46.130]:38768: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.82
country_id: 1269750
description:
2026-01-10 22:28:48 dovecot_login authenticator failed for H=([59.145.212.121]) [182.95.184.82]:58862: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.70.126
country_id: 1269750
description:
2026-01-10 22:29:01 dovecot_login authenticator failed for H=([182.78.70.126]) [182.78.70.126]:36776: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.248.30.205
country_id: 1269750
description:
2026-01-10 22:29:11 dovecot_login authenticator failed for H=([103.248.30.205]) [103.248.30.205]:40004: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 203.55.131.5
country_id: 6252001
description:
Jan 10 22:36:08 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=203.55.131.5, lip=66.85.158.91, session=<08xzqAtI6L/LN4MF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.80.228.231
country_id: 6252001
description:
2026-01-10 22:38:18 dovecot_login authenticator failed for H=([129.80.228.231]) [129.80.228.231]:39850: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.233
country_id: 6252001
description:
Jan 10 22:39:38 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.233, lip=66.85.158.92, TLS handshaking: Connection closed, session=<TRv0tAtIsa1APsXp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.227
country_id: 6252001
description:
Jan 10 22:39:56 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.227, lip=66.85.158.92, TLS handshaking: Connection closed, session=<GEwItgtISC5APsXj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 10 22:40:05 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<postfix@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<RQVotgtIJLJ100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.202.190
country_id: 1269750
description:
Jan 10 22:43:53 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=103.84.202.190, lip=66.85.158.91, TLS, session=<EVf9wgtIUa5nVMq+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.61.142.172
country_id: 2510769
description:
Jan 10 22:44:11 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=217.61.142.172, lip=66.85.158.91, TLS, session=<Y0o6xAtI3sXZPY6s>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.36
country_id: 6252001
description:
Jan 10 22:44:31 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=147.185.133.36, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<6bpwxgtIAdaTuYUk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.36
country_id: 6252001
description:
Jan 10 22:45:23 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 9 secs): user=<>, rip=147.185.133.36, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<3YWTyQtIEuiTuYUk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.72.78.233
country_id: 3469034
description:
Jan 10 22:45:43 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=177.72.78.233, lip=66.85.158.91, TLS, session=<j5S1yQtIFJexSE7p>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.235
country_id: 3865483
description:
Jan 10 22:46:05 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=179.0.251.235, lip=66.85.158.91, TLS, session=<Ur/fygtII6CzAPvr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.153
country_id: 2635167
description:
Jan 10 22:51:22 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=35.203.211.153, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<Gqv03gtIfsEjy9OZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.36
country_id: 6252001
description:
Jan 10 22:52:41 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.36, lip=66.85.158.91, TLS, session=<qIGr4wtIuvqTuYUk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.153
country_id: 2635167
description:
Jan 10 22:52:17 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=35.203.211.153, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<UAM04gtIVvIjy9OZ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 22:56:45 host2 sshd[3334238]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 207.90.244.14
country_id: 6252001
description:
Jan 10 22:57:13 host2 pure-ftpd[3334642]: (?@207.90.244.14) [INFO] New connection from 207.90.244.14


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 207.90.244.14
country_id: 6252001
description:
Jan 10 22:57:15 host2 pure-ftpd[3334676]: (?@207.90.244.14) [INFO] New connection from 207.90.244.14


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.235.248.73
country_id: 3469034
description:
2026-01-10 22:57:20 dovecot_login authenticator failed for H=(186.235.248.73.girardi-rs.com.br) [186.235.248.73]:48060: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.9.200.229
country_id: 2510769
description:
2026-01-10 22:56:57 dovecot_login authenticator failed for H=229.red-88-9-200.dynamicip.rima-tde.net [88.9.200.229]:46389: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.153
country_id: 2635167
description:
Jan 10 22:59:03 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.203.211.153, lip=66.85.158.92, TLS, session=<Mpln+gtIIPgjy9OZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.0.171.43
country_id: 298795
description:
Jan 10 23:01:50 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=95.0.171.43, lip=66.85.158.91, TLS, session=<m/FjAwxIXtdfAKsr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.201.115
country_id: 3469034
description:
Jan 10 23:02:13 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=179.189.201.115, lip=66.85.158.91, TLS, session=<ed2NBAxI6oCzvclz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.4.106.201
country_id: 1210997
description:
Jan 10 23:04:09 host2 sshd[3341749]: Disconnected from invalid user steam 202.4.106.201 port 60466 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.4.106.201
country_id: 1210997
description:
Jan 10 23:05:26 host2 sshd[3343252]: Disconnected from invalid user testuser 202.4.106.201 port 48938 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.206
country_id: 1269750
description:
2026-01-10 23:06:45 dovecot_login authenticator failed for H=([27.123.105.41]) [182.95.52.206]:37822: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.227.8.186
country_id: 934292
description:
Jan 10 23:05:58 host2 sshd[3343864]: Disconnected from invalid user deployerer 197.227.8.186 port 31511 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2026-01-10 23:06:28 dovecot_login authenticator failed for H=([152.52.234.46]) [182.95.176.194]:59188: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.151
country_id: 6252001
description:
Jan 10 23:06:46 host2 pure-ftpd[3344734]: (?@205.210.31.151) [INFO] New connection from 205.210.31.151


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.4.106.201
country_id: 1210997
description:
Jan 10 23:07:38 host2 sshd[3345573]: Disconnected from invalid user speedtest 202.4.106.201 port 55112 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.191.75
country_id: 1819730
description:
Jan 10 23:10:46 host2 sshd[3349177]: Disconnected from invalid user test 152.32.191.75 port 54040 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.28.190.0
country_id: 2510769
description:
Jan 10 23:11:11 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=139.28.190.0, lip=66.85.158.91, TLS, session=<JebVJAxISeWLHL4A>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.191
country_id: 3175395
description:
Jan 10 23:10:54 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=217.26.179.191, lip=66.85.158.91, TLS, session=<sIa6IwxIBunZGrO/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.69
country_id: 6252001
description:
Jan 10 23:14:55 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.20.69, lip=66.85.158.92, TLS handshaking: Connection closed, session=<DHUxMwxIJlpBMRRF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 10 23:15:42 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<G63cNQxIZOF100Db>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.75
country_id: 6252001
description:
Jan 10 23:15:15 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.75, lip=66.85.158.92, session=<7+ZfNAxIt/lBMQFL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.69
country_id: 6252001
description:
Jan 10 23:15:17 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.20.69, lip=66.85.158.92, TLS handshaking: Connection closed, session=<htZzNAxIVnlBMRRF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.66
country_id: 6252001
description:
Jan 10 23:15:26 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.66, lip=66.85.158.92, TLS: Connection closed, session=<RA4KNQxITKhBMQFC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.161
country_id: 3865483
description:
Jan 10 23:19:51 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=179.0.251.161, lip=66.85.158.91, TLS, session=<MgqWQwxIs+SzAPuh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.172.213.166
country_id: 1605651
description:
2026-01-10 23:20:03 dovecot_login authenticator failed for H=([203.172.213.166]) [203.172.213.166]:32942: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.194
country_id: 1269750
description:
2026-01-10 23:20:05 dovecot_login authenticator failed for H=([182.95.115.194]) [182.95.115.194]:45478: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.184
country_id: 3144096
description:
2026-01-10 23:20:46 dovecot_login authenticator failed for H=(cm-178.232.153.184.get.no) [178.232.153.184]:43585: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.223.251.135
country_id: 2395170
description:
Jan 10 23:20:11 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=41.223.251.135, lip=66.85.158.91, TLS, session=<NSnpRAxIcLQp3/uH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2026-01-10 23:20:21 dovecot_login authenticator failed for H=([94.201.22.158]) [94.201.22.158]:36624: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.144.27.228
country_id: 6252001
description:
2026-01-10 23:21:28 dovecot_plain authenticator failed for H=c-73-144-27-228.hsd1.mi.comcast.net (suadsing) [73.144.27.228]:51226: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.254.91
country_id: 3865483
description:
2026-01-10 23:26:01 dovecot_login authenticator failed for H=(static.92.254.104.190.cps.com.ar) [190.104.254.91]:60429: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.74.12.86
country_id: 1269750
description:
2026-01-10 23:25:31 dovecot_login authenticator failed for H=(nsg-static-193.87.72.182.airtel.in) [182.74.12.86]:35660: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.65.30
country_id: 2264397
description:
2026-01-10 23:28:44 dovecot_login authenticator failed for H=bl23-65-30.dsl.telepac.pt [144.64.65.30]:4404: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.142
country_id: 1269750
description:
2026-01-10 23:29:03 dovecot_login authenticator failed for H=([182.95.215.71]) [182.95.230.142]:53578: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.79.195
country_id: 337996
description:
2026-01-10 23:36:56 dovecot_login authenticator failed for H=([213.55.79.199]) [213.55.79.195]:49588: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.145.122.196
country_id: 3175395
description:
2026-01-10 23:37:11 dovecot_login authenticator failed for H=([82.145.122.196]) [82.145.122.196]:51812: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.118.162.194
country_id: 2453866
description:
2026-01-10 23:40:36 dovecot_login authenticator failed for H=([154.118.162.194]) [154.118.162.194]:9133: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.50.154
country_id: 1269750
description:
2026-01-10 23:41:18 dovecot_login authenticator failed for H=([125.19.93.105]) [182.95.50.154]:51984: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2026-01-10 23:46:17 dovecot_plain authenticator failed for H=c-73-168-136-150.hsd1.il.comcast.net (valite) [73.168.136.150]:46646: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.25.232.7
country_id: 953987
description:
Jan 10 23:49:28 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<amila@euroentertainmentlk.com>, method=PLAIN, rip=41.25.232.7, lip=66.85.158.91, session=<nfSXrgxIwOIpGegH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.66
country_id: 6252001
description:
Jan 10 23:51:42 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.20.66, lip=66.85.158.92, session=<QrO0tgxIVrBBMRRC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.251.72.36
country_id: 6252001
description:
Jan 10 23:52:33 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=783) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=47.251.72.36, lip=66.85.158.91, TLS handshaking: read(size=783) failed: Connection reset by peer, session=<53rCuQxI7J4v+0gk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 10 23:52:47 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<+Ml6ugxIKdl100Db>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.251.53.147
country_id: 6252001
description:
Jan 10 23:53:03 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=47.251.53.147, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<BJqNuwxIHrwv+zWT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.251.53.147
country_id: 6252001
description:
Jan 10 23:53:11 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=47.251.53.147, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<g4YKvAxIsCov+zWT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.206.54
country_id: 1269750
description:
2026-01-10 23:53:28 dovecot_login authenticator failed for H=([182.95.3.57]) [125.19.206.54]:52686: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.83.98
country_id: 1269750
description:
2026-01-10 23:53:59 dovecot_login authenticator failed for H=([182.79.83.98]) [182.79.83.98]:39296: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.31
country_id: 6252001
description:
Jan 10 23:55:03 host2 dovecot[3239883]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=91.230.168.31, lip=66.85.158.92, session=<3fOrwgxIBc9b5qgf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.29
country_id: 6252001
description:
Jan 10 23:55:06 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.230.168.29, lip=66.85.158.92, session=<BfDawgxIV+xb5qgd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.16
country_id: 6252001
description:
Jan 10 23:54:41 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.230.168.16, lip=66.85.158.92, session=<jpBiwQxIDatb5qgQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.24
country_id: 6252001
description:
Jan 10 23:54:51 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.230.168.24, lip=66.85.158.92, session=<V0b8wQxIT8Nb5qgY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.206.54
country_id: 1269750
description:
2026-01-11 00:02:57 dovecot_login authenticator failed for H=([182.95.3.57]) [125.19.206.54]:37620: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.218.247.234
country_id: 1522867
description:
2026-01-11 00:03:25 dovecot_login authenticator failed for H=([89.218.247.234]) [89.218.247.234]:47680: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 124.248.184.195
country_id: 1831722
description:
[2026-01-11 00:07:47 +0530] info [cpaneld] 124.248.184.195 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 00:12:46 host2 sshd[3412265]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.244
country_id: 3996063
description:
2026-01-11 00:13:39 dovecot_login authenticator failed for H=([177.236.146.244]) [177.236.146.244]:56568: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.19.91
country_id: 1269750
description:
2026-01-11 00:13:22 dovecot_login authenticator failed for H=(static.ill.117.250.19.91.bsnl.co.in) [117.250.19.91]:44096: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 11 00:23:10 host2 sshd[3424640]: Disconnected from invalid user admin 2.57.121.112 port 42460 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan 11 00:23:39 host2 pure-ftpd[3425044]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.67
country_id: 99237
description:
2026-01-11 00:26:46 dovecot_plain authenticator failed for H=(urisderato) [65.20.129.67]:56361: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 117.211.64.219
country_id: 1269750
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[117.211.64.219] [Remote Port]=[50213] [Authentication Database]=[mail] [Username]=[webmaster@seyawin.com] (10/10 failures) (blocked until [Sun Jan 11 18:57:36 2026 UTC/Mon Jan 12 00:27:36 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 11 00:27:38 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<J20GNw1IJcR100Db>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan 11 00:31:04 host2 pure-ftpd[3431477]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.50
country_id: 1269750
description:
2026-01-11 00:31:53 dovecot_login authenticator failed for H=([125.16.246.121]) [182.95.63.50]:40344: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.142
country_id: 1269750
description:
2026-01-11 00:31:53 dovecot_login authenticator failed for H=([27.123.104.142]) [27.123.104.142]:41686: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.207.176.58
country_id: 192950
description:
2026-01-11 00:32:04 dovecot_login authenticator failed for H=([196.207.176.58]) [196.207.176.58]:44114: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.118.138
country_id: 3144096
description:
2026-01-11 00:31:53 dovecot_login authenticator failed for H=(cm-46.212.118.138.get.no) [46.212.118.138]:47568: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.99.61.248
country_id: 1269750
description:
2026-01-11 00:34:21 dovecot_login authenticator failed for H=([14.99.61.248]) [14.99.61.248]:54004: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.116
country_id: 1269750
description:
2026-01-11 00:34:33 dovecot_login authenticator failed for H=(nsg-corporate-116.230.187.122.airtel.in) [122.187.230.116]:51550: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.49
country_id: 290557
description:
Jan 11 00:40:45 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=185.93.89.49, lip=66.85.158.91, session=<wAzmZQ1Impe5XVkx>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 00:42:54 host2 sshd[3441959]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.48
country_id: 290557
description:
Jan 11 00:48:23 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=185.93.89.48, lip=66.85.158.91, session=<PklWgQ1IXte5XVkw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2026-01-11 00:49:02 dovecot_login authenticator failed for H=([125.18.154.73]) [182.95.226.118]:45116: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.47
country_id: 290557
description:
Jan 11 00:53:36 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=185.93.89.47, lip=66.85.158.91, session=<TUv7kw1IXsO5XVkv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.46
country_id: 290557
description:
Jan 11 00:54:10 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=185.93.89.46, lip=66.85.158.91, session=<GU8Alg1IQKa5XVku>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.46
country_id: 290557
description:
Jan 11 00:54:14 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 6 secs): user=<admin@venee.lk>, method=PLAIN, rip=185.93.89.46, lip=66.85.158.91, session=<rO0Alg1IUKa5XVku>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.5.178.229
country_id: 3865483
description:
2026-01-11 00:54:23 dovecot_login authenticator failed for H=([186.5.178.229]) [186.5.178.229]:45584: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.187.170.129
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 89.187.170.129 - 587hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.30
country_id: 290557
description:
Jan 11 00:55:33 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=185.93.89.30, lip=66.85.158.91, session=<ren2mg1IMsm5XVke>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.45
country_id: 290557
description:
Jan 11 00:59:40 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=185.93.89.45, lip=66.85.158.91, session=<vEeoqQ1IAKm5XVkt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan 11 00:59:58 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<2aC2qg1I+KoUOAHJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan 11 01:00:23 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<xzAsrA1IErVm2gqW>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.171.146.247
country_id: 2921044
description:
[2026-01-11 01:00:40 +0530] info [cpaneld] 62.171.146.247 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2026-01-11 01:00:49 dovecot_plain authenticator failed for H=c-98-227-25-115.hsd1.il.comcast.net (untory) [98.227.25.115]:58314: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Jan 11 01:01:56 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@dataesite.lk>, method=PLAIN, rip=47.236.243.254, lip=66.85.158.91, session=<DyrIsQ1ILsIv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan 11 01:02:10 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<h8yWsg1I9OZIpyJ4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan 11 01:01:32 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@nsteeleng.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<GsdQsA1IKIhCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Jan 11 01:03:07 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=165.211.25.202, lip=66.85.158.91, session=<nfsEtg1I2K6l0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 105.174.17.50
country_id: 3351879
description:
Jan 11 01:02:17 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=105.174.17.50, lip=66.85.158.91, session=<7s8Bsw1IfNFprhEy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan 11 01:02:21 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<YmpGsw1IksMv/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan 11 01:02:26 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<K7KNsw1I6s0vWBNS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Jan 11 01:02:35 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@mathsmotorcysle.xyz>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<8YoRtA1IkOq8putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 11 01:02:46 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<B/i9tA1I6sl100Db>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 124.248.184.195
country_id: 1831722
description:
[2026-01-11 01:03:41 +0530] info [cpaneld] 124.248.184.195 - kamechot "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.29
country_id: 290557
description:
Jan 11 01:04:26 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=185.93.89.29, lip=66.85.158.91, session=<ofOuug1IrIS5XVkd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan 11 01:05:09 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@seyawin.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<tlQ7vQ1IEJqi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 141.94.22.51
country_id: 3017382
description:
Jan 11 01:06:07 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=141.94.22.51, lip=66.85.158.91, session=<h/q/wA1I1OONXhYz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.28
country_id: 290557
description:
Jan 11 01:05:50 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=185.93.89.28, lip=66.85.158.91, session=<iRqvvw1IltO5XVkc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.190.22.247
country_id: 2750405
description:
Jan 11 01:06:18 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=146.190.22.247, lip=66.85.158.91, session=<1BZdwQ1IRuuSvhb3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.67.11
country_id: 1269750
description:
Jan 11 01:06:59 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@lankaherbalsolutions.com>, method=PLAIN, rip=115.241.67.11, lip=66.85.158.91, session=<+RTRww1IEqlz8UML>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 01:07:51 host2 sshd[3468389]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.212.140.171
country_id: 1880251
description:
2026-01-11 01:07:49 dovecot_login authenticator failed for H=(171.140.212.218.starhub.net.sg) [218.212.140.171]:58254: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-01-11 01:08:03 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:37478: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2026-01-11 01:07:41 dovecot_login authenticator failed for H=(1522312565.colombiatel.co) [152.231.25.64]:51986: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.184.118.5
country_id: 1168579
description:
Jan 11 01:08:52 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=182.184.118.5, lip=66.85.158.91, session=<hO+Syg1IvoO2uHYF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 105.174.17.50
country_id: 3351879
description:
Jan 11 01:08:16 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=105.174.17.50, lip=66.85.158.91, session=<4LZfyA1IlGNprhEy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.253.82.89
country_id: 6252001
description:
Jan 11 01:08:50 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=47.253.82.89, lip=66.85.158.91, session=<4Vh0yg1IzKgv/VJZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.68.110.207
country_id: 2921044
description:
Jan 11 01:09:20 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=138.68.110.207, lip=66.85.158.91, session=<ilU9zA1IZq6KRG7P>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.218.10.150
country_id: 51537
description:
Jan 11 01:10:08 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=102.218.10.150, lip=66.85.158.91, session=<XGMUzw1IeuNm2gqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan 11 01:11:03 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<qKdk0g1Ivr4v/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Jan 11 01:11:25 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<od2n0w1ISIUv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Jan 11 01:11:29 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@venee.lk>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<JMLk0w1ISMe8putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.67.11
country_id: 1269750
description:
Jan 11 01:12:08 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@lankaherbalsolutions.com>, method=PLAIN, rip=115.241.67.11, lip=66.85.158.91, session=<zEZC1g1IGpFz8UML>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.105.156.165
country_id: 3923057
description:
Jan 11 01:13:45 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=200.105.156.165, lip=66.85.158.91, session=<vkgK3A1I4onIaZyl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan 11 01:18:03 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@ceylondigest.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<TL9h6w1I7ulCdMzo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2026-01-11 01:18:07 dovecot_login authenticator failed for H=([122.184.120.98]) [122.184.120.98]:40170: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.171.116
country_id: 99237
description:
2026-01-11 01:18:42 dovecot_login authenticator failed for H=([65.20.171.116]) [65.20.171.116]:48832: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.239.164.207
country_id: 3996063
description:
2026-01-11 01:18:49 dovecot_login authenticator failed for H=([177.239.164.207]) [177.239.164.207]:36526: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.2
country_id: 1269750
description:
2026-01-11 01:19:08 dovecot_login authenticator failed for H=([125.19.173.202]) [152.52.236.2]:38602: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 01:19:34 host2 sshd[3482861]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.143.72
country_id: 298795
description:
2026-01-11 01:25:16 dovecot_plain authenticator failed for H=(solia) [5.11.143.72]:47936: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.209.108.42
country_id: 6254930
description:
2026-01-11 01:26:18 dovecot_plain authenticator failed for H=(niziera) [185.209.108.42]:59790: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 01:28:27 host2 sshd[3493734]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 11 01:37:12 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<lsjiLw5IPZd100Db>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.181.104
country_id: 6252001
description:
Jan 11 01:44:43 host2 dovecot[3239883]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=45.79.181.104, lip=66.85.158.92, session=<ObXhSg5ItMUtT7Vo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.55.198
country_id: 6252001
description:
2026-01-11 01:51:45 dovecot_plain authenticator failed for H=([178.16.55.198]) [178.16.55.198]:58396: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.129
country_id: 6252001
description:
Jan 11 01:52:42 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.129, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<JZlxZw5IGcmTuYSB>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 01:57:49 host2 sshd[3530240]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 124.248.184.195
country_id: 1831722
description:
[2026-01-11 01:57:58 +0530] info [cpaneld] 124.248.184.195 - kamechot "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 124.248.184.195
country_id: 1831722
description:
[2026-01-11 02:00:09 +0530] info [cpaneld] 124.248.184.195 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 02:02:01 host2 sshd[3535421]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.66
country_id: 6252001
description:
Jan 11 02:02:02 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.66, lip=66.85.158.92, TLS, session=<ZOLSiA5IavbG6xhC>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 02:07:35 host2 sshd[3541930]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 11 02:12:18 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<72lmrQ5INL5100Db>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 02:15:05 host2 sshd[3551148]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2026-01-11 02:16:13 dovecot_login authenticator failed for H=([65.191.211.33]) [65.191.211.33]:43880: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.190.155.43
country_id: 6252001
description:
2026-01-11 02:16:22 dovecot_plain authenticator failed for H=(caling) [76.190.155.43]:44466: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2026-01-11 02:16:24 dovecot_plain authenticator failed for H=c-73-13-220-220.hsd1.de.comcast.net (brodolable) [73.13.220.220]:49058: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.176.4.105
country_id: 1168579
description:
2026-01-11 02:16:29 dovecot_login authenticator failed for H=([182.176.4.105]) [182.176.4.105]:58394: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 02:17:17 host2 sshd[3553905]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.107.251
country_id: 3469034
description:
Jan 11 02:19:52 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=187.120.107.251, lip=66.85.158.91, TLS, session=<x858xw5I3t+7eGv7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.7.10
country_id: 690791
description:
Jan 11 02:20:11 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=176.103.7.10, lip=66.85.158.91, TLS, session=<b+KtyA5IlaOwZwcK>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 02:20:33 host2 sshd[3557618]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 02:27:40 host2 sshd[3566971]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2026-01-11 02:28:37 dovecot_login authenticator failed for H=(237-166.adsl.static.espeed.com.bn) [119.160.166.237]:43762: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.158.145.31
country_id: 2510769
description:
2026-01-11 02:28:22 dovecot_login authenticator failed for H=31.145.158.146.dynamic.jazztel.es [146.158.145.31]:46223: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.45
country_id: 6252001
description:
Jan 11 02:31:55 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.45, lip=66.85.158.91, session=<kdS18w5I3ZtAPpwt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.38
country_id: 6252001
description:
Jan 11 02:32:07 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.38, lip=66.85.158.91, TLS: Connection closed, session=<chxu9A5IEEdAPpwm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.38
country_id: 6252001
description:
Jan 11 02:32:19 host2 dovecot[3239883]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=64.62.156.38, lip=66.85.158.91, session=<CF0k9Q5IevZAPpwm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-11 02:33:32 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (shoynicar) [87.103.126.54]:35124: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.1.34.242
country_id: 719819
description:
2026-01-11 02:34:51 dovecot_plain authenticator failed for H=dsl540122f2.fixip.t-online.hu (bogrels) [84.1.34.242]:34076: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2026-01-11 02:35:25 dovecot_plain authenticator failed for H=c-73-145-107-251.hsd1.mi.comcast.net (exclainess) [73.145.107.251]:56260: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 02:36:19 host2 sshd[3578109]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.255.223.75
country_id: 1880251
description:
Jan 11 02:38:05 host2 sshd[3580229]: Disconnected from invalid user frappe 36.255.223.75 port 64552 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.53.88
country_id: 3932488
description:
Jan 11 02:38:28 host2 sshd[3580619]: Disconnected from invalid user admin 161.132.53.88 port 49182 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.25.232.7
country_id: 953987
description:
Jan 11 02:38:40 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<amila@euroentertainmentlk.com>, method=PLAIN, rip=41.25.232.7, lip=66.85.158.91, session=<4fy5Cw9IB9QpGegH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.255.223.75
country_id: 1880251
description:
Jan 11 02:38:48 host2 sshd[3580952]: Disconnected from invalid user testuser 36.255.223.75 port 22094 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.255.223.75
country_id: 1880251
description:
Jan 11 02:39:21 host2 sshd[3581555]: Disconnected from invalid user admin 36.255.223.75 port 33284 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 02:40:25 host2 sshd[3582967]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.255.223.75
country_id: 1880251
description:
Jan 11 02:40:22 host2 sshd[3582904]: Disconnected from invalid user claude 36.255.223.75 port 55660 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.53.88
country_id: 3932488
description:
Jan 11 02:40:43 host2 sshd[3583331]: Disconnected from invalid user testuser 161.132.53.88 port 52294 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan 11 02:40:17 host2 pure-ftpd[3582814]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 11 02:42:05 host2 sshd[3584993]: Disconnected from invalid user admin 2.57.121.112 port 19412 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.58.87.108
country_id: 6252001
description:
2026-01-11 02:41:21 dovecot_plain authenticator failed for H=c-174-58-87-108.hsd1.fl.comcast.net (syncon) [174.58.87.108]:53580: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.132.53.88
country_id: 3932488
description:
Jan 11 02:41:46 host2 sshd[3584599]: Disconnected from invalid user test 161.132.53.88 port 53544 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 112.120.170.82
country_id: 1819730
description:
Jan 11 02:42:42 host2 sshd[3585652]: Disconnected from invalid user testuser 112.120.170.82 port 56786 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 163.43.225.34
country_id: 1861060
description:
Jan 11 02:43:47 host2 sshd[3586888]: Disconnected from invalid user vpn 163.43.225.34 port 44626 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 11 02:47:14 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<Y9pWKg9IRMZ100Db>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan 11 02:47:15 host2 pure-ftpd[3591441]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 02:52:47 host2 sshd[3598935]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.72.147.99
country_id: 1880251
description:
Jan 11 02:56:42 host2 sshd[3604214]: Disconnected from invalid user admin 103.72.147.99 port 44006 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.72.147.99
country_id: 1880251
description:
Jan 11 02:58:46 host2 sshd[3606597]: Disconnected from invalid user deploy 103.72.147.99 port 42272 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.72.147.99
country_id: 1880251
description:
Jan 11 02:59:21 host2 sshd[3607319]: Disconnected from invalid user deploy 103.72.147.99 port 36230 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.158.216
country_id: 2510769
description:
2026-01-11 03:06:00 dovecot_login authenticator failed for H=([207.188.158.216]) [207.188.158.216]:30868: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.63
country_id: 99237
description:
2026-01-11 03:06:18 dovecot_login authenticator failed for H=([65.20.174.63]) [65.20.174.63]:34895: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2026-01-11 03:07:26 dovecot_plain authenticator failed for H=c-24-127-53-61.hsd1.mi.comcast.net (cully) [24.127.53.61]:36292: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.0.228.11
country_id: 1269750
description:
2026-01-11 03:07:32 dovecot_login authenticator failed for H=([61.0.228.11]) [61.0.228.11]:41318: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.122
country_id: 1269750
description:
2026-01-11 03:07:57 dovecot_login authenticator failed for H=([125.16.31.25]) [152.52.236.122]:50316: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 03:09:07 host2 sshd[3619753]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 03:11:53 host2 sshd[3623350]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 199.195.248.191
country_id: 6252001
description:
Jan 11 03:15:52 host2 sshd[3628187]: Disconnected from invalid user user1 199.195.248.191 port 56362 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2026-01-11 03:20:10 dovecot_plain authenticator failed for H=(deccon) [65.20.205.197]:60728: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 11 03:22:10 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<help@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<oXhCpw9IGo1100Db>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.196
country_id: 6252001
description:
Jan 11 03:22:34 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.247.196, lip=66.85.158.91, session=<vdTZqA9IwNu4affE>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 03:24:55 host2 sshd[3639035]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 136.113.146.40
country_id: 6252001
description:
Jan 11 03:25:35 host2 pure-ftpd[3640238]: (?@136.113.146.40) [INFO] New connection from 136.113.146.40


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2026-01-11 03:34:02 dovecot_login authenticator failed for H=([115.240.244.53]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.207.176.58
country_id: 192950
description:
2026-01-11 03:35:05 dovecot_login authenticator failed for H=([196.207.176.58]) [196.207.176.58]:50892: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.218
country_id: 337996
description:
2026-01-11 03:34:19 dovecot_login authenticator failed for H=([196.189.124.218]) [196.189.124.218]:57706: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.5
country_id: 6252001
description:
Jan 11 03:35:24 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=74.82.47.5, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Fc2z1g9IvEpKUi8F>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.169.42
country_id: 1819730
description:
Jan 11 03:38:25 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: read(size=1013) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=152.32.169.42, lip=66.85.158.91, session=<qKKF4Q9Iqi+YIKkq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.240.95
country_id: 1819730
description:
Jan 11 03:38:58 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=152.32.240.95, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Cf584w9IBBuYIPBf>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 03:42:51 host2 sshd[3660279]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 03:43:41 host2 sshd[3661131]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.218.2
country_id: 1269750
description:
2026-01-11 03:46:43 dovecot_login authenticator failed for H=([61.246.205.1]) [125.19.218.2]:42798: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2026-01-11 03:46:16 dovecot_plain authenticator failed for H=(uneum) [80.227.102.242]:59543: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-11 03:46:18 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (ressordia) [87.103.126.54]:3577: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.49
country_id: 290557
description:
Jan 11 03:48:55 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=185.93.89.49, lip=66.85.158.91, session=<M8rpBhBIQIG5XVkx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.49
country_id: 290557
description:
Jan 11 03:53:08 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=185.93.89.49, lip=66.85.158.91, session=</o8KFhBIpqW5XVkx>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 03:55:06 host2 sshd[3676182]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-11 03:57:04 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (sustadvias) [87.103.126.54]:64337: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 11 03:57:29 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@seyawin.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<Q+uTJRBIi5N100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.48
country_id: 290557
description:
Jan 11 04:00:19 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=185.93.89.48, lip=66.85.158.91, session=</3O5LxBIxMm5XVkw>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 04:04:13 host2 sshd[3686804]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.48
country_id: 290557
description:
Jan 11 04:04:37 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=185.93.89.48, lip=66.85.158.91, session=<LWAcPxBIXKi5XVkw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.222.81.115
country_id: 6252001
description:
Jan 11 04:04:55 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.222.81.115, lip=66.85.158.91, TLS, session=<NGNEQBBI5IIs3lFz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.30
country_id: 290557
description:
Jan 11 04:06:09 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=185.93.89.30, lip=66.85.158.91, session=<J72NRBBI3Jm5XVke>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.46
country_id: 290557
description:
Jan 11 04:08:03 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=185.93.89.46, lip=66.85.158.91, session=<CaVZSxBI5Lm5XVku>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.232.178.116
country_id: 1269750
description:
Jan 11 04:09:08 host2 sshd[3692934]: Disconnected from invalid user mailtpls 165.232.178.116 port 55768 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 04:09:28 host2 sshd[3693297]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.232.178.116
country_id: 1269750
description:
Jan 11 04:09:43 host2 sshd[3693600]: Disconnected from invalid user urischeme 165.232.178.116 port 54168 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.30
country_id: 290557
description:
Jan 11 04:10:27 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=185.93.89.30, lip=66.85.158.91, session=<eq3zUxBI1NC5XVke>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.232.178.116
country_id: 1269750
description:
Jan 11 04:10:17 host2 sshd[3694390]: Disconnected from invalid user weee 165.232.178.116 port 40056 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.45
country_id: 290557
description:
Jan 11 04:11:35 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=185.93.89.45, lip=66.85.158.91, session=<E+n/VxBI/sa5XVkt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.48
country_id: 6252001
description:
Jan 11 04:13:44 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.48, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<gqLVXxBIfNbG6xgw>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 04:14:58 host2 sshd[3700804]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.45
country_id: 290557
description:
Jan 11 04:15:52 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@melanifinefood.com>, method=PLAIN, rip=185.93.89.45, lip=66.85.158.91, session=<aBtOZxBIXuq5XVkt>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.78.140.118
country_id: 2802361
description:
Jan 11 04:15:55 host2 pure-ftpd[3702481]: (?@34.78.140.118) [INFO] New connection from 34.78.140.118


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.53.254.168
country_id: 6252001
description:
2026-01-11 04:17:51 dovecot_plain authenticator failed for H=c-73-53-254-168.hsd1.fl.comcast.net (ranian) [73.53.254.168]:40738: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.10
country_id: 1269750
description:
2026-01-11 04:18:27 dovecot_login authenticator failed for H=(abts-north-dynamic-121.212.66.182.airtelbroadband.in) [27.123.113.10]:33708: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-01-11 04:18:45 dovecot_login authenticator failed for H=([197.219.228.242]) [197.219.228.242]:41434: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.173.58.47
country_id: 6252001
description:
2026-01-11 04:18:48 dovecot_plain authenticator failed for H=c-67-173-58-47.hsd1.il.comcast.net (preous) [67.173.58.47]:60216: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.29
country_id: 290557
description:
Jan 11 04:18:59 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=185.93.89.29, lip=66.85.158.91, session=<B1VychBIeM65XVkd>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 04:20:07 host2 sshd[3708454]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.28
country_id: 290557
description:
Jan 11 04:21:12 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=185.93.89.28, lip=66.85.158.91, session=<iQVpehBIwsu5XVkc>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 04:21:25 host2 sshd[3709935]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 04:24:03 host2 sshd[3713114]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.29
country_id: 290557
description:
Jan 11 04:23:18 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=185.93.89.29, lip=66.85.158.91, session=<vQ7ugRBIDOe5XVkd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2026-01-11 04:25:16 dovecot_plain authenticator failed for H=(nosiont) [178.250.191.189]:51470: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.28
country_id: 290557
description:
Jan 11 04:25:33 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=185.93.89.28, lip=66.85.158.91, session=<8Bf6iRBItNy5XVkc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.228
country_id: 99237
description:
2026-01-11 04:25:42 dovecot_login authenticator failed for H=([65.20.205.228]) [65.20.205.228]:43527: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.240.102.68
country_id: 6252001
description:
2026-01-11 04:27:35 dovecot_login authenticator failed for H=vps-13116434.franquiaadonairh.com [162.240.102.68]:52662: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 04:28:25 host2 sshd[3719587]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 04:30:32 host2 sshd[3722761]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.96
country_id: 6252001
description:
Jan 11 04:30:32 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.96, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<WL3mmxBIjt/G6xhg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.66.209
country_id: 1819730
description:
2026-01-11 04:32:00 dovecot_login authenticator failed for H=209.66.246.220.static.netvigator.com [220.246.66.209]:54506: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.178
country_id: 1269750
description:
2026-01-11 04:32:21 dovecot_login authenticator failed for H=([182.79.95.139]) [152.52.246.178]:37176: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 04:34:29 host2 sshd[3728881]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.82
country_id: 1269750
description:
2026-01-11 04:34:56 dovecot_login authenticator failed for H=([59.145.212.121]) [182.95.184.82]:41974: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-01-11 04:35:11 dovecot_login authenticator failed for H=([197.219.228.242]) [197.219.228.242]:41308: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.18.99.38
country_id: 1269750
description:
2026-01-11 04:35:56 dovecot_login authenticator failed for H=([182.95.20.225]) [125.18.99.38]:44726: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2026-01-11 04:35:57 dovecot_login authenticator failed for H=([186.239.240.127]) [186.215.245.175]:39895: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.206.54
country_id: 1269750
description:
2026-01-11 04:36:24 dovecot_login authenticator failed for H=([128.185.241.87]) [125.19.206.54]:56536: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2026-01-11 04:36:38 dovecot_login authenticator failed for H=([59.145.84.25]) [103.251.31.154]:56854: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.77.137.236
country_id: 1605651
description:
2026-01-11 04:36:57 dovecot_login authenticator failed for H=([110.77.137.236]) [110.77.137.236]:57042: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 34.122.105.182
country_id: 6252001
description:
Jan 11 04:37:04 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=34.122.105.182, lip=66.85.158.91, TLS: Connection closed, session=<VXpDsxBIoOoiemm2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.78.16.88
country_id: 2661886
description:
2026-01-11 04:37:08 dovecot_login authenticator failed for H=a088.broadband.quicknet.se [217.78.16.88]:47700: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.48
country_id: 290557
description:
Jan 11 04:40:34 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=185.93.89.48, lip=66.85.158.91, session=<B7SgvxBI3Ki5XVkw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.48
country_id: 290557
description:
Jan 11 04:41:26 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=185.93.89.48, lip=66.85.158.91, session=<C9zGwhBI8pW5XVkw>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 04:42:52 host2 sshd[3740993]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 04:43:31 host2 sshd[3741847]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 04:44:19 host2 sshd[3742960]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.30
country_id: 290557
description:
Jan 11 04:46:09 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=185.93.89.30, lip=66.85.158.91, session=<tPKW0xBIGJG5XVke>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.72.176.66
country_id: 2542007
description:
2026-01-11 04:46:55 dovecot_plain authenticator failed for H=(acring) [105.72.176.66]:54874: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.30
country_id: 290557
description:
Jan 11 04:47:00 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=185.93.89.30, lip=66.85.158.91, session=<dD6w1hBIrt65XVke>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 04:47:31 host2 sshd[3748278]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.46
country_id: 290557
description:
Jan 11 04:48:28 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=185.93.89.46, lip=66.85.158.91, session=<pDrm2xBI/N+5XVku>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.46
country_id: 290557
description:
Jan 11 04:49:20 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=185.93.89.46, lip=66.85.158.91, session=<OhAI3xBIdOC5XVku>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.45
country_id: 290557
description:
Jan 11 04:51:54 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@ceylondigest.com>, method=PLAIN, rip=185.93.89.45, lip=66.85.158.91, session=<yNUm6BBIGI25XVkt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.190.155.43
country_id: 6252001
description:
2026-01-11 04:52:10 dovecot_plain authenticator failed for H=(relste) [76.190.155.43]:37957: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.45
country_id: 290557
description:
Jan 11 04:52:46 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=185.93.89.45, lip=66.85.158.91, session=<1wBO6xBIaK65XVkt>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan 11 04:53:42 host2 pure-ftpd[3758763]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.110.238.68
country_id: 6252001
description:
2026-01-11 04:54:23 dovecot_plain authenticator failed for H=(wolings) [75.110.238.68]:41482: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 04:56:41 host2 sshd[3763552]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.51.244
country_id: 6252001
description:
2026-01-11 04:58:53 dovecot_login authenticator failed for H=dummitfradin.com [174.138.51.244]:49986: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.29
country_id: 290557
description:
Jan 11 04:59:48 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=185.93.89.29, lip=66.85.158.91, session=<1853BBFIeOm5XVkd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.29
country_id: 290557
description:
Jan 11 05:00:42 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=185.93.89.29, lip=66.85.158.91, session=<WKiiBxFIJOq5XVkd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.175.208.166
country_id: 6252001
description:
Jan 11 05:00:33 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.175.208.166, lip=66.85.158.91, TLS handshaking: Connection closed, session=<bAhEBxFIjOZCr9Cm>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.175.208.166
country_id: 6252001
description:
Jan 11 05:00:37 host2 pure-ftpd[3770126]: (?@66.175.208.166) [INFO] New connection from 66.175.208.166


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan 11 05:00:41 host2 pure-ftpd[3770206]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.28
country_id: 290557
description:
Jan 11 05:02:16 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=185.93.89.28, lip=66.85.158.91, session=<3eREDRFIjMS5XVkc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.28
country_id: 290557
description:
Jan 11 05:03:09 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@nsteeleng.com>, method=PLAIN, rip=185.93.89.28, lip=66.85.158.91, session=<0sJyEBFIsrm5XVkc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 80.82.77.139
country_id: 2750405
description:
Jan 11 05:03:47 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=80.82.77.139, lip=66.85.158.91, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<bTbPEhFIwJBQUk2L>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.128.112.204
country_id: 3017382
description:
2026-01-11 05:09:19 dovecot_login authenticator failed for H=217-128-112-204.ftth.fr.orangecustomers.net [217.128.112.204]:55680: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.174
country_id: 6252001
description:
Jan 11 05:09:46 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.132.174, lip=66.85.158.91, TLS, session=<0eQxKBFImOqTuYSu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.81
country_id: 1733045
description:
2026-01-11 05:09:59 dovecot_login authenticator failed for H=([49.124.151.81]) [49.124.151.81]:54842: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 05:15:17 host2 sshd[3787435]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.112
country_id: 1819730
description:
Jan 11 05:15:15 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=45.142.154.112, lip=66.85.158.92, TLS, session=<LM7VOxFI5qktjppw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.76.183
country_id: 3469034
description:
Jan 11 05:17:08 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=187.120.76.183, lip=66.85.158.91, TLS, session=<C2NRQRFI6dy7eEy3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.140.238
country_id: 99237
description:
Jan 11 05:17:15 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=65.20.140.238, lip=66.85.158.91, TLS, session=<rFntQRFIiuxBFIzu>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 05:18:00 host2 sshd[3790536]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.115.144.103
country_id: 3469034
description:
2026-01-11 05:18:10 dovecot_login authenticator failed for H=(buenosnet.static.gvt.net.br) [187.115.144.103]:44028: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.85.107.34
country_id: 3469034
description:
Jan 11 05:17:31 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<hr>, method=PLAIN, rip=187.85.107.34, lip=66.85.158.91, TLS, session=<NuuuQhFI0ZG7VWsi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.170.238
country_id: 3175395
description:
Jan 11 05:17:33 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<hr>, method=PLAIN, rip=185.15.170.238, lip=66.85.158.91, TLS, session=<fAgPQxFI2py5D6ru>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.202.65
country_id: 2413451
description:
2026-01-11 05:18:34 dovecot_login authenticator failed for H=(197-255-202-65.netpagedns.net) [197.255.202.65]:34147: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 05:19:55 host2 sshd[3792397]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 05:24:30 host2 sshd[3798176]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 05:27:26 host2 sshd[3801657]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.25.232.7
country_id: 953987
description:
Jan 11 05:28:34 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<amila@euroentertainmentlk.com>, method=PLAIN, rip=41.25.232.7, lip=66.85.158.91, session=<hExSaxFIKeopGegH>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 05:30:25 host2 sshd[3804815]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 11 05:32:46 host2 sshd[3807354]: Disconnected from invalid user admin 2.57.121.112 port 15344 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 05:33:40 host2 sshd[3808229]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.92
country_id: 1819730
description:
Jan 11 05:36:03 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed: read(size=1013) failed: Connection reset by peer (no auth attempts in 3 secs): user=<>, rip=45.142.154.92, lip=66.85.158.92, session=<SAk6hhFIemAtjppc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 118.193.39.149
country_id: 1819730
description:
Jan 11 05:36:48 host2 dovecot[3239883]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=118.193.39.149, lip=66.85.158.91, TLS handshaking: Connection closed, session=<fNrniBFITMt2wSeV>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 11 05:37:58 host2 sshd[3813167]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.216.195.77
country_id: 2658434
description:
Jan 11 05:39:00 host2 pure-ftpd[3814669]: (?@35.216.195.77) [INFO] New connection from 35.216.195.77


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 35.216.195.77
country_id: 2658434
description:
Jan 11 05:39:05 host2 pure-ftpd[3814813]: (?@35.216.195.77) [INFO] New connection from 35.216.195.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2026-01-11 05:41:03 dovecot_plain authenticator failed for H=(unreoteria) [12.150.243.22]:59616: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.123
country_id: 6252001
description:
Jan 11 05:42:53 host2 dovecot[3239883]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.123, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<njWpnhFIMNjG6xh7>


