# incident

plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.68.104.233
country_id: 2921044
description:
Dec 17 18:35:39 host2 sshd[2244803]: Disconnected from invalid user yash 138.68.104.233 port 42226 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 17 18:35:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<lQQngSVGSpE+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2025-12-17 18:36:23 dovecot_login authenticator failed for ([38.226.118.9]) [38.226.118.0]:52562: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.154.162.193
country_id: 6252001
description:
Dec 17 18:37:07 host2 pure-ftpd[2245697]: (?@165.154.162.193) [INFO] New connection from 165.154.162.193


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 17 18:36:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<PAn/giVG4s8+PIcf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.59.221
country_id: 3144096
description:
2025-12-17 18:36:47 dovecot_login authenticator failed for ([84.215.59.221]) [84.215.59.221]:35121: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.154.162.193
country_id: 6252001
description:
Dec 17 18:37:26 host2 pure-ftpd[2245914]: (?@165.154.162.193) [INFO] New connection from 165.154.162.193


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 90.180.197.128
country_id: 3077311
description:
Dec 17 18:37:53 host2 sshd[2246206]: Disconnected from invalid user macro 90.180.197.128 port 51850 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.154.162.193
country_id: 6252001
description:
Dec 17 18:38:15 host2 pure-ftpd[2246486]: (?@165.154.162.193) [INFO] New connection from 165.154.162.193


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 90.180.197.128
country_id: 3077311
description:
Dec 17 18:39:41 host2 sshd[2247534]: Disconnected from invalid user jira 90.180.197.128 port 63887 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.1.105.105
country_id: 1269750
description:
2025-12-17 18:40:49 dovecot_login authenticator failed for ([61.1.105.105]) [61.1.105.105]:33523: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-12-17 18:41:33 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:35075: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.50.151
country_id: 1168579
description:
2025-12-17 18:43:56 dovecot_login authenticator failed for ([203.124.50.151]) [203.124.50.151]:41743: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.164.238.63
country_id: 6252001
description:
2025-12-17 18:44:32 dovecot_login authenticator failed for c-67-164-238-63.hsd1.il.comcast.net [67.164.238.63]:16962: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.252.92.5
country_id: 1821275
description:
2025-12-17 18:47:49 dovecot_login authenticator failed for (ADMIN) [84.252.92.5]:57726: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.119
country_id: 1819730
description:
2025-12-17 18:53:27 dovecot_login authenticator failed for (m121-202-206-119.smartone.com) [121.202.206.119]:53274: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.134.235
country_id: 6252001
description:
Dec 17 18:54:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=71.6.134.235, lip=66.85.158.92, TLS: Connection closed, session=<6/MwxCVGDL1HBobr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.144
country_id: 1269750
description:
2025-12-17 18:54:58 dovecot_login authenticator failed for (nsg-corporate-144.230.187.122.airtel.in) [122.187.230.144]:55023: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.160
country_id: 1733045
description:
2025-12-17 18:55:45 dovecot_login authenticator failed for ([49.124.154.160]) [49.124.154.160]:50160: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 17 18:56:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<V252yiVGwLw+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 17 18:58:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<3RZ00iVGzMA+PIdm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 17 19:02:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<0GNL3yVGOoQ+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.234.178.105
country_id: 3469034
description:
Dec 17 19:05:09 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<careers>, method=PLAIN, rip=177.234.178.105, lip=66.85.158.91, TLS, session=<H++k6CVGpZOx6rJp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.150
country_id: 3865483
description:
Dec 17 19:04:46 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=179.0.250.150, lip=66.85.158.91, TLS, session=<dc9B5yVGE8qzAPqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.26.147
country_id: 798544
description:
Dec 17 19:04:48 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=178.216.26.147, lip=66.85.158.91, TLS, session=<3FaF5yVGA4Ky2BqT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.107.86.63
country_id: 732800
description:
Dec 17 19:05:07 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers>, method=PLAIN, rip=109.107.86.63, lip=66.85.158.91, TLS, session=<bKed6CVGjelta1Y/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.202.110.50
country_id: 798544
description:
Dec 17 19:04:38 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=85.202.110.50, lip=66.85.158.91, TLS, session=<Rebk5iVGyKZVym4y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.25.219
country_id: 690791
description:
Dec 17 19:04:48 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=176.103.25.219, lip=66.85.158.91, TLS, session=<1z+E5yVGlZ2wZxnb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.245.219.224
country_id: 6290252
description:
Dec 17 19:04:58 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<careers>, method=PLAIN, rip=109.245.219.224, lip=66.85.158.91, TLS, session=<sof+5yVGEY5t9dvg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.223
country_id: 3175395
description:
Dec 17 19:05:06 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<careers>, method=PLAIN, rip=185.15.169.223, lip=66.85.158.91, TLS, session=<845+6CVGed65D6nf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.118.138
country_id: 3144096
description:
2025-12-17 19:06:00 dovecot_login authenticator failed for (cm-46.212.118.138.get.no) [46.212.118.138]:51721: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.99
country_id: 1269750
description:
2025-12-17 19:06:23 dovecot_login authenticator failed for (nsg-corporate-99.229.187.122.airtel.in) [122.187.229.99]:40302: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 19:08:14 host2 sshd[2269885]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 17 19:08:50 host2 sshd[2270121]: Disconnected from invalid user user 2.57.121.25 port 44577 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.153.124
country_id: 6252001
description:
2025-12-17 19:09:00 dovecot_login authenticator failed for (ADMIN) [102.129.153.124]:46337: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.73.171.250
country_id: 149590
description:
Dec 17 19:10:45 host2 sshd[2271469]: Disconnected from invalid user student2 154.73.171.250 port 22942 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.73.171.250
country_id: 149590
description:
Dec 17 19:11:35 host2 sshd[2272378]: Disconnected from invalid user sftp_user 154.73.171.250 port 62037 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.156.67.18
country_id: 6252001
description:
Dec 17 19:13:09 host2 sshd[2273231]: Disconnected from invalid user chris 12.156.67.18 port 37178 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 12.156.67.18
country_id: 6252001
description:
Dec 17 19:13:53 host2 sshd[2273659]: Disconnected from invalid user runner 12.156.67.18 port 47082 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.204.74.149
country_id: 1269750
description:
Dec 17 19:14:32 host2 sshd[2273961]: Disconnected from invalid user builder 49.204.74.149 port 36570 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.182.132.154
country_id: 1269750
description:
Dec 17 19:15:33 host2 sshd[2274631]: Disconnected from invalid user runner 103.182.132.154 port 35316 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.2.146.184
country_id: 3865483
description:
Dec 17 19:15:43 host2 sshd[2274700]: Disconnected from invalid user gemini 181.2.146.184 port 36356 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.204.74.149
country_id: 1269750
description:
Dec 17 19:17:07 host2 sshd[2275476]: Disconnected from invalid user teamspeak3 49.204.74.149 port 57498 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 49.204.74.149
country_id: 1269750
description:
Dec 17 19:18:24 host2 sshd[2276182]: Disconnected from invalid user zhenshan 49.204.74.149 port 53846 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.126.26
country_id: 3703430
description:
2025-12-17 19:25:23 dovecot_login authenticator failed for (ADMIN) [91.90.126.26]:58548: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 17 19:26:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<2pRGNCZGdJ8+PIdm>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.201.208
country_id: 1880251
description:
Dec 17 19:26:26 host2 sshd[2280851]: Disconnected from invalid user vivek 45.78.201.208 port 56570 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.237.32
country_id: 3625428
description:
2025-12-17 19:26:26 dovecot_login authenticator failed for (ADMIN) [95.181.237.32]:53218: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 17 19:29:27 host2 pure-ftpd[2282681]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 17 19:30:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<a7JbRCZGgrI+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 17 19:35:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<SG3UViZG+OY+PIMp>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 19:36:25 host2 sshd[2287016]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.94.146.56
country_id: 6252001
description:
Dec 17 19:38:37 host2 pure-ftpd[2288346]: (?@167.94.146.56) [INFO] New connection from 167.94.146.56


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 17 19:42:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<b5xkbiZGItI+PIcm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 19:43:46 host2 sshd[2292241]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.37.148
country_id: 6252001
description:
2025-12-17 19:44:28 dovecot_login authenticator failed for (ADMIN) [191.96.37.148]:47509: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.109.154.54
country_id: 3469034
description:
2025-12-17 19:45:20 dovecot_login authenticator failed for ([189.109.154.54]) [189.109.154.54]:43699: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.6.31
country_id: 1880251
description:
2025-12-17 19:45:31 dovecot_login authenticator failed for (31.6.245.49.unknown.m1.com.sg) [49.245.6.31]:54523: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.89.138
country_id: 660013
description:
2025-12-17 19:49:23 dovecot_login authenticator failed for (ADMIN) [188.126.89.138]:52374: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.140
country_id: 6252001
description:
Dec 17 19:53:27 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.140, lip=66.85.158.91, TLS: Connection closed, session=<+JV7liZG6C5ChJmM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.172.239.193
country_id: 3017382
description:
2025-12-17 19:53:52 dovecot_login authenticator failed for sed08-h03-176-172-239-193.dsl.sta.abo.bbox.fr [176.172.239.193]:52535: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.28.86.1
country_id: 1819730
description:
2025-12-17 19:54:13 dovecot_login authenticator failed for (113-28-86-1.static.imsbiz.com) [113.28.86.1]:53731: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 17 19:56:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<6u+zoSZGZI4+PIcm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.116
country_id: 1819730
description:
Dec 17 19:57:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=45.142.154.116, lip=66.85.158.92, TLS handshaking: Connection closed, session=<dyZlpiZG2Ictjpp0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 17 19:57:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<1FJFpCZGiOk+PIMh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 17 19:57:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<9YdHpCZGxt4+PIMp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 17 19:59:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<LWm0qiZG5IE+PIcm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.93.37.178
country_id: 1269750
description:
2025-12-17 20:00:08 dovecot_login authenticator failed for ([103.93.37.178]) [103.93.37.178]:60236: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.50.155
country_id: 1269750
description:
2025-12-17 20:00:24 dovecot_login authenticator failed for (abts-north-static-155.50.160.122.airtelbroadband.in) [122.160.50.155]:52985: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec 17 20:04:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<R8otvSZGKO0+PIds>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.237.34
country_id: 3625428
description:
2025-12-17 20:05:57 dovecot_login authenticator failed for (ADMIN) [95.181.237.34]:32862: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 17 20:06:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<uT/bxCZGztE+PIM0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 17 20:08:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<4XtnyiZGGow+PIcg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.0.3
country_id: 3469034
description:
2025-12-17 20:11:07 dovecot_login authenticator failed for (177-174-0-3.user.vivozap.com.br) [177.174.0.3]:48458: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.138.184
country_id: 3144096
description:
2025-12-17 20:10:52 dovecot_login authenticator failed for (cm-178.232.138.184.get.no) [178.232.138.184]:54711: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 17 20:13:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<qN2y3SZGEqw+PIcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.37.148.184
country_id: 286963
description:
2025-12-17 20:13:51 dovecot_plain authenticator failed for (JKJEX) [5.37.148.184]:2829: 535 Incorrect authentication data (set_id=chitral100@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Dec 17 20:14:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<swz64iZGMOQ+PIco>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.202
country_id: 3077311
description:
2025-12-17 20:15:42 dovecot_login authenticator failed for (ADMIN) [212.102.39.202]:1797: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.92.229
country_id: 3996063
description:
2025-12-17 20:18:09 dovecot_login authenticator failed for (201.173.92.229-clientes-izzi.mx) [201.173.92.229]:60565: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2025-12-17 20:18:21 dovecot_login authenticator failed for ([90.161.217.228]) [90.161.217.228]:52130: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec 17 20:18:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<UwuA8SZGsKA+PIdq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.73
country_id: 3144096
description:
2025-12-17 20:19:03 dovecot_login authenticator failed for (73-161-97-62.cust.smartcall.no) [62.97.161.73]:46827: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.147.89.158
country_id: 1269750
description:
2025-12-17 20:19:25 dovecot_login authenticator failed for ([203.147.89.38]) [203.147.89.158]:57514: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.203.43
country_id: 2542007
description:
2025-12-17 20:20:00 dovecot_login authenticator failed for ([105.73.203.43]) [105.73.203.43]:53511: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2025-12-17 20:22:47 dovecot_login authenticator failed for ([65.20.153.146]) [65.20.153.146]:42184: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.228.23.212
country_id: 6252001
description:
2025-12-17 20:22:46 dovecot_plain authenticator failed for ec2-34-228-23-212.compute-1.amazonaws.com (EC2AMAZ-RT2IK6U.ec2.internal) [34.228.23.212]:58460: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.127.217
country_id: 1512440
description:
2025-12-17 20:23:11 dovecot_login authenticator failed for ([213.230.127.217]) [213.230.127.217]:41384: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.136.194.120
country_id: 2510769
description:
2025-12-17 20:23:26 dovecot_login authenticator failed for (120-194-136-45.ddns.movitel.tv) [45.136.194.120]:60680: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.91.113.248
country_id: 6252001
description:
2025-12-17 20:24:05 dovecot_login authenticator failed for (syn-172-091-113-248.res.spectrum.com) [172.91.113.248]:42650: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 17 20:24:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<s9cMBCdGaOk+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.171.153.24
country_id: 783754
description:
2025-12-17 20:24:13 dovecot_login authenticator failed for (ADMIN) [31.171.153.24]:12661: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.147.102
country_id: 1733045
description:
2025-12-17 20:24:43 dovecot_login authenticator failed for ([49.124.147.102]) [49.124.147.102]:60268: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.141.216.143
country_id: 298795
description:
2025-12-17 20:28:55 dovecot_plain authenticator failed for (zinalle) [31.141.216.143]:54374: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 17 20:31:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<CCURHydGZLE+PIM0>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 17 20:33:21 host2 pure-ftpd[2324993]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.124.37
country_id: 3042225
description:
2025-12-17 20:34:53 dovecot_login authenticator failed for (ADMIN) [91.90.124.37]:57994: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 17 20:35:13 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<593bKydGksIDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 17 20:35:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<Xk0WLCdGKoc+PIce>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 17 20:37:19 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<I35VMydGPuIDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 17 20:37:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<cNd2NCdGVLc+PIdj>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 20:38:29 host2 sshd[2328790]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.73.148.20
country_id: 798549
description:
Dec 17 20:40:08 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=212.73.148.20, lip=66.85.158.92, session=<RtNnPSdGRsLUSZQU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 17 20:39:18 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<tBZ5OidGkswDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.101
country_id: 6251999
description:
2025-12-17 20:40:52 dovecot_login authenticator failed for ([207.219.221.101]) [207.219.221.101]:42710: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec 17 20:41:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<QL/TQCdGZOA+PIdo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 17 20:40:19 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<76sWPidGRo8DhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.98
country_id: 130758
description:
Dec 17 20:40:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.98, lip=66.85.158.91, session=<TTFKPidGEI4+PIdi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.98.241.4
country_id: 290557
description:
2025-12-17 20:41:21 dovecot_login authenticator failed for ([98.98.241.4]) [98.98.241.4]:33875: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 17 20:41:24 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<eZn6QSdGGLcDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 17 20:42:25 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<ftGYRSdGnMADhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.22.95.160
country_id: 6251999
description:
2025-12-17 20:43:40 dovecot_login authenticator failed for (ADMIN) [149.22.95.160]:36852: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 17 20:43:43 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<Z09BSidGwNkDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 17 20:44:50 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<n+9ATidGyIYDhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.213.126
country_id: 1819730
description:
Dec 17 20:45:22 host2 sshd[2333249]: Disconnected from invalid user test 123.58.213.126 port 43262 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec 17 20:46:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<PyGrUydG0Mw+PIdo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 17 20:47:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<rc/UVidGVoo+PIcm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.88.51
country_id: 294640
description:
2025-12-17 20:47:59 dovecot_login authenticator failed for ([2.55.88.51]) [2.55.88.51]:45306: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.66.16.233
country_id: 1643084
description:
Dec 17 20:48:38 host2 sshd[2335605]: Disconnected from invalid user debian 36.66.16.233 port 41830 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.66.16.233
country_id: 1643084
description:
Dec 17 20:49:21 host2 sshd[2336100]: Disconnected from invalid user vbox 36.66.16.233 port 54016 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.66.16.233
country_id: 1643084
description:
Dec 17 20:50:01 host2 sshd[2336396]: Disconnected from invalid user production 36.66.16.233 port 37964 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.87
country_id: 6252001
description:
Dec 17 20:52:04 host2 pure-ftpd[2337861]: (?@147.185.132.87) [INFO] New connection from 147.185.132.87


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-17 20:53:54 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:49476: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.152.15
country_id: 2658434
description:
2025-12-17 20:57:04 dovecot_login authenticator failed for (ADMIN) [158.173.152.15]:2432: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.66.16.233
country_id: 1643084
description:
Dec 17 20:56:14 host2 sshd[2340867]: Disconnected from invalid user alba 36.66.16.233 port 34710 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 20:59:39 host2 sshd[2342236]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.124
country_id: 6252001
description:
Dec 17 21:01:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.124, lip=66.85.158.92, TLS: Connection closed, session=<AtcViSdGJtZChJl8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.52
country_id: 6252001
description:
Dec 17 21:02:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.52, lip=66.85.158.91, TLS: Connection closed, session=<WFE6jCdGCDinXpI0>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 123.58.213.126
country_id: 1819730
description:
Dec 17 21:05:59 host2 sshd[2348801]: Disconnected from invalid user tes 123.58.213.126 port 46904 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.56.52.110
country_id: 6251999
description:
2025-12-17 21:06:01 dovecot_login authenticator failed for (ADMIN) [212.56.52.110]:36711: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 17 21:06:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<Y1o1mydGLsY+PIcl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 17 21:09:32 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Zt+MpidGttADgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.158.149.139
country_id: 2750405
description:
Dec 17 21:10:15 host2 sshd[2352100]: Disconnected from invalid user postgres 51.158.149.139 port 58172 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.98
country_id: 130758
description:
Dec 17 21:10:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.98, lip=66.85.158.91, session=<C70oqSdGDsY+PIdi>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.158.149.139
country_id: 2750405
description:
Dec 17 21:11:35 host2 sshd[2353024]: Disconnected from invalid user lab 51.158.149.139 port 55492 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 17 21:12:09 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<67furydGNNUDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 17 21:12:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<v4NfsSdGENE+PIde>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 17 21:13:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<bMoqsydG/rI+PIM0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 17 21:13:19 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: Connection closed, session=<9DEVtCdGnLYDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.155.223.9
country_id: 1605651
description:
Dec 17 21:13:37 host2 sshd[2354482]: Disconnected from invalid user sam 122.155.223.9 port 37333 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.95.128.167
country_id: 6252001
description:
Dec 17 21:13:51 host2 sshd[2354701]: Disconnected from invalid user test6 23.95.128.167 port 49548 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 17 21:14:26 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<bo0buCdG/MkDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.20.157
country_id: 2750405
description:
2025-12-17 21:14:40 dovecot_login authenticator failed for (ADMIN) [158.173.20.157]:39736: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 17 21:14:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<+KAluSdGHLg+PIcd>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.55.87.153
country_id: 6252001
description:
Dec 17 21:15:20 host2 sshd[2356033]: Disconnected from invalid user peter 45.55.87.153 port 33742 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.3.159.149
country_id: 6252001
description:
Dec 17 21:15:35 host2 sshd[2356223]: Disconnected from invalid user beehive 192.3.159.149 port 35116 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.82.240.194
country_id: 1643084
description:
Dec 17 21:16:08 host2 sshd[2356692]: Disconnected from invalid user mark 103.82.240.194 port 36972 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 17 21:16:40 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<up0QwCdGDpEDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 17 21:17:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<zdMxxCdGcqw+PIcl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 17 21:17:19 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: Connection closed, session=<iEJswidGANIDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.3.159.149
country_id: 6252001
description:
Dec 17 21:17:33 host2 sshd[2358072]: Disconnected from invalid user azureuser 192.3.159.149 port 38828 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.82.240.194
country_id: 1643084
description:
Dec 17 21:17:49 host2 sshd[2358285]: Disconnected from invalid user user1 103.82.240.194 port 36672 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.82.240.194
country_id: 1643084
description:
Dec 17 21:18:32 host2 sshd[2358909]: Disconnected from invalid user azureuser 103.82.240.194 port 51138 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 17 21:18:58 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS, session=<6L1RyCdGDJ0DgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 17 21:19:20 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<5AaaySdGkNEDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.95.128.167
country_id: 6252001
description:
Dec 17 21:19:24 host2 sshd[2359600]: Disconnected from invalid user ccserver 23.95.128.167 port 59576 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.184.78
country_id: 6252001
description:
2025-12-17 21:19:34 dovecot_login authenticator failed for ([74.196.184.78]) [74.196.184.78]:32948: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 192.3.159.149
country_id: 6252001
description:
Dec 17 21:19:36 host2 sshd[2359724]: Disconnected from invalid user ftpUser 192.3.159.149 port 60192 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 121.122.89.119
country_id: 1733045
description:
Dec 17 21:20:28 host2 sshd[2360774]: Disconnected from invalid user azureuser 121.122.89.119 port 65358 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 23.95.128.167
country_id: 6252001
description:
Dec 17 21:21:06 host2 sshd[2361447]: Disconnected from invalid user test10 23.95.128.167 port 54388 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.76.135.162
country_id: 6252001
description:
2025-12-17 21:20:12 dovecot_login authenticator failed for 149-76-135-162.fidnet.com [149.76.135.162]:55926: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.155.223.9
country_id: 1605651
description:
Dec 17 21:20:26 host2 sshd[2360719]: Disconnected from invalid user wekan 122.155.223.9 port 9216 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 17 21:21:11 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: Connection closed, session=<+p450CdGGOQDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.97.44.51
country_id: 3175395
description:
Dec 17 21:22:17 host2 sshd[2362637]: Disconnected from invalid user tomcatuser 62.97.44.51 port 42890 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 17 21:22:30 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<1Pbq1CdGTIsDgmBb>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.212.34.237
country_id: 3895114
description:
Dec 17 21:22:46 host2 sshd[2363016]: Disconnected from invalid user g 181.212.34.237 port 18576 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 17 21:22:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<ng2C1idGNL0+PIM0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 17 21:24:46 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS, session=</g4S3SdG0rQDgmBb>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 21:25:33 host2 sshd[2365636]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.40
country_id: 2635167
description:
Dec 17 21:25:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=35.203.211.40, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<yoJH4CdGM8Qjy9Mo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 121.122.89.119
country_id: 1733045
description:
Dec 17 21:25:59 host2 sshd[2365942]: Disconnected from invalid user steam 121.122.89.119 port 22860 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 190.171.108.25
country_id: 3624060
description:
Dec 17 21:26:30 host2 pure-ftpd[2366575]: (?@190.171.108.25) [INFO] New connection from 190.171.108.25


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.40
country_id: 2635167
description:
Dec 17 21:26:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 2 secs): user=<>, rip=35.203.211.40, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<dlzN4ydGcPEjy9Mo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.40
country_id: 2635167
description:
Dec 17 21:27:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 25 secs): user=<>, rip=35.203.211.40, lip=66.85.158.91, TLS: read(size=429) failed: Connection reset by peer, session=<72Cy5SdGduQjy9Mo>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 190.171.108.25
country_id: 3624060
description:
Dec 17 21:27:36 host2 pure-ftpd[2367837]: (?@190.171.108.25) [INFO] New connection from 190.171.108.25


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 190.171.108.25
country_id: 3624060
description:
Dec 17 21:27:39 host2 pure-ftpd[2367877]: (?@190.171.108.25) [INFO] New connection from 190.171.108.25


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 190.171.108.25
country_id: 3624060
description:
Dec 17 21:28:08 host2 pure-ftpd[2368532]: (?@190.171.108.25) [INFO] New connection from 190.171.108.25


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 190.171.108.25
country_id: 3624060
description:
Dec 17 21:28:08 host2 pure-ftpd[2368528]: (?@190.171.108.25) [INFO] New connection from 190.171.108.25


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.122.29
country_id: 3042058
description:
2025-12-17 21:28:32 dovecot_login authenticator failed for (ADMIN) [91.90.122.29]:25642: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 190.171.108.25
country_id: 3624060
description:
Dec 17 21:29:08 host2 pure-ftpd[2369821]: (?@190.171.108.25) [INFO] New connection from 190.171.108.25


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 190.171.108.25
country_id: 3624060
description:
Dec 17 21:29:09 host2 pure-ftpd[2369845]: (?@190.171.108.25) [INFO] New connection from 190.171.108.25


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 17 21:29:12 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<8ZPP7CdG6K0+PIdf>


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 190.171.108.25
country_id: 3624060
description:
Dec 17 21:30:09 host2 pure-ftpd[2371074]: (?@190.171.108.25) [INFO] New connection from 190.171.108.25


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 190.171.108.25
country_id: 3624060
description:
Dec 17 21:30:08 host2 pure-ftpd[2371059]: (?@190.171.108.25) [INFO] New connection from 190.171.108.25


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 190.171.108.25
country_id: 3624060
description:
Dec 17 21:31:10 host2 pure-ftpd[2372135]: (?@190.171.108.25) [INFO] New connection from 190.171.108.25


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 17 21:31:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<AQeC9idG5IY+PIcm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.40
country_id: 2635167
description:
Dec 17 21:31:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.203.211.40, lip=66.85.158.91, TLS, session=<ch/F9idGjOwjy9Mo>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 190.171.108.25
country_id: 3624060
description:
Dec 17 21:31:08 host2 pure-ftpd[2372110]: (?@190.171.108.25) [INFO] New connection from 190.171.108.25


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 21:32:54 host2 sshd[2373781]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 190.171.108.25
country_id: 3624060
description:
Dec 17 21:32:08 host2 pure-ftpd[2373238]: (?@190.171.108.25) [INFO] New connection from 190.171.108.25


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 190.171.108.25
country_id: 3624060
description:
Dec 17 21:32:08 host2 pure-ftpd[2373251]: (?@190.171.108.25) [INFO] New connection from 190.171.108.25


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.140.141.211
country_id: 2542007
description:
2025-12-17 21:32:15 dovecot_plain authenticator failed for ([192.168.1.111]) [41.140.141.211]:22530: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 17 21:34:07 host2 pure-ftpd[2374389]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.127.128
country_id: 3144096
description:
2025-12-17 21:34:32 dovecot_login authenticator failed for ([46.212.127.128]) [46.212.127.128]:54368: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 17 21:34:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<tltpAShGnpg+PIdp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.17.20
country_id: 2077456
description:
2025-12-17 21:34:15 dovecot_login authenticator failed for ([101.168.17.20]) [101.168.17.20]:47236: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.152.99.244
country_id: 6252001
description:
2025-12-17 21:35:51 dovecot_login authenticator failed for (syn-184-152-099-244.res.spectrum.com) [184.152.99.244]:58809: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 158.94.210.91
country_id: 2750405
description:
2025-12-17 21:36:37 H=([158.94.210.91]) [158.94.210.91]:57122 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 CV=no F=<info@a05techhub.com> rejected RCPT <accounts@bostonlanka.com>: No Such User Here


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2025-12-17 21:37:53 dovecot_login authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:54384: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.64.246
country_id: 1512440
description:
2025-12-17 21:38:06 dovecot_login authenticator failed for ([213.230.64.246]) [213.230.64.246]:42692: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 17 21:37:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<2q+8CyhG8LY+PIcr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.185.159.132
country_id: 3865483
description:
2025-12-17 21:39:10 dovecot_login authenticator failed for ([190.185.159.132]) [190.185.159.132]:44523: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.148.95.217
country_id: 6252001
description:
2025-12-17 21:39:20 dovecot_login authenticator failed for ([38.148.95.217]) [38.148.95.217]:37711: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Dec 17 21:40:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<6ipJFShG/rw+PIcc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.165.174.234
country_id: 1269750
description:
2025-12-17 21:41:59 dovecot_login authenticator failed for ([103.165.174.234]) [103.165.174.234]:58187: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.197.74.150
country_id: 1269750
description:
2025-12-17 21:41:17 dovecot_plain authenticator failed for (GXA8DC) [103.197.74.150]:22073: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 17 21:41:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<BjqfGChGhr0+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.26
country_id: 6252001
description:
2025-12-17 21:42:09 dovecot_login authenticator failed for ([70.174.168.26]) [70.174.168.26]:53163: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 17 21:45:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<HIHKKChGvOg+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.115.24
country_id: 6290252
description:
2025-12-17 21:46:11 dovecot_login authenticator failed for (ADMIN) [37.46.115.24]:45404: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.153.107
country_id: 6252001
description:
2025-12-17 21:46:49 dovecot_login authenticator failed for (ADMIN) [158.173.153.107]:47697: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.202
country_id: 6252001
description:
Dec 17 21:51:44 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.202, lip=66.85.158.92, TLS handshaking: Connection closed, session=<8Ux7PShGypRBMQHK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.202
country_id: 6252001
description:
Dec 17 21:52:17 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.202, lip=66.85.158.92, TLS: Connection closed, session=<32N0PyhG8hNBMQHK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.84.155.190
country_id: 6252001
description:
2025-12-17 21:52:29 dovecot_login authenticator failed for (pool-162-84-155-190.nycmny.fios.verizon.net) [162.84.155.190]:53502: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.224.26
country_id: 1269750
description:
2025-12-17 21:53:14 dovecot_login authenticator failed for ([152.52.224.26]) [152.52.224.26]:38866: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 17 21:56:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<Bp3CTChGRtc+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.242.243
country_id: 6252001
description:
2025-12-17 22:03:34 dovecot_login authenticator failed for wsip-184-191-242-243.fv.ks.cox.net [184.191.242.243]:59476: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.232.38
country_id: 2542007
description:
2025-12-17 22:03:46 dovecot_login authenticator failed for (ADMIN) [95.181.232.38]:6704: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.206.205.76
country_id: 1605651
description:
2025-12-17 22:03:48 dovecot_login authenticator failed for ([103.206.205.76]) [103.206.205.76]:52976: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.4
country_id: 2635167
description:
Dec 17 22:04:12 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 10 secs): user=<>, rip=35.203.211.4, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<nbcXaihGfMwjy9ME>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.4
country_id: 2635167
description:
Dec 17 22:05:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=35.203.211.4, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<aWy1bShGuuEjy9ME>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.125.162.32
country_id: 718075
description:
Dec 17 22:08:41 host2 sshd[2410885]: Disconnected from invalid user proxyuser 79.125.162.32 port 55428 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.42.104.13
country_id: 6252001
description:
Dec 17 22:08:59 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.42.104.13, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<iY4teyhG3tUUKmgN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.20.16.22
country_id: 1269750
description:
Dec 17 22:09:10 host2 sshd[2411191]: Disconnected from invalid user dasusr1 125.20.16.22 port 45562 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.20.16.22
country_id: 1269750
description:
Dec 17 22:10:40 host2 sshd[2412407]: Disconnected from invalid user summer 125.20.16.22 port 36826 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.50
country_id: 6252001
description:
Dec 17 22:11:01 host2 pure-ftpd[2412669]: (?@205.210.31.50) [INFO] New connection from 205.210.31.50


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.35.119.129
country_id: 3175395
description:
Dec 17 22:10:29 host2 sshd[2412315]: Disconnected from invalid user ftp_user 151.35.119.129 port 22409 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 79.125.162.32
country_id: 718075
description:
Dec 17 22:10:31 host2 sshd[2412331]: Disconnected from invalid user smp 79.125.162.32 port 56876 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 17 22:10:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<Yly6gChGAqs+PIdm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.4
country_id: 2635167
description:
Dec 17 22:11:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.4, lip=66.85.158.92, TLS, session=<M7bjhChGDPgjy9ME>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.70
country_id: 6252001
description:
Dec 17 22:14:22 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.139.70, lip=66.85.158.92, session=<L3VsjihGYv64aYtG>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 125.20.16.22
country_id: 1269750
description:
Dec 17 22:14:46 host2 sshd[2415454]: Disconnected from invalid user ubuntu 125.20.16.22 port 28550 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.56.80.155
country_id: 6251999
description:
2025-12-17 22:17:00 dovecot_login authenticator failed for (ADMIN) [66.56.80.155]:16420: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 17 22:17:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<7bEYmihG0tzBHmEh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.35.119.129
country_id: 3175395
description:
Dec 17 22:18:50 host2 sshd[2418358]: Disconnected from invalid user user2 151.35.119.129 port 22779 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 17 22:18:36 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<7dF4nShGBMk+PIMh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.182.111.162
country_id: 1880251
description:
2025-12-17 22:19:23 dovecot_login authenticator failed for (162.111.182.58.starhub.net.sg) [58.182.111.162]:43904: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.169.113
country_id: 2635167
description:
2025-12-17 22:19:51 dovecot_login authenticator failed for (165-220-169-113.cust.exede.net) [165.220.169.113]:57451: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.246.255.183
country_id: 294640
description:
2025-12-17 22:20:02 dovecot_login authenticator failed for ([185.246.255.183]) [185.246.255.183]:37291: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.92.234
country_id: 3996063
description:
2025-12-17 22:20:19 dovecot_login authenticator failed for (201.173.92.234-clientes-izzi.mx) [201.173.92.234]:35862: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 17 22:20:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<e2B+pChG+sI+PIcr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2025-12-17 22:23:05 dovecot_login authenticator failed for (138.219.244.10.static.softdados.net) [177.128.209.48]:33732: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.243.234.23
country_id: 6252001
description:
2025-12-17 22:22:52 dovecot_login authenticator failed for c-73-243-234-23.hsd1.co.comcast.net [73.243.234.23]:39840: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.126.37
country_id: 3703430
description:
2025-12-17 22:24:00 dovecot_login authenticator failed for (ADMIN) [91.90.126.37]:59566: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 44.202.231.158
country_id: 6252001
description:
Dec 17 22:24:25 host2 pure-ftpd[2422510]: (?@44.202.231.158) [INFO] New connection from 44.202.231.158


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.35.119.129
country_id: 3175395
description:
Dec 17 22:25:33 host2 sshd[2423523]: Disconnected from invalid user wikijs 151.35.119.129 port 22377 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.109.38.143
country_id: 6252001
description:
2025-12-17 22:28:44 dovecot_login authenticator failed for 143.38.109.208.host.secureserver.net [208.109.38.143]:57172: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2025-12-17 22:28:58 dovecot_login authenticator failed for ([185.134.179.106]) [185.101.16.250]:55195: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.35.119.129
country_id: 3175395
description:
Dec 17 22:29:15 host2 sshd[2425963]: Disconnected from invalid user bkp 151.35.119.129 port 22496 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 17 22:29:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<lDWBxShGMos+PIcg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.56.30.33
country_id: 1269750
description:
Dec 17 22:31:12 host2 sshd[2427728]: Disconnected from invalid user ts3 103.56.30.33 port 59510 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.56.30.33
country_id: 1269750
description:
Dec 17 22:36:33 host2 sshd[2431874]: Disconnected from invalid user stats 103.56.30.33 port 54314 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 17 22:36:47 host2 pure-ftpd[2432059]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.59.199
country_id: 798544
description:
2025-12-17 22:36:51 dovecot_login authenticator failed for (ADMIN) [138.199.59.199]:46388: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.145
country_id: 3017382
description:
Dec 17 22:37:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 17 secs): user=<>, rip=91.196.152.145, lip=66.85.158.91, TLS: Connection closed, session=<uu2j4ShGbeVbxJiR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.164
country_id: 3017382
description:
Dec 17 22:37:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.196.152.164, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<DwdA4ihGoetbxJik>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.149
country_id: 3017382
description:
Dec 17 22:37:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.149, lip=66.85.158.91, TLS: Connection closed, session=<81N64ihGYZVbxJiV>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.56.30.33
country_id: 1269750
description:
Dec 17 22:37:13 host2 sshd[2432324]: Disconnected from invalid user admin 103.56.30.33 port 56924 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.163
country_id: 3017382
description:
Dec 17 22:37:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=91.196.152.163, lip=66.85.158.91, TLS handshaking: Connection closed, session=<7+ih4ChGYYlbxJij>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.101.50
country_id: 1269750
description:
2025-12-17 22:38:16 dovecot_login authenticator failed for (nsg-corporate-50.101.185.122.airtel.in) [122.185.101.50]:55222: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.159.14.187
country_id: 3469034
description:
2025-12-17 22:38:35 dovecot_login authenticator failed for (200-168-190-81.jandaia.com) [200.159.14.187]:37548: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.56.30.33
country_id: 1269750
description:
Dec 17 22:38:38 host2 sshd[2433190]: Disconnected from invalid user myuser 103.56.30.33 port 43258 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.123.118
country_id: 1269750
description:
2025-12-17 22:40:38 dovecot_login authenticator failed for ([122.184.123.118]) [122.184.123.118]:41732: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.175.201.167
country_id: 3469034
description:
2025-12-17 22:40:55 dovecot_login authenticator failed for 200.175.201.167.dynamic.dialup.gvt.net.br (corporate.static.gvt.net.br) [200.175.201.167]:58710: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 17 22:41:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<6OoO7yhGGpk+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 17 22:44:14 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<FZkV+ShG9MI+PIcd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.102.9
country_id: 290557
description:
2025-12-17 22:46:39 dovecot_login authenticator failed for (ADMIN) [146.70.102.9]:65182: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec 17 22:46:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<T4XbAilG4Mg+PIds>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.206.51
country_id: 3144096
description:
2025-12-17 22:49:05 dovecot_login authenticator failed for (cm-178.232.206.51.get.no) [178.232.206.51]:40205: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.25.36.197
country_id: 294640
description:
2025-12-17 22:49:29 dovecot_login authenticator failed for ([37.25.36.197]) [37.25.36.197]:34936: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 22:51:41 host2 sshd[2444207]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.148.165.230
country_id: 6252001
description:
2025-12-17 22:53:47 dovecot_login authenticator failed for ([141.148.165.230]) [141.148.165.230]:43744: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-12-17 22:53:21 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:44804: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.28.57.98
country_id: 1643084
description:
Dec 17 22:54:48 host2 sshd[2446833]: Disconnected from invalid user dss 103.28.57.98 port 30945 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec 17 22:56:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<HmN4JClGDuo+PIdq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.28.57.98
country_id: 1643084
description:
Dec 17 22:57:07 host2 sshd[2449097]: Disconnected from invalid user dls 103.28.57.98 port 45465 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 22:58:53 host2 sshd[2450377]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.28.57.98
country_id: 1643084
description:
Dec 17 22:58:20 host2 sshd[2450042]: Disconnected from invalid user alex 103.28.57.98 port 57258 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.98.199.45
country_id: 1861060
description:
Dec 17 22:58:48 host2 sshd[2450333]: Disconnected from invalid user dev 58.98.199.45 port 59038 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.91.246.101
country_id: 1269750
description:
Dec 17 23:00:15 host2 sshd[2451443]: Disconnected from invalid user ftpuser 103.91.246.101 port 33012 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.239.247.135
country_id: 1562822
description:
2025-12-17 23:01:10 dovecot_login authenticator failed for (ADMIN) [173.239.247.135]:13686: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.104.184
country_id: 6252001
description:
Dec 17 23:02:57 host2 sshd[2453881]: Disconnected from invalid user sabina 107.150.104.184 port 45752 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.98.199.45
country_id: 1861060
description:
Dec 17 23:04:05 host2 sshd[2455405]: Disconnected from invalid user runner 58.98.199.45 port 47722 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.52.86
country_id: 6252001
description:
Dec 17 23:03:31 host2 sshd[2454764]: Disconnected from invalid user debianuser 107.174.52.86 port 41596 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 85.208.253.156
country_id: 130758
description:
Dec 17 23:03:49 host2 sshd[2455175]: Disconnected from invalid user vbox 85.208.253.156 port 39764 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.208.253.156
country_id: 130758
description:
Dec 17 23:04:22 host2 sshd[2455624]: Disconnected from invalid user alex 85.208.253.156 port 36542 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.224.109
country_id: 1880251
description:
Dec 17 23:06:33 host2 sshd[2457539]: Disconnected from invalid user dd 45.78.224.109 port 40566 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 184.105.139.67
country_id: 6252001
description:
Dec 17 23:06:54 host2 pure-ftpd[2457750]: (?@184.105.139.67) [INFO] New connection from 184.105.139.67


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 58.98.199.45
country_id: 1861060
description:
Dec 17 23:08:15 host2 sshd[2458615]: Disconnected from invalid user tauro 58.98.199.45 port 58922 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.104.184
country_id: 6252001
description:
Dec 17 23:08:31 host2 sshd[2458793]: Disconnected from invalid user ftpuser 107.150.104.184 port 60372 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.233.204.9
country_id: 3469034
description:
Dec 17 23:08:45 host2 sshd[2458928]: Disconnected from invalid user akash 186.233.204.9 port 48734 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.229.24
country_id: 3194884
description:
2025-12-17 23:08:49 dovecot_login authenticator failed for (ADMIN) [176.125.229.24]:12425: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.224.109
country_id: 1880251
description:
Dec 17 23:10:02 host2 sshd[2459742]: Disconnected from invalid user sftpuser 45.78.224.109 port 43092 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.233.204.9
country_id: 3469034
description:
Dec 17 23:10:04 host2 sshd[2459944]: Disconnected from invalid user sa 186.233.204.9 port 60250 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.233.204.9
country_id: 3469034
description:
Dec 17 23:09:24 host2 sshd[2459370]: Disconnected from invalid user bitrix 186.233.204.9 port 37232 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.98.199.45
country_id: 1861060
description:
Dec 17 23:09:40 host2 sshd[2459555]: Disconnected from invalid user test 58.98.199.45 port 55886 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.52.86
country_id: 6252001
description:
Dec 17 23:11:37 host2 sshd[2461142]: Disconnected from invalid user administrator 107.174.52.86 port 59356 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.73
country_id: 6252001
description:
Dec 17 23:14:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.73, lip=66.85.158.92, TLS handshaking: Connection closed, session=<8hauZClGQ39BMQFJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.66
country_id: 6252001
description:
Dec 17 23:14:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.66, lip=66.85.158.92, TLS handshaking: Connection closed, session=<t1jEZSlGJO5BMQFC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 128.203.203.233
country_id: 6251999
description:
Dec 17 23:14:58 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=128.203.203.233, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<X80uZylGeKaAy8vp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.233.204.9
country_id: 3469034
description:
Dec 17 23:14:12 host2 sshd[2463431]: Disconnected from invalid user gandalf 186.233.204.9 port 40502 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.101.50
country_id: 1269750
description:
2025-12-17 23:15:17 dovecot_login authenticator failed for (nsg-corporate-50.101.185.122.airtel.in) [122.185.101.50]:34790: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.174.52.86
country_id: 6252001
description:
Dec 17 23:15:18 host2 sshd[2464674]: Disconnected from invalid user sftpuser 107.174.52.86 port 56610 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.164.251.182
country_id: 6252001
description:
2025-12-17 23:15:41 dovecot_login authenticator failed for 216-164-251-182.s9140.c3-0.eas-cbr4.atw-eas.pa.cable.rcncustomer.com [216.164.251.182]:59974: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.224.109
country_id: 1880251
description:
Dec 17 23:23:31 host2 sshd[2470962]: Disconnected from invalid user debianuser 45.78.224.109 port 37950 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.152.220
country_id: 2658434
description:
2025-12-17 23:24:55 dovecot_login authenticator failed for (ADMIN) [158.173.152.220]:17287: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.92
country_id: 1733045
description:
2025-12-17 23:25:55 dovecot_login authenticator failed for ([49.125.201.92]) [49.125.201.92]:34046: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.97.74
country_id: 1269750
description:
2025-12-17 23:26:23 dovecot_login authenticator failed for ([182.79.70.81]) [27.123.97.74]:54532: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.113.168
country_id: 2960313
description:
2025-12-17 23:27:16 dovecot_login authenticator failed for (ADMIN) [37.46.113.168]:43824: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 17 23:27:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<hF9dlClG7IE+PIdm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 17 23:28:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<qhLhlilGSog+PIcg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.165.88.92
country_id: 6252001
description:
Dec 17 23:29:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=52.165.88.92, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<v62umilG1oU0pVhc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.233.92.123
country_id: 1269750
description:
2025-12-17 23:30:22 dovecot_login authenticator failed for ([103.233.92.123]) [103.233.92.123]:46360: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.215.1.201
country_id: 2635167
description:
2025-12-17 23:30:41 dovecot_login authenticator failed for ([88.215.1.201]) [88.215.1.201]:34942: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 17 23:39:15 host2 pure-ftpd[2482038]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.83.151.102
country_id: 6252001
description:
Dec 17 23:39:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=20.83.151.102, lip=66.85.158.91, session=<WN4avylGaNIUU5dm>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.242
country_id: 2635167
description:
Dec 17 23:39:49 host2 dovecot[1284858]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.242, lip=66.85.158.91, TLS, session=<SSgKwClGzc6594ny>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.213
country_id: 2635167
description:
Dec 17 23:39:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.213, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<rlEowClG/cxX7LDV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.104.9
country_id: 6252001
description:
Dec 17 23:39:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.64.104.9, lip=66.85.158.92, session=<7GigwClGWK8UQGgJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.86
country_id: 1269750
description:
2025-12-17 23:41:06 dovecot_login authenticator failed for ([122.184.127.86]) [122.184.127.86]:33076: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.186
country_id: 2635167
description:
Dec 17 23:40:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.186, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<slAmwilGbclX7LC6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.0.88
country_id: 3144096
description:
2025-12-17 23:40:27 dovecot_login authenticator failed for (cm-78.156.0.88.get.no) [78.156.0.88]:35013: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.186
country_id: 2635167
description:
Dec 17 23:40:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.186, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<tnofxClGyZa594m6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 17 23:41:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<CTexxSlG9pg+PIdj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.195
country_id: 2635167
description:
Dec 17 23:41:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.195, lip=66.85.158.91, TLS handshaking: Connection closed, session=<DJ4axilGBdC594nD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.204
country_id: 2635167
description:
Dec 17 23:42:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.204, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<ayAWyClGa72594nM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.200
country_id: 2635167
description:
Dec 17 23:43:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.200, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<VdsMzClGA75X7LDI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.214
country_id: 2635167
description:
Dec 17 23:42:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.214, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<K40PyilGd+FX7LDW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.189
country_id: 2635167
description:
Dec 17 23:43:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.189, lip=66.85.158.91, TLS handshaking: Connection closed, session=<XkkIzilGE5m594m9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.183
country_id: 2635167
description:
Dec 17 23:44:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.183, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<sL4B0ClGvYy594m3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.153.168
country_id: 6252001
description:
2025-12-17 23:44:19 dovecot_login authenticator failed for (ADMIN) [102.129.153.168]:12828: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.196
country_id: 2635167
description:
Dec 17 23:44:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.196, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<iTb90SlGC4O594nE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 17 23:45:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<ZWbA1ClG8rk+PIdj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec 17 23:46:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<xb0z2SlGzMU+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 17 23:48:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<paXx3ilGTrI+PIcf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.239.247.136
country_id: 1562822
description:
2025-12-17 23:50:02 dovecot_login authenticator failed for (ADMIN) [173.239.247.136]:12503: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 17 23:49:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<5KBd4ylGjug+PIde>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.125
country_id: 6252001
description:
Dec 17 23:53:04 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.125, lip=66.85.158.92, TLS: Connection closed, session=<M3Jl7ylG2ItChJl9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 17 23:53:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<w1yr7ylGds8+PIce>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.5
country_id: 6252001
description:
Dec 17 23:54:01 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=74.82.47.5, lip=66.85.158.91, TLS handshaking: Connection closed, session=<037K8ilG+FtKUi8F>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.80
country_id: 3144096
description:
2025-12-17 23:55:09 dovecot_login authenticator failed for (80-170-97-62.cust.smartcall.no) [62.97.170.80]:34509: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.5
country_id: 6252001
description:
Dec 17 23:54:22 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=74.82.47.5, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Ve4M9ClGIIVKUi8F>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.140.38.110
country_id: 1269750
description:
2025-12-17 23:54:38 dovecot_login authenticator failed for (202.140.38.110.convergentindia.com) [202.140.38.110]:52655: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 17 23:55:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<yIGf+SlGIJQ+PIcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.238.221.65
country_id: 3996063
description:
2025-12-17 23:58:05 dovecot_login authenticator failed for ([177.238.221.65]) [177.238.221.65]:34876: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2025-12-17 23:58:21 dovecot_login authenticator failed for ([103.168.241.32]) [103.168.241.32]:52148: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 18 00:03:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<KIHXEypG2No+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.214.125.153
country_id: 1694008
description:
2025-12-18 00:06:26 dovecot_login authenticator failed for (ADMIN) [188.214.125.153]:33114: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.8.37
country_id: 2661886
description:
2025-12-18 00:10:02 dovecot_login authenticator failed for (ADMIN) [46.246.8.37]:31274: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-12-18 00:10:01 dovecot_login authenticator failed for ([196.191.212.236]) [213.55.85.202]:3903: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.75.122.7
country_id: 927384
description:
2025-12-18 00:10:29 dovecot_login authenticator failed for ([41.75.122.7]) [41.75.122.7]:40050: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.146
country_id: 3017382
description:
Dec 18 00:11:14 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=91.231.89.146, lip=66.85.158.92, TLS handshaking: Connection closed, session=<EGVfMCpGO+xb51mS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.150
country_id: 3017382
description:
Dec 18 00:11:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.231.89.150, lip=66.85.158.92, TLS: Connection closed, session=<G1QDMSpGHdFb51mW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.234
country_id: 3017382
description:
Dec 18 00:11:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.231.89.234, lip=66.85.158.92, TLS: Connection closed, session=<ar0CMipGjdpb51nq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 18 00:14:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<KdCMPSpGoOg+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.205.108.94
country_id: 1269750
description:
2025-12-18 00:16:21 dovecot_plain authenticator failed for (CEJ5O) [49.205.108.94]:24176: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 18 00:17:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<wu9HRipGOoQ+PIce>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.110.238.50
country_id: 3469034
description:
Dec 18 00:22:10 host2 sshd[2516154]: Disconnected from invalid user debian 187.110.238.50 port 51130 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.110.238.50
country_id: 3469034
description:
Dec 18 00:23:08 host2 sshd[2516989]: Disconnected from invalid user gitea 187.110.238.50 port 37720 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.77.172.159
country_id: 3996063
description:
Dec 18 00:22:25 host2 sshd[2516356]: Disconnected from invalid user centos 200.77.172.159 port 42242 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.77.172.159
country_id: 3996063
description:
Dec 18 00:23:04 host2 sshd[2516939]: Disconnected from invalid user teamspeak 200.77.172.159 port 56344 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.77.172.159
country_id: 3996063
description:
Dec 18 00:23:40 host2 sshd[2517483]: Disconnected from invalid user usuario 200.77.172.159 port 42192 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 34.122.105.182
country_id: 6252001
description:
Dec 18 00:23:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=34.122.105.182, lip=66.85.158.91, TLS: Connection closed, session=<3uJYXSpGCJAiemm2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 18 00:24:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<EarLXypGlso+PIdj>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.110.238.50
country_id: 3469034
description:
Dec 18 00:24:26 host2 sshd[2518149]: Disconnected from invalid user git 187.110.238.50 port 33960 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 18 00:25:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<WbxsYypGqK4+PIde>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 18 00:28:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<SrxtbSpGuI0+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 18 00:28:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<ChEWbipGHsI+PIdm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.215.235.99
country_id: 1831722
description:
2025-12-18 00:29:43 dovecot_login authenticator failed for (ADMIN) [188.215.235.99]:20259: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.23.242.223
country_id: 953987
description:
2025-12-18 00:29:53 dovecot_login authenticator failed for ([102.23.242.223]) [102.23.242.223]:59741: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.21.17.225
country_id: 6252001
description:
2025-12-18 00:30:09 dovecot_login authenticator failed for h225.17.21.98.static.ip.windstream.net [98.21.17.225]:42352: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.196
country_id: 6252001
description:
Dec 18 00:32:51 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.247.196, lip=66.85.158.91, session=<I+S1fSpGiEm4affE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 18 00:34:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<44KzgipGhNU+PIdp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.228.5
country_id: 2589581
description:
2025-12-18 00:34:28 dovecot_login authenticator failed for (ADMIN) [176.125.228.5]:56071: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 18 00:39:03 host2 sshd[2531564]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 18 00:41:29 host2 pure-ftpd[2533075]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 18 00:42:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<PPamnypG6JE+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-18 00:44:49 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:57064: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 18 00:46:15 host2 sshd[2536594]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 18 00:45:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<p2xCrCpG9Ic+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.154.172.221
country_id: 732800
description:
2025-12-18 00:46:12 dovecot_login authenticator failed for riscodialac.nl (webmail.lezzarotech.com) [94.154.172.221]:48408: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 18 00:48:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<MbTzsypG1Og+PIMh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.50
country_id: 6252001
description:
Dec 18 00:48:59 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.50, lip=66.85.158.91, TLS: Connection closed, session=<TYpitypG6ESnXpIy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 18 00:49:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<VDXIuSpGMMQ+PIcd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.47.30.51
country_id: 953987
description:
2025-12-18 00:51:49 dovecot_login authenticator failed for (ADMIN) [154.47.30.51]:17423: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 18 00:51:51 host2 sshd[2540761]: Disconnected from invalid user earl 62.60.131.157 port 9090 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.59.18.36
country_id: 1269750
description:
2025-12-18 00:54:56 dovecot_plain authenticator failed for (AM2GM97U1Z7) [152.59.18.36]:58374: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.59.219
country_id: 798544
description:
2025-12-18 00:57:19 dovecot_login authenticator failed for (ADMIN) [138.199.59.219]:17609: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 18 00:57:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<gik31SpGuqg+PIMp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 18 00:58:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<D2BW2ipGaJU+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 18 01:02:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<xg4w5ypGrpA+PIcs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.5.11
country_id: 6252001
description:
Dec 18 01:04:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.79.5.11, lip=66.85.158.91, session=<2QJo7ipGQdstTwUL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.72.57.85
country_id: 3469034
description:
Dec 18 01:07:23 host2 sshd[2556087]: Disconnected from invalid user andres 187.72.57.85 port 39034 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.72.57.85
country_id: 3469034
description:
Dec 18 01:08:12 host2 sshd[2556574]: Disconnected from invalid user es2 187.72.57.85 port 45228 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 18 01:08:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<XF0z/ipGQO4+PIcl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.72.57.85
country_id: 3469034
description:
Dec 18 01:09:53 host2 sshd[2557635]: Disconnected from invalid user student 187.72.57.85 port 57619 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 18 01:10:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<Ne8hBCtGpLY+PIdf>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 23.180.120.244
country_id: 6252001
description:
Dec 18 01:10:42 host2 pure-ftpd[2558654]: (?@23.180.120.244) [INFO] New connection from 23.180.120.244


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 23.180.120.244
country_id: 6252001
description:
Dec 18 01:10:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=23.180.120.244, lip=66.85.158.91, session=<oaUYBStG5LUXtHj0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 18 01:16:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<3rXlFytGeKI+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.49.204
country_id: 2510769
description:
2025-12-18 01:16:05 dovecot_login authenticator failed for (ADMIN) [212.102.49.204]:62533: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.32.122.33
country_id: 597427
description:
2025-12-18 01:16:39 dovecot_login authenticator failed for (ADMIN) [194.32.122.33]:29488: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 18 01:18:10 host2 sshd[2563986]: Disconnected from invalid user user 2.57.121.25 port 38857 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.83
country_id: 6252001
description:
Dec 18 01:19:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.83, lip=66.85.158.91, session=<PVGzIytGAS1APsVT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.77
country_id: 6252001
description:
Dec 18 01:19:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.77, lip=66.85.158.91, TLS: Connection closed, session=<YlBnJCtGiMVAPsVN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.48
country_id: 6252001
description:
Dec 18 01:19:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.48, lip=66.85.158.91, TLS handshaking: Connection closed, session=<J+BKJStG0ytAPsUw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.47
country_id: 6252001
description:
Dec 18 01:20:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.47, lip=66.85.158.91, TLS handshaking: Connection closed, session=<W/xeJitGHCVAPsUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Dec 18 01:21:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<A5AYKytGELg+PIco>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.250.11
country_id: 1605651
description:
Dec 18 01:21:47 host2 sshd[2566764]: Disconnected from invalid user alex 118.194.250.11 port 59288 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.183.128.237
country_id: 1269750
description:
Dec 18 01:24:19 host2 sshd[2568573]: Disconnected from invalid user admin 52.183.128.237 port 51734 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.210.149.121
country_id: 953987
description:
Dec 18 01:24:36 host2 sshd[2568793]: Disconnected from invalid user deploy 102.210.149.121 port 57662 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.183.128.237
country_id: 1269750
description:
Dec 18 01:24:55 host2 sshd[2568994]: Disconnected from invalid user pre 52.183.128.237 port 36780 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.47.92.86
country_id: 1643084
description:
Dec 18 01:24:59 host2 sshd[2569044]: Disconnected from invalid user admin 38.47.92.86 port 40948 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 52.183.128.237
country_id: 1269750
description:
Dec 18 01:28:08 host2 sshd[2571782]: Disconnected from invalid user s 52.183.128.237 port 47704 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.47.92.86
country_id: 1643084
description:
Dec 18 01:29:58 host2 sshd[2573001]: Disconnected from invalid user pre 38.47.92.86 port 38728 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.157.177.161
country_id: 1733045
description:
Dec 18 01:30:26 host2 sshd[2573499]: Disconnected from invalid user jessie 202.157.177.161 port 49482 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.250.11
country_id: 1605651
description:
Dec 18 01:30:33 host2 sshd[2573576]: Disconnected from invalid user admin 118.194.250.11 port 50614 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.210.149.121
country_id: 953987
description:
Dec 18 01:30:52 host2 sshd[2573900]: Disconnected from invalid user admin 102.210.149.121 port 39630 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.194.250.11
country_id: 1605651
description:
Dec 18 01:31:02 host2 sshd[2574017]: Disconnected from invalid user peter 118.194.250.11 port 59282 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.157.177.161
country_id: 1733045
description:
Dec 18 01:31:47 host2 sshd[2574565]: Disconnected from invalid user support 202.157.177.161 port 48632 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.183.128.237
country_id: 1269750
description:
Dec 18 01:31:54 host2 sshd[2574642]: Disconnected from invalid user peter 52.183.128.237 port 42740 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.210.149.121
country_id: 953987
description:
Dec 18 01:31:34 host2 sshd[2574380]: Disconnected from invalid user ubuntu 102.210.149.121 port 53314 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.183.128.237
country_id: 1269750
description:
Dec 18 01:33:11 host2 sshd[2575706]: Disconnected from invalid user vpn 52.183.128.237 port 41090 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.157.177.161
country_id: 1733045
description:
Dec 18 01:32:28 host2 sshd[2575071]: Disconnected from invalid user anes 202.157.177.161 port 34094 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.39.127
country_id: 1819730
description:
Dec 18 01:32:58 host2 sshd[2575509]: Disconnected from invalid user deploy 118.193.39.127 port 51508 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.127.181.65
country_id: 390903
description:
2025-12-18 01:34:13 dovecot_login authenticator failed for (ADMIN) [79.127.181.65]:64728: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.240.75
country_id: 2661886
description:
2025-12-18 01:34:35 dovecot_login authenticator failed for ([188.126.240.75]) [188.126.240.75]:56564: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.239.160.3
country_id: 3996063
description:
2025-12-18 01:34:52 dovecot_login authenticator failed for ([177.239.160.3]) [177.239.160.3]:45501: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.241.80.67
country_id: 1814991
description:
2025-12-18 01:38:17 dovecot_login authenticator failed for (ADMIN) [188.241.80.67]:26748: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.202
country_id: 6252001
description:
Dec 18 01:39:23 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.202, lip=66.85.158.91, session=<4w6oaytGSOvN0h/K>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 18 01:43:21 host2 pure-ftpd[2583464]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 18 01:43:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<GfT2eitGUt0+PIdp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 18 01:44:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<ETInfytGMqM+PIdp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.103
country_id: 130758
description:
Dec 18 01:45:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.103, lip=66.85.158.91, session=</yoUgytG4qI+PIdn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.119
country_id: 6252001
description:
Dec 18 01:50:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.119, lip=66.85.158.92, TLS: Connection closed, session=<6ykWlStGzIpChJl3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 18 01:53:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<CAhBnitGjNA+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 18 01:54:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<Rq1ZoitGmLw+PIcf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.46.135
country_id: 2635167
description:
Dec 18 01:54:54 host2 sshd[2592527]: Disconnected from invalid user simone 68.183.46.135 port 50550 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 18 01:55:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<gqmnoytGyKc+PIMh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.46.135
country_id: 2635167
description:
Dec 18 02:00:09 host2 sshd[2596243]: Disconnected from invalid user marvin 68.183.46.135 port 34196 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.215.182.113
country_id: 6252001
description:
2025-12-18 02:01:04 dovecot_login authenticator failed for (ADMIN) [181.215.182.113]:22151: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.183.46.135
country_id: 2635167
description:
Dec 18 02:00:40 host2 sshd[2596599]: Disconnected from invalid user db 68.183.46.135 port 53472 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.74
country_id: 6252001
description:
Dec 18 02:02:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.74, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<gpODvStGx9vN0h9K>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.46.135
country_id: 2635167
description:
Dec 18 02:01:38 host2 sshd[2597402]: Disconnected from invalid user toto 68.183.46.135 port 59456 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.127.181.26
country_id: 390903
description:
2025-12-18 02:05:30 dovecot_login authenticator failed for (ADMIN) [79.127.181.26]:49460: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.254.244.66
country_id: 1733045
description:
Dec 18 02:07:06 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 3 secs): user=<>, rip=47.254.244.66, lip=66.85.158.91, session=<ZOvAzitGnJwv/vRC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.94.20.119
country_id: 3469034
description:
Dec 18 02:08:21 host2 sshd[2602427]: Disconnected from invalid user james 187.94.20.119 port 48108 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.94.20.119
country_id: 3469034
description:
Dec 18 02:09:50 host2 sshd[2603321]: Disconnected from invalid user postgres 187.94.20.119 port 43934 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.94.20.119
country_id: 3469034
description:
Dec 18 02:10:40 host2 sshd[2604013]: Disconnected from invalid user user 187.94.20.119 port 55810 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.94.20.119
country_id: 3469034
description:
Dec 18 02:11:35 host2 sshd[2604772]: Disconnected from invalid user ftptest2 187.94.20.119 port 39454 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 18 02:11:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<S8jQ3itG2pw+PIdm>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.169.200.254
country_id: 3469034
description:
Dec 18 02:14:52 host2 sshd[2606859]: Disconnected from invalid user user 45.169.200.254 port 35232 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.169.200.254
country_id: 3469034
description:
Dec 18 02:15:34 host2 sshd[2607454]: Disconnected from invalid user admin 45.169.200.254 port 49010 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 18 02:16:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<96xy8CtGrLE+PIcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.210.94.61
country_id: 294640
description:
2025-12-18 02:19:09 dovecot_login authenticator failed for ([46.210.94.61]) [46.210.94.61]:38514: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.166.123
country_id: 1605651
description:
2025-12-18 02:18:29 dovecot_login authenticator failed for ([106.0.166.123]) [106.0.166.123]:45809: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.59.34
country_id: 2264397
description:
2025-12-18 02:19:34 dovecot_login authenticator failed for (ADMIN) [146.70.59.34]:22641: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 18 02:21:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<YXKrASxGPs4+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 18 02:23:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<PGSpByxGRKo+PIcg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.133.172.238
country_id: 2635167
description:
2025-12-18 02:23:24 dovecot_login authenticator failed for (ADMIN) [45.133.172.238]:35219: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.203.129
country_id: 2542007
description:
2025-12-18 02:24:30 dovecot_plain authenticator failed for (arbiveress) [105.73.203.129]:36647: 535 Incorrect authentication data (set_id=v-deploy@v-deploy.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 18 02:26:07 host2 sshd[2614801]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.60
country_id: 6252001
description:
Dec 18 02:27:51 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.60, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<O5D7GCxGr8vG6xg8>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 18 02:33:17 host2 sshd[2619370]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 18 02:33:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<ySidLixG4Ns+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 18 02:38:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<NxVZPixG6p8+PIMh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 18 02:38:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<n6jyPixGWI4+PIcf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.133.172.209
country_id: 2635167
description:
2025-12-18 02:39:36 dovecot_login authenticator failed for (ADMIN) [45.133.172.209]:44013: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 118.193.35.202
country_id: 1819730
description:
Dec 18 02:40:44 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=118.193.35.202, lip=66.85.158.91, session=<p7gJRyxGNrZ2wSPK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 18 02:44:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<49asUyxGaoE+PIcf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 118.193.35.202
country_id: 1819730
description:
Dec 18 02:44:21 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=118.193.35.202, lip=66.85.158.92, session=<6aT8UyxGfNt2wSPK>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 18 02:44:43 host2 pure-ftpd[2628434]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.133.193.46
country_id: 2629691
description:
2025-12-18 02:44:51 dovecot_login authenticator failed for (ADMIN) [45.133.193.46]:6527: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 18 02:52:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<4P4zcixGXsA+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 18 02:52:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<+l9rcixGLrY+PIcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2025-12-18 02:53:19 dovecot_login authenticator failed for (138.219.244.10.static.softdados.net) [177.128.209.48]:38560: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.28.86.1
country_id: 1819730
description:
2025-12-18 02:53:52 dovecot_login authenticator failed for (113-28-86-1.static.imsbiz.com) [113.28.86.1]:63313: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 18 02:54:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<rxGCdyxGdpw+PIdg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 18 02:54:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<pNPidyxGft0+PIdp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.199.126
country_id: 1269750
description:
2025-12-18 02:55:03 dovecot_login authenticator failed for ([152.52.199.126]) [152.52.199.126]:43870: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.206
country_id: 1269750
description:
2025-12-18 02:55:30 dovecot_login authenticator failed for ([125.21.145.49]) [182.95.52.206]:49256: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2025-12-18 02:56:22 dovecot_login authenticator failed for (nsg-corporate-126.176.185.122.airtel.in) [122.185.176.126]:55688: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.107.116.210
country_id: 798544
description:
2025-12-18 02:56:39 dovecot_login authenticator failed for (host-176.107.116-210.dynamic.mm.pl) [176.107.116.210]:58663: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 18 02:57:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<r8NNgixG+qk+PIde>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.159.234.9
country_id: 2635167
description:
2025-12-18 02:59:47 dovecot_login authenticator failed for (ADMIN) [98.159.234.9]:6403: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 18 03:00:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<uMSJjCxGwKM+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.159.234.45
country_id: 2635167
description:
2025-12-18 03:04:01 dovecot_login authenticator failed for (ADMIN) [98.159.234.45]:13788: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.224
country_id: 6252001
description:
Dec 18 03:04:20 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.224, lip=66.85.158.91, session=<T/ZpmyxGHO6s7OTg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 18 03:12:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<3iDitixGBOY+PIM0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.49.50.6
country_id: 3686110
description:
Dec 18 03:15:19 host2 sshd[2650352]: Disconnected from invalid user dattesh 181.49.50.6 port 52576 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.49.50.6
country_id: 3686110
description:
Dec 18 03:16:04 host2 sshd[2650698]: Disconnected from invalid user guestguest 181.49.50.6 port 37948 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.49.50.6
country_id: 3686110
description:
Dec 18 03:16:41 host2 sshd[2650969]: Disconnected from invalid user server 181.49.50.6 port 50528 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.124.46
country_id: 3042225
description:
2025-12-18 03:20:48 dovecot_login authenticator failed for (ADMIN) [91.90.124.46]:37067: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.103
country_id: 130758
description:
Dec 18 03:24:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.103, lip=66.85.158.91, session=<APnI4SxGuKk+PIdn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.104
country_id: 6252001
description:
Dec 18 03:24:18 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.104, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<bHzS4ixGl9/G6xho>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.94.190.197
country_id: 719819
description:
2025-12-18 03:28:32 dovecot_login authenticator failed for (ADMIN) [185.94.190.197]:52839: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 18 03:31:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<KtHo/CxGwow+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec 18 03:31:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<XSZL/SxG/Io+PIdr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 18 03:38:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<EAydFi1GisE+PIcg>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.189.235.176
country_id: 1643084
description:
Dec 18 03:41:53 host2 sshd[2666071]: Disconnected from invalid user ubuntu 103.189.235.176 port 37882 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.215.235.104
country_id: 1831722
description:
2025-12-18 03:42:57 dovecot_login authenticator failed for (ADMIN) [188.215.235.104]:49595: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 18 03:46:29 host2 pure-ftpd[2670447]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.67.111
country_id: 6252001
description:
2025-12-18 03:47:43 dovecot_login authenticator failed for (ADMIN) [191.96.67.111]:64388: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.88
country_id: 99237
description:
2025-12-18 03:48:53 dovecot_login authenticator failed for ([65.20.204.88]) [65.20.204.88]:53910: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.240.75
country_id: 2661886
description:
2025-12-18 03:49:07 dovecot_login authenticator failed for ([188.126.240.75]) [188.126.240.75]:43620: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.217.204.91
country_id: 2658434
description:
2025-12-18 03:49:47 dovecot_login authenticator failed for adsl-89-217-204-91.adslplus.ch [89.217.204.91]:46416: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 18 03:49:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<QpQYPi1GrJLBHmEh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-12-18 03:50:04 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:54296: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 18 03:53:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<yzsKSy1GSKE+PIde>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 18 03:53:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<arwmSy1Gmps+PIMp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 18 03:53:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<Cg6nTC1GCq0+PIdp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.221.194
country_id: 3144096
description:
2025-12-18 03:55:11 dovecot_login authenticator failed for ([178.232.221.194]) [178.232.221.194]:57424: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.109.13.50
country_id: 1269750
description:
2025-12-18 03:54:51 dovecot_login authenticator failed for ([103.109.13.50]) [103.109.13.50]:34704: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 18 03:55:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<BLy8Ui1GsN0+PIcd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.56.49.111
country_id: 6251999
description:
2025-12-18 04:03:22 dovecot_login authenticator failed for (ADMIN) [212.56.49.111]:16049: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.186
country_id: 2186224
description:
2025-12-18 04:03:54 dovecot_login authenticator failed for ([121.73.163.186]) [121.73.163.186]:54424: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.116.162.215
country_id: 6251999
description:
2025-12-18 04:04:12 dovecot_login authenticator failed for ([206.116.162.215]) [206.116.162.215]:37800: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.213.7.87
country_id: 6252001
description:
2025-12-18 04:05:28 dovecot_login authenticator failed for 87.sub-97-213-7.myvzw.com [97.213.7.87]:43516: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 18 04:09:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<yTWfgi1Gkto+PIcf>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 18 04:12:18 host2 sshd[2690416]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 18 04:15:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<XpdPmS1GPrQ+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.37.151
country_id: 6252001
description:
2025-12-18 04:17:25 dovecot_login authenticator failed for (ADMIN) [191.96.37.151]:45880: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.158.146.24
country_id: 2750405
description:
Dec 18 04:19:10 host2 sshd[2695836]: Disconnected from invalid user admin 51.158.146.24 port 35442 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 18 04:19:23 host2 sshd[2696021]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.158.146.24
country_id: 2750405
description:
Dec 18 04:20:59 host2 sshd[2697981]: Disconnected from invalid user koha 51.158.146.24 port 59326 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.128.40
country_id: 2635167
description:
Dec 18 04:21:30 host2 sshd[2698612]: Disconnected from invalid user user 167.71.128.40 port 39972 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.90.225.61
country_id: 2921044
description:
Dec 18 04:21:41 host2 sshd[2698751]: Disconnected from invalid user supervisor 164.90.225.61 port 53200 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 164.90.225.61
country_id: 2921044
description:
Dec 18 04:22:38 host2 sshd[2699586]: Disconnected from invalid user admin 164.90.225.61 port 38118 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 18 04:23:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<Hbf9tS1GcJA+PIdm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.128.40
country_id: 2635167
description:
Dec 18 04:22:29 host2 sshd[2699395]: Disconnected from invalid user admin 167.71.128.40 port 45126 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.128.40
country_id: 2635167
description:
Dec 18 04:23:55 host2 sshd[2700889]: Disconnected from invalid user centos 167.71.128.40 port 59220 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 18 04:25:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<4OatvS1GEMk+PIcd>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 18 04:28:32 host2 sshd[2706213]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 18 04:28:53 host2 sshd[2706711]: Disconnected from invalid user cielo 62.60.131.157 port 64510 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 18 04:29:23 host2 sshd[2707313]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-18 04:30:02 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:53406: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.81
country_id: 6252001
description:
Dec 18 04:30:26 host2 pure-ftpd[2708752]: (?@147.185.132.81) [INFO] New connection from 147.185.132.81


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.183
country_id: 6252001
description:
Dec 18 04:31:49 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.183, lip=66.85.158.92, TLS, session=<Ma9S1C1GJPvG6xi3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.143.192
country_id: 1880251
description:
Dec 18 04:31:56 host2 sshd[2710216]: Disconnected from invalid user aaa 101.47.143.192 port 40064 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.189.29.175
country_id: 2960313
description:
Dec 18 04:35:59 host2 sshd[2714447]: Disconnected from invalid user alex 107.189.29.175 port 41120 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.78
country_id: 1269750
description:
2025-12-18 04:37:12 dovecot_login authenticator failed for (nsg-corporate-186.152.185.122.airtel.in) [182.95.178.78]:51684: 535 Incorrect authentication data (set_id=bostonlanka)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.94.39.65
country_id: 1269750
description:
2025-12-18 04:36:52 dovecot_login authenticator failed for ([59.94.39.65]) [59.94.39.65]:55710: 535 Incorrect authentication data (set_id=bostonlanka@bostonlanka.com)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 107.189.29.175
country_id: 2960313
description:
Dec 18 04:37:41 host2 sshd[2716066]: Received disconnect from 107.189.29.175 port 48056:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.189.29.175
country_id: 2960313
description:
Dec 18 04:39:18 host2 sshd[2717748]: Disconnected from invalid user ping 107.189.29.175 port 54992 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.232.31
country_id: 2542007
description:
2025-12-18 04:40:52 dovecot_login authenticator failed for (ADMIN) [95.181.232.31]:50893: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.207
country_id: 2635167
description:
Dec 18 04:46:01 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=35.203.211.207, lip=66.85.158.92, session=<hFYPBy5G1Pcjy9PP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.56.53.31
country_id: 6252001
description:
2025-12-18 04:47:05 dovecot_login authenticator failed for (ADMIN) [212.56.53.31]:42586: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 18 04:48:24 host2 pure-ftpd[2727200]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.143.192
country_id: 1880251
description:
Dec 18 04:50:13 host2 sshd[2729028]: Disconnected from invalid user bg 101.47.143.192 port 55540 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 18 04:50:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<0HiuFy5GeKk+PIdm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 18 04:53:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<t9PQIS5GWtI+PIMp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 18 04:56:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<H37dKi5GAOE+PIcg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.42
country_id: 1269750
description:
2025-12-18 05:00:46 dovecot_login authenticator failed for ([27.123.104.42]) [27.123.104.42]:45620: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.97.77.182
country_id: 1269750
description:
2025-12-18 05:01:16 dovecot_login authenticator failed for ([14.97.77.182]) [14.97.77.182]:37738: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.61.240.34
country_id: 2186224
description:
2025-12-18 05:03:49 dovecot_login authenticator failed for (ADMIN) [179.61.240.34]:53436: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.59
country_id: 6252001
description:
Dec 18 05:07:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.59, lip=66.85.158.91, TLS: Connection closed, session=<532CVS5GgOqnXpI7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.236.13
country_id: 614540
description:
2025-12-18 05:11:28 dovecot_login authenticator failed for (ADMIN) [95.181.236.13]:45713: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 18 05:10:28 host2 sshd[2746865]: Disconnected from invalid user admin 2.57.121.112 port 54850 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-12-18 05:12:08 dovecot_login authenticator failed for ([178.250.191.189]) [178.250.191.189]:60202: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.150
country_id: 6252001
description:
Dec 18 05:11:36 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.150, lip=66.85.158.91, TLS handshaking: Connection closed, session=<S4KPYi5G0+vDuEyW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.85
country_id: 6252001
description:
Dec 18 05:11:46 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=195.184.76.85, lip=66.85.158.91, TLS: Connection closed, session=<EjAsYy5GTbHDuExV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.217.204.91
country_id: 2658434
description:
2025-12-18 05:11:51 dovecot_login authenticator failed for adsl-89-217-204-91.adslplus.ch [89.217.204.91]:54538: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.81
country_id: 6252001
description:
Dec 18 05:12:01 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=195.184.76.81, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<9T0JZC5Gk+jDuExR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 18 05:15:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<QxoFcC5GOsw+PIMp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.180
country_id: 6252001
description:
Dec 18 05:18:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.180, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ycwMei5GSNWTuYS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 18 05:20:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<YAlygi5G/OU+PIMh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.74
country_id: 1269750
description:
2025-12-18 05:25:33 dovecot_login authenticator failed for ([152.52.92.105]) [152.52.192.74]:42850: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.105.219
country_id: 1269750
description:
2025-12-18 05:25:50 dovecot_login authenticator failed for (abts-mum-static-219.105.170.122.airtelbroadband.in) [122.170.105.219]:43884: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 18 05:27:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<yPjMmi5G5Nw+PIcm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.242
country_id: 3996063
description:
2025-12-18 05:29:16 dovecot_login authenticator failed for ([177.236.146.242]) [177.236.146.242]:49043: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2025-12-18 05:29:41 dovecot_login authenticator failed for ([210.177.143.61]) [210.177.143.61]:37550: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 18 05:29:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<tQLtoy5GCsw+PIcm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.84
country_id: 6252001
description:
Dec 18 05:31:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.84, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<yjanqS5Gis/G6xhU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 18 05:34:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<QNgNsy5GyOw+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 18 05:33:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<Zno1sC5G+MY+PIM0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.245.97.82
country_id: 1880251
description:
Dec 18 05:38:58 host2 sshd[2766337]: Disconnected from invalid user amal 43.245.97.82 port 42972 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.245.97.82
country_id: 1880251
description:
Dec 18 05:41:01 host2 sshd[2767648]: Disconnected from invalid user vboxuser 43.245.97.82 port 49148 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.245.97.82
country_id: 1880251
description:
Dec 18 05:40:24 host2 sshd[2767388]: Disconnected from invalid user subhana 43.245.97.82 port 37456 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.154.166.19
country_id: 2921044
description:
[2025-12-18 05:40:45 +0530] info [webmaild] 217.154.166.19 - info@idesignvector.com@host2.phenomhost.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid user name specified


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec 18 05:40:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<mv9yyy5GLL4+PIds>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.245.97.82
country_id: 1880251
description:
Dec 18 05:41:37 host2 sshd[2768073]: Disconnected from invalid user merlin 43.245.97.82 port 60832 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Dec 18 05:42:36 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<DZZX0S5G5s8+PIco>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.47.10.72
country_id: 3469034
description:
Dec 18 05:42:58 host2 sshd[2768673]: Disconnected from invalid user admin1 189.47.10.72 port 56002 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.209.225.104
country_id: 2921044
description:
Dec 18 05:43:20 host2 sshd[2768872]: Disconnected from invalid user server 134.209.225.104 port 38358 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 18 05:43:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<ny8p1i5GLNI+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.238.120
country_id: 6252001
description:
2025-12-18 05:46:39 dovecot_login authenticator failed for (ADMIN) [95.181.238.120]:60054: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.205.128
country_id: 1880251
description:
Dec 18 05:46:59 host2 sshd[2771709]: Disconnected from invalid user production 165.154.205.128 port 49068 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.117.56.152
country_id: 1643084
description:
Dec 18 05:47:07 host2 sshd[2771788]: Disconnected from invalid user dashboard 103.117.56.152 port 59038 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 18 05:46:10 host2 sshd[2770887]: Disconnected from invalid user magdalena 62.60.131.157 port 15136 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.137
country_id: 6252001
description:
Dec 18 05:48:45 host2 pure-ftpd[2772716]: (?@66.132.153.137) [INFO] New connection from 66.132.153.137


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.117.56.152
country_id: 1643084
description:
Dec 18 05:49:06 host2 sshd[2772919]: Disconnected from invalid user angel 103.117.56.152 port 52160 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.205.128
country_id: 1880251
description:
Dec 18 05:48:28 host2 sshd[2772508]: Disconnected from invalid user rolando 165.154.205.128 port 50870 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.117.56.152
country_id: 1643084
description:
Dec 18 05:48:29 host2 sshd[2772521]: Disconnected from invalid user joe 103.117.56.152 port 52546 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.205.128
country_id: 1880251
description:
Dec 18 05:49:10 host2 sshd[2772952]: Disconnected from invalid user tes 165.154.205.128 port 55538 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 18 05:50:27 host2 pure-ftpd[2773928]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.205.128
country_id: 1880251
description:
Dec 18 05:51:06 host2 sshd[2774363]: Disconnected from invalid user vbox 165.154.205.128 port 45764 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.209.225.104
country_id: 2921044
description:
Dec 18 05:51:53 host2 sshd[2774866]: Disconnected from invalid user pq 134.209.225.104 port 40870 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.209.225.104
country_id: 2921044
description:
Dec 18 05:52:23 host2 sshd[2775216]: Disconnected from invalid user production 134.209.225.104 port 51882 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec 18 05:53:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<be7N+C5GNrg+PIdq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 18 05:55:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<lL2d/y5GHsE+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 18 05:56:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=</hnwAi9GDtg+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 18 05:59:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<yWR3DC9GwuQ+PIM0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.47.10.72
country_id: 3469034
description:
Dec 18 06:02:59 host2 sshd[2781814]: Disconnected from invalid user nexus 189.47.10.72 port 59980 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.63
country_id: 99237
description:
2025-12-18 06:03:06 dovecot_login authenticator failed for ([65.20.174.63]) [65.20.174.63]:33769: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.223.176.171
country_id: 6252001
description:
2025-12-18 06:03:23 dovecot_login authenticator failed for ([50.223.176.171]) [50.223.176.171]:47936: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.47.10.72
country_id: 3469034
description:
Dec 18 06:03:52 host2 sshd[2782682]: Disconnected from invalid user user3 189.47.10.72 port 40250 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.47.10.72
country_id: 3469034
description:
Dec 18 06:06:14 host2 sshd[2784455]: Disconnected from invalid user anaconda 189.47.10.72 port 60092 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 18 06:06:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<QaFvKC9GHsQ+PIdj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.98
country_id: 130758
description:
Dec 18 06:10:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.98, lip=66.85.158.91, session=<3MkQNC9GyMs+PIdi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.61
country_id: 6252001
description:
Dec 18 06:10:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.61, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<injMNC9G19CTuYQ9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.122.112
country_id: 3144096
description:
2025-12-18 06:13:48 dovecot_login authenticator failed for (ADMIN) [46.246.122.112]:36527: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec 18 06:16:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<NwVvSS9GEK0+PIdo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.49.67
country_id: 1668284
description:
2025-12-18 06:19:05 dovecot_login authenticator failed for (ADMIN) [173.244.49.67]:40134: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 18 06:19:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<mQUsVC9GRt8+PIcm>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.193
country_id: 2635167
description:
Dec 18 06:20:55 host2 dovecot[1284858]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.193, lip=66.85.158.91, TLS, session=<yQJ2Wi9G48VX7LDB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec 18 06:21:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<MSaeXC9GkOw+PIdo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Dec 18 06:22:00 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<KFhXXi9GvLqLonQW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2025-12-18 06:26:50 dovecot_plain authenticator failed for (adigatte) [154.146.240.123]:40420: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 13.89.125.225
country_id: 6252001
description:
Dec 18 06:29:11 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=13.89.125.225, lip=66.85.158.91, session=<R/IKeC9G2MENWX3h>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.5.145.8
country_id: 2464461
description:
Dec 18 06:30:09 host2 sshd[2802757]: Disconnected from invalid user george 197.5.145.8 port 57970 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.5.145.8
country_id: 2464461
description:
Dec 18 06:32:18 host2 sshd[2804995]: Disconnected from invalid user sinusbot1 197.5.145.8 port 49718 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.5.145.8
country_id: 2464461
description:
Dec 18 06:32:46 host2 sshd[2805392]: Disconnected from invalid user nvidia 197.5.145.8 port 60522 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 18 06:35:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<PrmyjS9G6LU+PIde>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 18 06:38:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<o6NNmi9Gxog+PIcl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 18 06:39:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<X0hKmy9G7rw+PIcd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.31.38
country_id: 3017382
description:
2025-12-18 06:40:38 dovecot_login authenticator failed for (ADMIN) [191.101.31.38]:36305: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.98
country_id: 130758
description:
Dec 18 06:40:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.98, lip=66.85.158.91, session=<W2zQoC9G/us+PIdi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.247
country_id: 1269750
description:
2025-12-18 06:40:52 dovecot_login authenticator failed for (nsg-corporate-247.228.187.122.airtel.in) [122.187.228.247]:34411: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.202
country_id: 1149361
description:
2025-12-18 06:41:14 dovecot_login authenticator failed for ([180.94.75.202]) [180.94.75.202]:51729: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 18 06:41:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<N4j5oy9GKNY+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.239.84.78
country_id: 2635167
description:
2025-12-18 06:45:14 dovecot_login authenticator failed for (ADMIN) [193.239.84.78]:58847: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.213.197.49
country_id: 1605651
description:
Dec 18 06:45:26 host2 sshd[2813417]: Disconnected from invalid user mario 8.213.197.49 port 54848 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.136.43.74
country_id: 2017370
description:
Dec 18 06:48:05 host2 sshd[2814916]: Disconnected from invalid user tin 103.136.43.74 port 57174 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.82.111.18
country_id: 1880251
description:
Dec 18 06:48:20 host2 sshd[2815054]: Disconnected from invalid user admin 154.82.111.18 port 54536 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.207.125
country_id: 1643084
description:
Dec 18 06:48:47 host2 sshd[2815304]: Disconnected from invalid user admin 103.13.207.125 port 47916 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.136.43.74
country_id: 2017370
description:
Dec 18 06:49:12 host2 sshd[2815579]: Disconnected from invalid user teamspeak 103.136.43.74 port 39264 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.190.7.203
country_id: 1269750
description:
Dec 18 06:49:30 host2 sshd[2815701]: Disconnected from invalid user ansible 103.190.7.203 port 49784 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.193.240.246
country_id: 718075
description:
Dec 18 06:49:35 host2 sshd[2815754]: Disconnected from invalid user mario 185.193.240.246 port 35080 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 18 06:51:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<hdsuxi9Gnuc+PIdf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.13.207.125
country_id: 1643084
description:
Dec 18 06:51:07 host2 sshd[2816858]: Disconnected from invalid user posiflex 103.13.207.125 port 44938 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 18 06:50:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<hrjtwy9GKKg+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 18 06:50:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<d7K6xS9GEJI+PIM0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.207.125
country_id: 1643084
description:
Dec 18 06:51:50 host2 sshd[2817356]: Disconnected from invalid user appltest 103.13.207.125 port 34104 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.193.240.246
country_id: 718075
description:
Dec 18 06:51:13 host2 sshd[2816908]: Disconnected from invalid user nasrin 185.193.240.246 port 43376 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 18 06:52:37 host2 pure-ftpd[2817715]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.136.43.74
country_id: 2017370
description:
Dec 18 06:52:58 host2 sshd[2817854]: Disconnected from invalid user admin 103.136.43.74 port 39520 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.190.7.203
country_id: 1269750
description:
Dec 18 06:53:08 host2 sshd[2817980]: Disconnected from invalid user dev 103.190.7.203 port 55596 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.193.240.246
country_id: 718075
description:
Dec 18 06:52:17 host2 sshd[2817565]: Disconnected from invalid user wm 185.193.240.246 port 39480 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 103.136.43.74
country_id: 2017370
description:
Dec 18 06:52:58 host2 sshd[2817854]: Received disconnect from 103.136.43.74 port 39520:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.174.72.225
country_id: 6252001
description:
Dec 18 06:54:08 host2 sshd[2818679]: Disconnected from invalid user mike 172.174.72.225 port 52160 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.136.43.74
country_id: 2017370
description:
Dec 18 06:53:32 host2 sshd[2818166]: Disconnected from invalid user posiflex 103.136.43.74 port 34630 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.175.224.118
country_id: 6252001
description:
Dec 18 06:54:19 host2 sshd[2819005]: Disconnected from invalid user test1 107.175.224.118 port 40322 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.174.72.225
country_id: 6252001
description:
Dec 18 06:54:43 host2 sshd[2819195]: Disconnected from invalid user git2 172.174.72.225 port 37950 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.224.118
country_id: 6252001
description:
Dec 18 06:55:30 host2 sshd[2819809]: Disconnected from invalid user sammy 107.175.224.118 port 40658 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.154.125.60
country_id: 6251999
description:
Dec 18 06:55:53 host2 sshd[2820020]: Disconnected from invalid user antonio 66.154.125.60 port 49854 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.174.72.225
country_id: 6252001
description:
Dec 18 06:55:55 host2 sshd[2820034]: Disconnected from invalid user wanda 172.174.72.225 port 37766 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 66.154.125.60
country_id: 6251999
description:
Dec 18 06:56:59 host2 sshd[2820637]: Disconnected from invalid user kim 66.154.125.60 port 50004 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.38.101.56
country_id: 130758
description:
Dec 18 06:56:21 host2 sshd[2820282]: Disconnected from invalid user idc 95.38.101.56 port 39124 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.154.125.60
country_id: 6251999
description:
Dec 18 06:56:27 host2 sshd[2820319]: Disconnected from invalid user christian 66.154.125.60 port 49928 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.147.35
country_id: 1643084
description:
Dec 18 06:56:45 host2 sshd[2820527]: Disconnected from invalid user suman 103.187.147.35 port 49296 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.224.118
country_id: 6252001
description:
Dec 18 06:57:17 host2 sshd[2820816]: Disconnected from invalid user test 107.175.224.118 port 55272 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.147.35
country_id: 1643084
description:
Dec 18 06:57:26 host2 sshd[2820871]: Disconnected from invalid user bot 103.187.147.35 port 51824 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.187.147.35
country_id: 1643084
description:
Dec 18 06:58:42 host2 sshd[2821777]: Disconnected from invalid user update 103.187.147.35 port 58518 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.170
country_id: 1643084
description:
Dec 18 06:58:51 host2 sshd[2821903]: Disconnected from invalid user david 27.112.78.170 port 48150 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.174.72.225
country_id: 6252001
description:
Dec 18 06:58:59 host2 sshd[2821993]: Disconnected from invalid user sammy 172.174.72.225 port 51460 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 137.184.202.107
country_id: 6252001
description:
Dec 18 07:00:02 host2 sshd[2822687]: Disconnected from invalid user sftpuser 137.184.202.107 port 45948 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.170
country_id: 1643084
description:
Dec 18 06:59:42 host2 sshd[2822402]: Disconnected from invalid user user3 27.112.78.170 port 38030 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.8.115
country_id: 3175395
description:
Dec 18 07:00:10 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=185.197.8.115, lip=66.85.158.91, TLS, session=<SunO5S9GGYC5xQhz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.86
country_id: 3865483
description:
Dec 18 07:00:19 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=179.0.250.86, lip=66.85.158.91, TLS, session=<6zTw5S9Gc8KzAPpW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.45
country_id: 3175395
description:
Dec 18 07:00:38 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers>, method=PLAIN, rip=185.15.169.45, lip=66.85.158.91, TLS, session=<fHl55y9GyZ65D6kt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.8.88
country_id: 3175395
description:
Dec 18 07:00:10 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=185.197.8.88, lip=66.85.158.91, TLS, session=<DdjO5S9GeIK5xQhY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.26
country_id: 3865483
description:
Dec 18 07:00:17 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=179.0.252.26, lip=66.85.158.91, TLS, session=<IPXq5S9GEomzAPwa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.89.74
country_id: 3865483
description:
Dec 18 07:00:32 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<careers>, method=PLAIN, rip=190.181.89.74, lip=66.85.158.91, TLS, session=<F4r35i9GOe2+tVlK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.24
country_id: 3865483
description:
Dec 18 07:00:33 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<careers>, method=PLAIN, rip=179.0.250.24, lip=66.85.158.91, TLS, session=<110D5y9GVaSzAPoY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.146
country_id: 3865483
description:
Dec 18 07:00:46 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 25 secs): user=<careers>, method=PLAIN, rip=179.0.250.146, lip=66.85.158.91, TLS, session=<0iiF5y9GVZWzAPqS>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.211.152.28
country_id: 3469034
description:
Dec 18 07:01:17 host2 sshd[2823557]: Disconnected from invalid user git2 102.211.152.28 port 50088 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.170
country_id: 1643084
description:
Dec 18 07:02:45 host2 sshd[2824314]: Disconnected from invalid user frappe 27.112.78.170 port 41818 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.41.202.12
country_id: 6252001
description:
2025-12-18 07:04:05 dovecot_login authenticator failed for syn-071-041-202-012.biz.spectrum.com [71.41.202.12]:39034: 535 Incorrect authentication data (set_id=eng-env@lezzarotech.com)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 185.116.160.35
country_id: 130758
description:
Dec 18 07:03:12 host2 sshd[2824870]: Received disconnect from 185.116.160.35 port 58094:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-12-18 07:04:14 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:60152: 535 Incorrect authentication data (set_id=env-eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-18 07:04:48 dovecot_login authenticator failed for host-196-47-172-253.afnet.net [196.47.172.253]:58452: 535 Incorrect authentication data (set_id=env.eng@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.116.160.35
country_id: 130758
description:
Dec 18 07:04:51 host2 sshd[2826332]: Disconnected from invalid user sammy 185.116.160.35 port 60032 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.75.218.103
country_id: 1269750
description:
2025-12-18 07:04:31 dovecot_login authenticator failed for ([103.55.89.5]) [116.75.218.103]:36560: 535 Incorrect authentication data (set_id=enveng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.125.200
country_id: 294640
description:
2025-12-18 07:04:37 dovecot_login authenticator failed for (2-55-125-200.orange.net.il) [2.55.125.200]:43778: 535 Incorrect authentication data (set_id=env-eng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-12-18 07:04:41 dovecot_login authenticator failed for ([102.53.15.18]) [102.53.15.18]:35773: 535 Incorrect authentication data (set_id=eng-env@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-18 07:04:52 dovecot_login authenticator failed for ([154.144.243.93]) [154.144.243.93]:37752: 535 Incorrect authentication data (set_id=eng-env)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.140.250
country_id: 3469034
description:
2025-12-18 07:05:03 dovecot_login authenticator failed for ([181.233.140.250]) [181.233.140.250]:48450: 535 Incorrect authentication data (set_id=enveng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2025-12-18 07:05:10 dovecot_login authenticator failed for ([41.59.202.241]) [41.59.202.241]:54244: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-12-18 07:05:18 dovecot_login authenticator failed for (237-166.adsl.static.espeed.com.bn) [119.160.166.237]:42414: 535 Incorrect authentication data (set_id=engenv@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.116.160.35
country_id: 130758
description:
Dec 18 07:05:22 host2 sshd[2826851]: Disconnected from invalid user email 185.116.160.35 port 41634 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-18 07:05:32 dovecot_login authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:43582: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 18 07:05:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<3E7H+i9GAOc+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 18 07:09:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<IF2OBjBGOoY+PIcr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.19.12
country_id: 3144096
description:
2025-12-18 07:09:30 dovecot_login authenticator failed for (cm-84.211.19.12.get.no) [84.211.19.12]:54612: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.111.144
country_id: 3144096
description:
2025-12-18 07:10:18 dovecot_login authenticator failed for ([84.215.111.144]) [84.215.111.144]:38367: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 18 07:14:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<hU2uGjBGJNI+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 18 07:15:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<TReFHTBGGN8+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.24.107.1
country_id: 1269750
description:
2025-12-18 07:16:36 dovecot_login authenticator failed for ([144.24.107.1]) [144.24.107.1]:39232: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.115.237.19
country_id: 3923057
description:
2025-12-18 07:17:00 dovecot_login authenticator failed for ([181.115.237.19]) [181.115.237.19]:59384: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 18 07:17:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<ja1cJDBGhNM+PIdp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.250.108
country_id: 6252001
description:
2025-12-18 07:18:32 dovecot_login authenticator failed for wsip-184-191-250-108.fv.ks.cox.net [184.191.250.108]:60042: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.242
country_id: 3996063
description:
2025-12-18 07:19:07 dovecot_login authenticator failed for ([177.236.146.242]) [177.236.146.242]:47287: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.125
country_id: 6252001
description:
Dec 18 07:19:52 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.125, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<K/BPLTBGkdDG6xh9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.41.206.151
country_id: 6252001
description:
2025-12-18 07:20:29 dovecot_login authenticator failed for (ADMIN) [181.41.206.151]:54271: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Dec 18 07:23:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<GUrXOTBGDuc+PIcc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.62
country_id: 6252001
description:
Dec 18 07:23:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.62, lip=66.85.158.92, TLS: Connection closed, session=<ormGOTBG6HKnXpI+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.122
country_id: 6252001
description:
Dec 18 07:31:44 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.122, lip=66.85.158.91, session=<KFy3VzBGwCxAPpx6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.122
country_id: 6252001
description:
Dec 18 07:32:10 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=64.62.156.122, lip=66.85.158.91, session=<KSNBWTBG7qdAPpx6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 18 07:40:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<RffxdjBGMpk+PIdm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.110.237
country_id: 3144096
description:
2025-12-18 07:43:29 dovecot_login authenticator failed for (cm-46.212.110.237.get.no) [46.212.110.237]:43391: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
country_id: 6252001
description:
2025-12-18 07:43:45 dovecot_login authenticator failed for ([67.213.230.122]) [67.213.230.122]:26894: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 18 07:44:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<MDzGhjBGArY+PIMh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.23.160
country_id: 2635167
description:
2025-12-18 07:48:55 dovecot_login authenticator failed for (ADMIN) [158.173.23.160]:8598: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.61.176.110
country_id: 3469034
description:
2025-12-18 07:52:10 dovecot_login authenticator failed for (177-61-176-110.dsl.telesp.net.br) [177.61.176.110]:59139: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.102
country_id: 1149361
description:
2025-12-18 07:52:27 dovecot_login authenticator failed for ([180.94.75.102]) [180.94.75.102]:57122: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 18 07:53:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<1/UbpTBG6p8+PIcr>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 18 07:54:51 host2 pure-ftpd[2857490]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.218.82.11
country_id: 3996063
description:
2025-12-18 07:57:35 dovecot_login authenticator failed for (189.218.82.11-clientes-izzi.mx) [189.218.82.11]:58247: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.167.117
country_id: 99237
description:
2025-12-18 07:58:44 dovecot_login authenticator failed for ([65.20.167.117]) [65.20.167.117]:41938: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 18 07:59:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<8alfuTBGHr4+PIcg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.222.54
country_id: 1269750
description:
2025-12-18 08:00:44 dovecot_login authenticator failed for (aes-static-089.140.22.125.airtel.in) [122.187.222.54]:58196: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.153.123.18
country_id: 3625428
description:
2025-12-18 08:01:11 dovecot_login authenticator failed for ([190.153.123.18]) [190.153.123.18]:12002: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.84.153.170
country_id: 6252001
description:
Dec 18 08:07:39 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.84.153.170, lip=66.85.158.92, session=<Bvor2DBGZoYUVJmq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 18 08:10:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<fph74DBG8Ig+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-18 08:10:50 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:49326: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 18 08:10:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<923T4zBGdow+PIcd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2025-12-18 08:11:43 dovecot_login authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:41141: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.248.170
country_id: 1269750
description:
2025-12-18 08:12:05 dovecot_login authenticator failed for (nsg-corporate-81.20.187.122.airtel.in) [125.19.248.170]:52052: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 18 08:14:40 host2 sshd[2871445]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.126
country_id: 6252001
description:
Dec 18 08:14:15 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.132.126, lip=66.85.158.91, TLS, session=<RdjE7zBGSOmTuYR+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.230.250
country_id: 1861060
description:
Dec 18 08:14:58 host2 sshd[2871587]: Disconnected from invalid user git 118.194.230.250 port 58564 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.59.55.50
country_id: 1269750
description:
Dec 18 08:15:36 host2 sshd[2872120]: Disconnected from invalid user support 137.59.55.50 port 50806 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.194.230.250
country_id: 1861060
description:
Dec 18 08:16:59 host2 sshd[2873075]: Disconnected from invalid user vncuser 118.194.230.250 port 34732 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.80.158
country_id: 1269750
description:
2025-12-18 08:16:21 dovecot_login authenticator failed for (victoryent.in) [111.93.80.158]:59354: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.230.250
country_id: 1861060
description:
Dec 18 08:16:23 host2 sshd[2872656]: Disconnected from invalid user webadmin 118.194.230.250 port 34668 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.59.55.50
country_id: 1269750
description:
Dec 18 08:17:18 host2 sshd[2873341]: Disconnected from invalid user user4 137.59.55.50 port 57052 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.187.240
country_id: 3144096
description:
2025-12-18 08:18:11 dovecot_login authenticator failed for (cm-84.213.187.240.get.no) [84.213.187.240]:37415: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 137.59.55.50
country_id: 1269750
description:
Dec 18 08:18:30 host2 sshd[2874945]: Disconnected from invalid user sysadmin 137.59.55.50 port 55142 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.53.7.231
country_id: 6252001
description:
2025-12-18 08:18:48 dovecot_login authenticator failed for ([64.53.7.231]) [64.53.7.231]:38510: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.230.250
country_id: 1861060
description:
Dec 18 08:18:51 host2 sshd[2875346]: Disconnected from invalid user debian 118.194.230.250 port 34918 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 18 08:21:28 host2 sshd[2877370]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec 18 08:29:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<4QKmJDFG/OI+PIds>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.19.224.161
country_id: 3017382
description:
Dec 18 08:32:30 host2 sshd[2884556]: Disconnected from invalid user sdtd 162.19.224.161 port 59940 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 119.92.70.82
country_id: 1694008
description:
Dec 18 08:33:57 host2 sshd[2885280]: Disconnected from invalid user xxx 119.92.70.82 port 35382 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 119.92.70.82
country_id: 1694008
description:
Dec 18 08:35:00 host2 sshd[2885659]: Disconnected from invalid user desarrollo 119.92.70.82 port 47600 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec 18 08:34:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<qQuHODFGCoI+PIdq>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.188.112.111
country_id: 6252001
description:
Dec 18 08:36:15 host2 sshd[2886722]: Disconnected from invalid user test 35.188.112.111 port 46084 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.27.22
country_id: 3923057
description:
Dec 18 08:36:44 host2 sshd[2887065]: Disconnected from invalid user centos 190.181.27.22 port 57166 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.212.133
country_id: 1819730
description:
Dec 18 08:37:17 host2 sshd[2887330]: Disconnected from invalid user printer 123.58.212.133 port 35348 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.19.224.161
country_id: 3017382
description:
Dec 18 08:37:25 host2 sshd[2887412]: Disconnected from invalid user simon 162.19.224.161 port 46638 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.76.120.90
country_id: 1643084
description:
Dec 18 08:37:42 host2 sshd[2887586]: Disconnected from invalid user printer 103.76.120.90 port 39298 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.27.22
country_id: 3923057
description:
Dec 18 08:38:34 host2 sshd[2887993]: Disconnected from invalid user king 190.181.27.22 port 38258 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.212.133
country_id: 1819730
description:
Dec 18 08:38:40 host2 sshd[2888040]: Disconnected from invalid user mahesh 123.58.212.133 port 36028 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.91.170.15
country_id: 241170
description:
Dec 18 08:38:08 host2 sshd[2887807]: Disconnected from invalid user ventas 154.91.170.15 port 40054 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.19.224.161
country_id: 3017382
description:
Dec 18 08:38:29 host2 sshd[2887952]: Disconnected from invalid user fsc 162.19.224.161 port 51776 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.155.50.50
country_id: 6252001
description:
Dec 18 08:39:26 host2 sshd[2888522]: Disconnected from invalid user ftpuser 107.155.50.50 port 44306 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.181.27.22
country_id: 3923057
description:
Dec 18 08:39:59 host2 sshd[2888958]: Disconnected from invalid user mahesh 190.181.27.22 port 59660 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.53.215.134
country_id: 3658394
description:
Dec 18 08:43:42 host2 sshd[2891870]: Disconnected from invalid user mtvps1 177.53.215.134 port 59408 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.95.157.171
country_id: 1861060
description:
Dec 18 08:43:48 host2 sshd[2891923]: Disconnected from invalid user ubuntu 150.95.157.171 port 59830 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 150.95.157.171
country_id: 1861060
description:
Dec 18 08:45:06 host2 sshd[2893451]: Disconnected from invalid user dev 150.95.157.171 port 56522 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.155.50.50
country_id: 6252001
description:
Dec 18 08:45:54 host2 sshd[2895148]: Disconnected from invalid user dev 107.155.50.50 port 56324 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.53.215.134
country_id: 3658394
description:
Dec 18 08:47:51 host2 sshd[2896890]: Disconnected from invalid user git 177.53.215.134 port 58006 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.14.88.205
country_id: 6252001
description:
Dec 18 08:49:06 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.14.88.205, lip=66.85.158.92, TLS, session=<GkZnbDFG8oAUDljN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.43.167
country_id: 1819730
description:
Dec 18 08:49:35 host2 sshd[2898216]: Disconnected from invalid user user 118.193.43.167 port 28668 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.193.43.167
country_id: 1819730
description:
Dec 18 08:52:04 host2 sshd[2900371]: Disconnected from invalid user anthony 118.193.43.167 port 2524 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.43.167
country_id: 1819730
description:
Dec 18 08:51:22 host2 sshd[2899861]: Disconnected from invalid user thomas 118.193.43.167 port 54640 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.43.167
country_id: 1819730
description:
Dec 18 08:52:43 host2 sshd[2900872]: Disconnected from invalid user practice 118.193.43.167 port 14376 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.180.249.32
country_id: 1269750
description:
2025-12-18 08:52:48 dovecot_login authenticator failed for (abts-north-static-32.249.180.122.airtelbroadband.in) [122.180.249.32]:56243: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.53.199.160
country_id: 6252001
description:
2025-12-18 08:52:25 dovecot_login authenticator failed for (136-53-199-160.googlefiber.net) [136.53.199.160]:58987: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.102.232.21
country_id: 3057568
description:
2025-12-18 08:56:49 dovecot_login authenticator failed for (ADMIN) [149.102.232.21]:39710: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 18 08:57:11 host2 pure-ftpd[2904843]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 18 09:00:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<bxAnlTFGtr8+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 18 09:03:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=</ihmnjFGBLQ+PIdm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.30
country_id: 6252001
description:
Dec 18 09:04:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=162.216.150.30, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<ICwmojFGatii2JYe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.39.201
country_id: 3144096
description:
2025-12-18 09:08:45 dovecot_login authenticator failed for (cm-46.212.39.201.get.no) [46.212.39.201]:36156: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 82.67.140.251
country_id: 3017382
description:
Dec 18 09:09:20 host2 sshd[2913392]: error: maximum authentication attempts exceeded for root from 82.67.140.251 port 59726 ssh2 [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 82.67.140.251
country_id: 3017382
description:
Dec 18 09:09:20 host2 sshd[2913392]: Disconnecting authenticating user root 82.67.140.251 port 59726: Too many authentication failures [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 82.67.140.251
country_id: 3017382
description:
Dec 18 09:09:29 host2 sshd[2913497]: Disconnecting invalid user admin 82.67.140.251 port 60868: Too many authentication failures [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.30
country_id: 6252001
description:
Dec 18 09:09:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.30, lip=66.85.158.91, TLS, session=<VAajtTFG2Oyi2JYe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec 18 09:12:12 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<GuLtvjFGwtQ+PIcq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.209.152.58
country_id: 1269750
description:
Dec 18 09:14:06 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 1 secs): user=<>, rip=134.209.152.58, lip=66.85.158.92, TLS, session=<yljRxTFGJJKG0Zg6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.209.152.58
country_id: 1269750
description:
Dec 18 09:14:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=134.209.152.58, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<U/HbxTFGMpKG0Zg6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.239.217.156
country_id: 3041565
description:
2025-12-18 09:14:07 dovecot_login authenticator failed for (ADMIN) [173.239.217.156]:52950: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.48.229.117
country_id: 3469034
description:
2025-12-18 09:14:25 dovecot_login authenticator failed for ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:56862: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.53.199.160
country_id: 6252001
description:
2025-12-18 09:16:30 dovecot_login authenticator failed for (136-53-199-160.googlefiber.net) [136.53.199.160]:52758: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 18 09:18:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<KtwX1DFGLtg+PIdj>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.195.33.9
country_id: 2921044
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 159.195.33.9 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 18 09:19:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<uNV31zFG0uLBHmEh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.227.147.163
country_id: 6252001
description:
Dec 18 09:19:06 host2 sshd[2918857]: Disconnected from invalid user wireguard 23.227.147.163 port 48212 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.227.147.163
country_id: 6252001
description:
Dec 18 09:20:13 host2 sshd[2919622]: Disconnected from invalid user ubuntu 23.227.147.163 port 44118 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 23.227.147.163
country_id: 6252001
description:
Dec 18 09:20:44 host2 sshd[2919895]: Disconnected from invalid user user 23.227.147.163 port 37500 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.227.147.163
country_id: 6252001
description:
Dec 18 09:21:13 host2 sshd[2920189]: Disconnected from invalid user invoices 23.227.147.163 port 44648 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 18 09:22:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<O9IA5DFG0pY+PIdj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 18 09:22:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<jy+b5DFGVII+PIde>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.65.97.67
country_id: 3469034
description:
Dec 18 09:23:30 host2 sshd[2921262]: Disconnected from invalid user deployer 177.65.97.67 port 33352 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.233
country_id: 6252001
description:
Dec 18 09:24:08 host2 pure-ftpd[2921630]: (?@205.210.31.233) [INFO] New connection from 205.210.31.233


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.211.86.46
country_id: 6252001
description:
2025-12-18 09:24:11 dovecot_login authenticator failed for (syn-024-211-086-046.res.spectrum.com) [24.211.86.46]:32830: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.194.230.231
country_id: 1861060
description:
Dec 18 09:24:21 host2 sshd[2921841]: Disconnected from invalid user dockeruser 118.194.230.231 port 48704 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.191.169
country_id: 6252001
description:
2025-12-18 09:24:23 dovecot_login authenticator failed for ([70.174.191.169]) [70.174.191.169]:39880: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 18 09:27:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<9nL/9jFG0pU+PIce>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.48
country_id: 3017382
description:
Dec 18 09:30:47 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.196.152.48, lip=66.85.158.91, TLS handshaking: Connection closed, session=<4YB5ATJGQ9NbxJgw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.74
country_id: 3017382
description:
Dec 18 09:31:16 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=91.196.152.74, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<YfE3AzJG+aVbxJhK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.48
country_id: 3017382
description:
Dec 18 09:31:19 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=91.196.152.48, lip=66.85.158.91, TLS: Connection closed, session=<TZthAzJGNYBbxJgw>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.250.10.101
country_id: 1643084
description:
Dec 18 09:31:42 host2 sshd[2925789]: Disconnected from invalid user camera 103.250.10.101 port 55342 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.123
country_id: 6252001
description:
Dec 18 09:32:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 45 secs): user=<>, rip=147.185.133.123, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<78q5CDJGNdWTuYV7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.123
country_id: 6252001
description:
Dec 18 09:33:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=147.185.133.123, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<NwF8CzJGyumTuYV7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 18 09:33:41 host2 sshd[2926736]: Disconnected from invalid user admin 2.57.121.112 port 9933 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.19.210.164
country_id: 6252001
description:
2025-12-18 09:35:24 dovecot_login authenticator failed for (ADMIN) [37.19.210.164]:6827: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.237
country_id: 6252001
description:
Dec 18 09:35:33 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.237, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<jEGCEjJGCdqTuYTt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 18 09:37:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<uZfAFzJGMJc+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 18 09:38:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<CMOnHjJGtr8+PIce>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.123
country_id: 6252001
description:
Dec 18 09:40:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.123, lip=66.85.158.92, TLS, session=<0lQRJTJG3PiTuYV7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.122.112
country_id: 3144096
description:
2025-12-18 09:42:11 dovecot_login authenticator failed for (ADMIN) [46.246.122.112]:19169: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 18 09:46:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<QP49OzJGYtA+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 18 09:46:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<V+01OzJGlq8+PIMh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.58.211.64
country_id: 2635167
description:
Dec 18 09:48:32 host2 sshd[2936388]: Disconnected from invalid user karen 143.58.211.64 port 42566 [preauth]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 35.94.252.155
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 35.94.252.155: 250 connections per 30 seconds to 80 port.


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 18 09:51:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<9FRvTDJGQtE+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-12-18 09:51:48 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:34084: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.89.161.111
country_id: 1269750
description:
Dec 18 09:52:00 host2 sshd[2939351]: Disconnected from invalid user test101 159.89.161.111 port 33432 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.44.21
country_id: 6252001
description:
2025-12-18 09:52:08 dovecot_login authenticator failed for ([98.181.44.21]) [98.181.44.21]:42138: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 143.58.211.64
country_id: 2635167
description:
Dec 18 09:52:12 host2 sshd[2939577]: Disconnected from invalid user george 143.58.211.64 port 33336 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.164.107.6
country_id: 6252001
description:
Dec 18 09:54:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=194.164.107.6, lip=66.85.158.91, session=<PPXsVDJGzr3CpGsG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.89.161.111
country_id: 1269750
description:
Dec 18 09:53:12 host2 sshd[2940431]: Disconnected from invalid user ansari 159.89.161.111 port 34246 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 159.89.161.111
country_id: 1269750
description:
Dec 18 09:53:50 host2 sshd[2940949]: Disconnected from invalid user kasia 159.89.161.111 port 47020 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 18 09:54:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<v9kjVjJGdr0+PIce>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 18 09:56:51 host2 sshd[2944053]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.254
country_id: 6252001
description:
2025-12-18 09:56:17 dovecot_login authenticator failed for ([209.23.72.254]) [209.23.72.254]:35614: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 18 09:59:40 host2 pure-ftpd[2946092]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 18 10:01:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<2MvgbjJGdLU+PIde>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 18 10:03:40 host2 sshd[2949747]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 18 10:03:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<QeuedjJG8KQ+PIdj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.119.40.156
country_id: 6252001
description:
Dec 18 10:04:08 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=40.119.40.156, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<AnDBeDJGopwodyic>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.139
country_id: 6252001
description:
Dec 18 10:06:27 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.139, lip=66.85.158.92, TLS: Connection closed, session=<k3cOgTJGkDdChJmL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.144
country_id: 6252001
description:
Dec 18 10:09:04 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.144, lip=66.85.158.92, session=<ARVpijJG/PLG6xiQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 18 10:09:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<F62pizJGpKY+PIdm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.108.174.60
country_id: 1269750
description:
2025-12-18 10:11:45 dovecot_login authenticator failed for (ADMIN) [103.108.174.60]:20945: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 18 10:13:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<LLcAmTJGkLo+PIMp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 18 10:21:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<30XFtjJGUoA+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 18 10:22:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<oJI1ujJG8KY+PIdj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 18 10:23:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<8MaPvjJGOLM+PIMh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.140.219
country_id: 298795
description:
2025-12-18 10:24:38 dovecot_plain authenticator failed for (ingly) [5.11.140.219]:43006: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.26.190.79
country_id: 298795
description:
2025-12-18 10:24:38 dovecot_plain authenticator failed for (rewagnics) [5.26.190.79]:54030: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 18 10:24:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<ADZjwjJGMro+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 18 10:25:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<Rv0SxTJGNLk+PIMp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 18 10:31:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<CFbp2zJGAO4+PIdp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 18 10:34:23 host2 sshd[2970618]: Disconnected from invalid user user 2.57.121.25 port 45897 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.65.154.228
country_id: 6252001
description:
Dec 18 10:35:30 host2 pure-ftpd[2971419]: (?@20.65.154.228) [INFO] New connection from 20.65.154.228


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 18 10:40:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<0fAW/DJGCKw+PIcl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Dec 18 10:42:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.91, TLS: Connection closed, session=<x6wzATNGOJOLonHU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.70.122.245
country_id: 1269750
description:
2025-12-18 10:45:22 dovecot_login authenticator failed for (abts-mum-static-245.122.70.182.airtelbroadband.in) [182.70.122.245]:44488: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.112.148.66
country_id: 130758
description:
2025-12-18 10:45:40 dovecot_login authenticator failed for ([185.112.148.66]) [185.112.148.66]:39835: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.79.173.175
country_id: 2802361
description:
Dec 18 10:49:11 host2 pure-ftpd[2979531]: (?@34.79.173.175) [INFO] New connection from 34.79.173.175


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 18 10:51:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<97itIDNGDOQ+PIcl>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 87.236.176.222
country_id: 2635167
description:
Dec 18 10:51:57 host2 pure-ftpd[2981141]: (?@87.236.176.222) [INFO] New connection from 87.236.176.222


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 18 10:52:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<FCMBJzNG4qk+PIdf>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.140.92.201
country_id: 2802361
description:
Dec 18 10:53:54 host2 pure-ftpd[2982210]: (?@34.140.92.201) [INFO] New connection from 34.140.92.201


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 18 10:57:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<wWryNTNGNrw+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 18 10:57:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<fm/pNzNGrpU+PIdj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 18 11:00:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<jRZ4QDNGvJw+PIdl>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 18 11:02:08 host2 pure-ftpd[2987738]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.241.77.78
country_id: 1269750
description:
2025-12-18 11:03:37 dovecot_login authenticator failed for ([117.241.77.78]) [117.241.77.78]:45342: 535 Incorrect authentication data (set_id=v-deploy.com@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 18 11:03:56 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<BhCjTjNGWugDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.231.50
country_id: 1269750
description:
2025-12-18 11:04:27 dovecot_login authenticator failed for ([182.95.85.109]) [125.19.231.50]:55800: 535 Incorrect authentication data (set_id=v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Dec 18 11:04:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<WWWOUTNGFNQ+PIco>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 93.174.95.106
country_id: 2750405
description:
Dec 18 11:04:58 host2 pure-ftpd[2990694]: (?@93.174.95.106) [INFO] New connection from 93.174.95.106


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 93.174.95.106
country_id: 2750405
description:
Dec 18 11:05:01 host2 pure-ftpd[2990790]: (?@93.174.95.106) [INFO] New connection from 93.174.95.106


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 136.113.146.40
country_id: 6252001
description:
Dec 18 11:05:17 host2 pure-ftpd[2991412]: (?@136.113.146.40) [INFO] New connection from 136.113.146.40


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.65.194.176
country_id: 6252001
description:
Dec 18 11:07:16 host2 pure-ftpd[2992814]: (?@20.65.194.176) [INFO] New connection from 20.65.194.176


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 18 11:07:28 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<V65AWzNGgooDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.68.37.25
country_id: 2661886
description:
2025-12-18 11:07:54 dovecot_plain authenticator failed for 78-68-37-25-no2560.tbcn.telia.com (tribunads) [78.68.37.25]:35876: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-12-18 11:07:57 dovecot_plain authenticator failed for (physts) [24.187.213.29]:56972: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 18 11:09:07 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<PuwnYTNGWqgDhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.110.167
country_id: 6252001
description:
Dec 18 11:08:42 host2 sshd[2993586]: Disconnected from invalid user wekan 107.150.110.167 port 16868 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 18 11:09:15 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<AlOkYTNGjMQDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 18 11:10:49 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<1rQ2ZzNG7qkDhBfJ>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 18 11:11:42 host2 dovecot[1284858]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<SS9oajNGGsYDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 18 11:13:20 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<Stc5cDNGDocDhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.110.167
country_id: 6252001
description:
Dec 18 11:14:11 host2 sshd[2996628]: Disconnected from invalid user tomcatuser 107.150.110.167 port 14616 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.31.39.240
country_id: 1643084
description:
Dec 18 11:14:20 host2 sshd[2996708]: Disconnected from invalid user wekan 103.31.39.240 port 44800 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.248.200.9
country_id: 1210997
description:
Dec 18 11:15:09 host2 sshd[2997202]: Disconnected from invalid user dev 161.248.200.9 port 60274 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.150.110.167
country_id: 6252001
description:
Dec 18 11:15:13 host2 sshd[2997313]: Disconnected from invalid user s1 107.150.110.167 port 39324 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.88.28.122
country_id: 1643084
description:
Dec 18 11:15:30 host2 sshd[2997533]: Disconnected from invalid user wekan 36.88.28.122 port 46282 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.174
country_id: 1733045
description:
2025-12-18 11:15:44 dovecot_login authenticator failed for ([49.124.155.174]) [49.124.155.174]:60758: 535 Incorrect authentication data (set_id=lezzarotech.com@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.248.200.9
country_id: 1210997
description:
Dec 18 11:16:33 host2 sshd[2998172]: Disconnected from invalid user wekan 161.248.200.9 port 60378 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 107.150.110.167
country_id: 6252001
description:
Dec 18 11:16:51 host2 sshd[2998337]: Received disconnect from 107.150.110.167 port 21382:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.195.19.75
country_id: 1269750
description:
2025-12-18 11:16:58 dovecot_login authenticator failed for ([14.195.19.75]) [14.195.19.75]:56866: 535 Incorrect authentication data (set_id=lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.248.200.9
country_id: 1210997
description:
Dec 18 11:18:31 host2 sshd[2999233]: Disconnected from invalid user tomcatuser 161.248.200.9 port 60538 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.88.28.122
country_id: 1643084
description:
Dec 18 11:19:29 host2 sshd[2999671]: Disconnected from invalid user yxu 36.88.28.122 port 40294 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.92.243.14
country_id: 6252001
description:
Dec 18 11:19:44 host2 sshd[2999757]: Disconnected from invalid user telkom 91.92.243.14 port 39152 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.202.58
country_id: 1880251
description:
Dec 18 11:20:21 host2 sshd[3000251]: Disconnected from invalid user s1 45.78.202.58 port 35588 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.248.200.9
country_id: 1210997
description:
Dec 18 11:21:11 host2 sshd[3000832]: Disconnected from invalid user misha 161.248.200.9 port 60750 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.202.58
country_id: 1880251
description:
Dec 18 11:21:35 host2 sshd[3001024]: Disconnected from invalid user wekan 45.78.202.58 port 49806 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.56.52.109
country_id: 6251999
description:
2025-12-18 11:22:14 dovecot_login authenticator failed for (ADMIN) [212.56.52.109]:43531: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.80
country_id: 1733045
description:
2025-12-18 11:25:31 dovecot_login authenticator failed for ([49.125.201.80]) [49.125.201.80]:48548: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.84.54
country_id: 1269750
description:
2025-12-18 11:25:57 dovecot_login authenticator failed for ([182.79.151.121]) [27.123.84.54]:36164: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.147.85
country_id: 3144096
description:
2025-12-18 11:26:42 dovecot_login authenticator failed for (cm-178.232.147.85.get.no) [178.232.147.85]:35628: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.103.119.198
country_id: 1282988
description:
Dec 18 11:27:03 host2 dovecot[1284858]: imap-login: Disconnected: Aborted login by logging out (auth failed, 1 attempts in 5 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=117.103.119.198, lip=66.85.158.91, TLS, session=<8voBoTNGMBV1Z3fG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.124
country_id: 6252001
description:
Dec 18 11:27:07 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.124, lip=66.85.158.91, TLS: Connection closed, session=<sC9/oTNGkC9ChJl8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.124
country_id: 6252001
description:
Dec 18 11:27:12 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=66.132.153.124, lip=66.85.158.91, session=<xuzToTNG7olChJl8>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.184.50.251
country_id: 3686110
description:
Dec 18 11:30:06 host2 sshd[3006306]: Disconnected from invalid user venta 201.184.50.251 port 55644 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.184.50.251
country_id: 3686110
description:
Dec 18 11:31:08 host2 sshd[3006989]: Disconnected from invalid user hadoopuser 201.184.50.251 port 42888 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.184.50.251
country_id: 3686110
description:
Dec 18 11:31:45 host2 sshd[3007306]: Disconnected from invalid user gustavo 201.184.50.251 port 54976 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.184.50.251
country_id: 3686110
description:
Dec 18 11:32:23 host2 sshd[3007741]: Disconnected from invalid user facturacion 201.184.50.251 port 38832 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 18 11:35:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<oxbNvTNGktM+PIMh>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.16.238.49
country_id: 3469034
description:
Dec 18 11:37:47 host2 sshd[3011067]: Disconnected from invalid user odoo 201.16.238.49 port 40456 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 136.144.233.117
country_id: 2750405
description:
Dec 18 11:37:51 host2 sshd[3011097]: Disconnected from invalid user oracle 136.144.233.117 port 35000 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 18 11:38:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<ChPKyDNGoII+PIdf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.16.238.49
country_id: 3469034
description:
Dec 18 11:38:31 host2 sshd[3011410]: Disconnected from invalid user ubuntu 201.16.238.49 port 52284 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 18 11:39:17 host2 sshd[3012075]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.16.238.49
country_id: 3469034
description:
Dec 18 11:39:14 host2 sshd[3012012]: Disconnected from invalid user sfc 201.16.238.49 port 35878 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 136.144.233.117
country_id: 2750405
description:
Dec 18 11:39:34 host2 sshd[3012238]: Disconnected from invalid user ec2-user 136.144.233.117 port 53080 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.169.138
country_id: 1819730
description:
Dec 18 11:39:53 host2 sshd[3012405]: Disconnected from invalid user odoo 150.5.169.138 port 50328 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.103
country_id: 130758
description:
Dec 18 11:40:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.103, lip=66.85.158.91, session=<8CV10DNGVtE+PIdn>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 150.5.169.138
country_id: 1819730
description:
Dec 18 11:41:40 host2 sshd[3013786]: Disconnected from invalid user admin 150.5.169.138 port 55900 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 136.144.233.117
country_id: 2750405
description:
Dec 18 11:43:30 host2 sshd[3014814]: Disconnected from invalid user ubuntu 136.144.233.117 port 58336 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 18 11:46:06 host2 sshd[3017021]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 18 11:45:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<CzkS5DNGiOY+PIdp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 210.79.142.221
country_id: 1643084
description:
Dec 18 11:46:27 host2 sshd[3017229]: Disconnected from invalid user admin 210.79.142.221 port 56542 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 18 11:47:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<5WKM6DNGqLo+PIdp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.119.212.84
country_id: 130758
description:
2025-12-18 11:51:32 dovecot_login authenticator failed for (ADMIN) [93.119.212.84]:37467: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 18 11:54:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<ISkSBTRGoLw+PIcf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 210.79.142.221
country_id: 1643084
description:
Dec 18 11:55:27 host2 sshd[3023528]: Disconnected from invalid user ubuntu 210.79.142.221 port 38806 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 18 11:56:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<WeZECzRGNMs+PIde>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.234.124.206
country_id: 6252001
description:
Dec 18 11:56:52 host2 pure-ftpd[3024446]: (?@104.234.124.206) [INFO] New connection from 104.234.124.206


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.234.124.206
country_id: 6252001
description:
[2025-12-18 11:56:53 +0530] info [cpaneld] 104.234.124.206 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 18 11:59:04 host2 sshd[3025610]: Disconnected from invalid user brenton 62.60.131.157 port 59692 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 18 11:59:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<bFrCFDRG2q0+PIdm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.157.65
country_id: 2921044
description:
2025-12-18 12:01:19 dovecot_login authenticator failed for (ADMIN) [191.101.157.65]:49969: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.40.218.197
country_id: 6252001
description:
Dec 18 12:02:56 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 1 secs): user=<>, rip=20.40.218.197, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<2xaXITRG4KMUKNrF>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 18 12:04:43 host2 pure-ftpd[3029297]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 18 12:04:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<ykY9JzRGJsk+PIcg>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 164.177.31.66
country_id: 3017382
description:
Dec 18 12:07:31 host2 sshd[3031221]: Disconnected from invalid user lighthouse 164.177.31.66 port 45346 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.177.31.66
country_id: 3017382
description:
Dec 18 12:08:31 host2 sshd[3031790]: Disconnected from invalid user ctf 164.177.31.66 port 35644 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 18 12:09:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<URE+OTRGrJUDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 18 12:11:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<mLSuPjRGrpIDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 18 12:11:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: Connection closed, session=<hrxdPzRGIK4DlTsa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 18 12:13:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<VwYGSTRGTLs+PIcs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 18 12:14:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: Connection closed, session=<hs2USTRGgt8DlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 18 12:14:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS, session=<OQqESjRGbt4DlTsa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 18 12:16:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<juhOUDRGqrU+PIcd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 18 12:15:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<XIGNTTRGBs8DlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 18 12:16:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<OQH0UjRGkLQDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 18 12:17:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: Connection closed, session=<dCW5VjRG0tUDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 18 12:18:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS, session=<cU92WTRGDIEDlTsa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 18 12:19:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<q9HvWjRG5qg+PIcs>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 18 12:19:42 host2 sshd[3039543]: Disconnected from invalid user brenton 62.60.131.157 port 26634 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 18 12:20:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<e0WVYTRGhpQ+PIMh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.38.3.179
country_id: 2215636
description:
2025-12-18 12:21:52 dovecot_login authenticator failed for ([102.38.3.179]) [102.38.3.179]:34880: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 18 12:32:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<NwNtjDRGBIQ+PIdg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.98.186.174
country_id: 3017382
description:
2025-12-18 12:35:07 dovecot_login authenticator failed for ip174.ip-87-98-186.eu (ADMIN) [87.98.186.174]:39738: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.84.61.38
country_id: 6252001
description:
Dec 18 12:37:07 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.84.61.38, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<AWbfmzRGJsoUVD0m>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 18 12:42:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 23 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<EnVFrjRGiOw+PIcf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.150.112.242
country_id: 1880251
description:
Dec 18 12:42:57 host2 sshd[3063452]: Disconnected from invalid user ubuntu 107.150.112.242 port 59860 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 18 12:43:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<1xlxszRG8oc+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 18 12:44:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<+hVRtjRGyLQ+PIde>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 18 12:48:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<S7dFwzRGULU+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 18 12:48:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<jxeSxDRGLO0+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 18 12:52:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<X98G0jRGOs0+PIcs>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 35.94.252.155
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 35.94.252.155: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.57.141
country_id: 6252001
description:
Dec 18 12:54:29 host2 sshd[3073578]: Disconnected from invalid user test 198.98.57.141 port 36024 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.57.141
country_id: 6252001
description:
Dec 18 12:56:25 host2 sshd[3075303]: Disconnected from invalid user admin 198.98.57.141 port 36668 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.98.57.141
country_id: 6252001
description:
Dec 18 12:57:23 host2 sshd[3076182]: Disconnected from invalid user ubuntu 198.98.57.141 port 50840 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 18 12:58:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<72bs5jRGpK4+PIM0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.57.141
country_id: 6252001
description:
Dec 18 12:58:35 host2 sshd[3076912]: Disconnected from invalid user hduser 198.98.57.141 port 36780 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 18 13:00:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<36DB8DRGDo8+PIdp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.61.228.137
country_id: 2077456
description:
2025-12-18 13:05:02 dovecot_login authenticator failed for (ADMIN) [179.61.228.137]:1334: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.220.126
country_id: 1269750
description:
2025-12-18 13:06:25 dovecot_login authenticator failed for ([152.52.220.126]) [152.52.220.126]:59228: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-12-18 13:06:51 dovecot_login authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:57106: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 18 13:07:16 host2 pure-ftpd[3082428]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.164.35.116
country_id: 2328926
description:
2025-12-18 13:07:38 dovecot_login authenticator failed for ([102.164.35.116]) [102.164.35.116]:46028: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.199.223
country_id: 3144096
description:
2025-12-18 13:07:15 dovecot_login authenticator failed for (cm-178.232.199.223.get.no) [178.232.199.223]:41100: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.83.130.80
country_id: 1269750
description:
2025-12-18 13:08:32 dovecot_login authenticator failed for (80.130.83.103.static.rapidnet.in) [103.83.130.80]:57332: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.31
country_id: 3996063
description:
2025-12-18 13:09:04 dovecot_login authenticator failed for (201.173.250.31-clientes-izzi.mx) [201.173.250.31]:44333: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.129.13.184
country_id: 1880251
description:
2025-12-18 13:09:39 dovecot_login authenticator failed for (184.13.129.180.unknown.m1.com.sg) [180.129.13.184]:49172: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 112.134.213.132
country_id: 1227603
description:
Dec 18 13:11:56 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=112.134.213.132, lip=66.85.158.91, TLS, session=<aH5fGDVG7VpwhtWE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.23.180.137
country_id: 6252001
description:
Dec 18 13:19:10 host2 sshd[3090816]: Disconnected from invalid user mcc 64.23.180.137 port 57180 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec 18 13:19:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<AOWeNDVGNKg+PIdr>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.105.224.72
country_id: 1861060
description:
Dec 18 13:20:21 host2 pure-ftpd[3091943]: (?@172.105.224.72) [INFO] New connection from 172.105.224.72


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 18 13:21:47 host2 sshd[3092756]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.23.180.137
country_id: 6252001
description:
Dec 18 13:21:16 host2 sshd[3092473]: Disconnected from invalid user test 64.23.180.137 port 52712 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 18 13:24:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<37zeRDVG8IA+PIcg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.159.234.21
country_id: 2635167
description:
2025-12-18 13:26:50 dovecot_login authenticator failed for (ADMIN) [98.159.234.21]:43945: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.103
country_id: 130758
description:
Dec 18 13:26:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.103, lip=66.85.158.91, session=<R12/TDVGSuk+PIdn>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 18 13:28:36 host2 sshd[3096989]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 166.170.48.43
country_id: 6252001
description:
Dec 18 13:31:24 host2 sshd[3099184]: Disconnected from invalid user manager 166.170.48.43 port 21684 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 166.170.48.43
country_id: 6252001
description:
Dec 18 13:33:08 host2 sshd[3100177]: Disconnected from invalid user ubuntu 166.170.48.43 port 7501 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 18 13:33:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<9hWWZTVGVuk+PIMp>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 166.170.48.43
country_id: 6252001
description:
Dec 18 13:33:40 host2 sshd[3100445]: Received disconnect from 166.170.48.43 port 56297:11: Bye Bye [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 18 13:35:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<6JpabDVGXt8+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 18 13:42:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<OlW2hDVG+Lw+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 18 13:44:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<QdLtjDVGvrc+PIde>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.0.192.28
country_id: 3865483
description:
Dec 18 13:45:02 host2 sshd[3107228]: Disconnected from invalid user pdf 181.0.192.28 port 8480 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.188.13
country_id: 2635167
description:
Dec 18 13:49:13 host2 sshd[3110236]: Disconnected from invalid user test 139.59.188.13 port 37138 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 139.59.188.13
country_id: 2635167
description:
Dec 18 13:49:45 host2 sshd[3110514]: Disconnected from invalid user support 139.59.188.13 port 49548 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.0.192.28
country_id: 3865483
description:
Dec 18 13:53:22 host2 sshd[3113095]: Disconnected from invalid user wangtao 181.0.192.28 port 8319 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.0.101
country_id: 1643084
description:
Dec 18 13:54:21 host2 sshd[3114028]: Disconnected from invalid user ashok 103.186.0.101 port 37238 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.0.192.28
country_id: 3865483
description:
Dec 18 13:55:54 host2 sshd[3115218]: Disconnected from invalid user marco 181.0.192.28 port 13335 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.152
country_id: 6252001
description:
Dec 18 13:57:12 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=199.45.154.152, lip=66.85.158.92, TLS: Connection closed, session=<y2k/ujVG1IXHLZqY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.152
country_id: 6252001
description:
Dec 18 13:57:15 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=199.45.154.152, lip=66.85.158.92, TLS, session=<gYVwujVG3oXHLZqY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.221.78
country_id: 1880251
description:
Dec 18 13:58:13 host2 sshd[3117645]: Disconnected from invalid user cosmo 45.78.221.78 port 35742 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.221.78
country_id: 1880251
description:
Dec 18 13:59:19 host2 sshd[3118327]: Disconnected from invalid user mama 45.78.221.78 port 43790 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.174.243
country_id: 1269750
description:
Dec 18 14:00:41 host2 sshd[3119297]: Disconnected from invalid user main 64.227.174.243 port 43184 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.186.0.101
country_id: 1643084
description:
Dec 18 14:00:44 host2 sshd[3119326]: Disconnected from invalid user west 103.186.0.101 port 42746 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 18 14:02:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 6 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<7PI4zjVGttE+PIdp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.140.184.163
country_id: 3996063
description:
Dec 18 14:03:10 host2 sshd[3121104]: Disconnected from invalid user zte 187.140.184.163 port 34350 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.10.201.7
country_id: 3469034
description:
Dec 18 14:03:34 host2 sshd[3121552]: Disconnected from invalid user vpn 177.10.201.7 port 37276 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.140.184.163
country_id: 3996063
description:
Dec 18 14:04:24 host2 sshd[3122242]: Disconnected from invalid user oracle 187.140.184.163 port 59088 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.10.201.7
country_id: 3469034
description:
Dec 18 14:04:56 host2 sshd[3122540]: Disconnected from invalid user pre 177.10.201.7 port 34966 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 223.17.0.220
country_id: 1819730
description:
Dec 18 14:05:44 host2 sshd[3123094]: Disconnected from invalid user ymoreno 223.17.0.220 port 48640 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 135.13.8.139
country_id: 1269750
description:
Dec 18 14:07:08 host2 sshd[3123719]: Disconnected from invalid user ts3 135.13.8.139 port 44940 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.98.21
country_id: 3469034
description:
2025-12-18 14:06:28 dovecot_login authenticator failed for (ADMIN) [146.70.98.21]:54091: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.10.201.7
country_id: 3469034
description:
Dec 18 14:07:24 host2 sshd[3124132]: Disconnected from invalid user ubuntu 177.10.201.7 port 56392 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 18 14:07:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<4keo3jVGfMQ+PIdf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 223.17.0.220
country_id: 1819730
description:
Dec 18 14:07:35 host2 sshd[3124220]: Disconnected from invalid user oracle 223.17.0.220 port 52466 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 18 14:09:48 host2 pure-ftpd[3125795]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.10.201.7
country_id: 3469034
description:
Dec 18 14:11:24 host2 sshd[3126904]: Disconnected from invalid user postgres 177.10.201.7 port 47530 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 135.13.8.139
country_id: 1269750
description:
Dec 18 14:15:09 host2 sshd[3129770]: Disconnected from invalid user jester 135.13.8.139 port 55562 [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 87.92.131.254
country_id: 660013
description:
Dec 18 14:17:07 host2 sshd[3131011]: Disconnecting authenticating user root 87.92.131.254 port 38822: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 87.92.131.254
country_id: 660013
description:
Dec 18 14:17:07 host2 sshd[3131011]: error: maximum authentication attempts exceeded for root from 87.92.131.254 port 38822 ssh2 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 18 14:17:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<PLb6AzZGjL4+PIcf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 87.92.131.254
country_id: 660013
description:
Dec 18 14:17:21 host2 sshd[3131141]: Disconnecting invalid user admin 87.92.131.254 port 41794: Too many authentication failures [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 18 14:18:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<TB+iBzZGAsw+PIdm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 18 14:18:51 host2 sshd[3131966]: Disconnected from invalid user admin 2.57.121.112 port 17661 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.158.205.225
country_id: 1861060
description:
2025-12-18 14:20:44 dovecot_login authenticator failed for kd113158205225.ppp-bb.dion.ne.jp [113.158.205.225]:33459: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.31
country_id: 3996063
description:
2025-12-18 14:21:32 dovecot_login authenticator failed for (201.173.250.31-clientes-izzi.mx) [201.173.250.31]:45670: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 18 14:24:45 host2 sshd[3135727]: Disconnected from invalid user anaya 62.60.131.157 port 56439 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.151.158
country_id: 3144096
description:
2025-12-18 14:26:51 dovecot_login authenticator failed for (cm-84.210.151.158.get.no) [84.210.151.158]:38897: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.127.86
country_id: 1269750
description:
2025-12-18 14:26:36 dovecot_login authenticator failed for (dsl-ncr-dynamic-097.178.23.125.airtelbroadband.in) [182.79.127.86]:53936: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.21
country_id: 6252001
description:
Dec 18 14:27:32 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.21, lip=66.85.158.92, TLS, session=<nZ28JjZGOOaTuYQV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.61.240.14
country_id: 2186224
description:
2025-12-18 14:31:14 dovecot_login authenticator failed for (ADMIN) [179.61.240.14]:48641: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 18 14:35:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<gcOMQzZGPOQ+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.178
country_id: 3144096
description:
2025-12-18 14:36:47 dovecot_login authenticator failed for (cm-84.213.189.178.get.no) [84.213.189.178]:52810: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.108.215.39
country_id: 3469034
description:
2025-12-18 14:37:07 dovecot_login authenticator failed for ([189.108.215.39]) [189.108.215.39]:57621: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 18 14:43:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<dQhTYDZGXp0+PIcg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 18 14:45:09 host2 sshd[3149156]: Disconnected from invalid user anaya 62.60.131.157 port 31136 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 18 14:47:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<I2Y3bDZGZIs+PIdm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.178.77.26
country_id: 3703430
description:
2025-12-18 14:47:03 dovecot_plain authenticator failed for (96H3V7R8Q2) [181.178.77.26]:56946: 535 Incorrect authentication data (set_id=virajith.rathnasekara@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.107.163.195
country_id: 3932488
description:
2025-12-18 14:49:38 dovecot_login authenticator failed for ([200.107.163.195]) [200.107.163.195]:21278: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 18 14:49:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<DPTmdTZG0ojBHmEh>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.102
country_id: 2635167
description:
Dec 18 14:50:38 host2 dovecot[1284858]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.102, lip=66.85.158.92, TLS, session=<s3teeTZGLdO594lm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.89
country_id: 2635167
description:
Dec 18 14:50:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.89, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<bNKmeTZGi9BX7LBZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.85
country_id: 2635167
description:
Dec 18 14:51:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.85, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<9iyiezZG/bC594lV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.104
country_id: 2635167
description:
Dec 18 14:51:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.104, lip=66.85.158.92, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<o7udfTZGh6q594lo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.74
country_id: 2635167
description:
Dec 18 14:52:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.74, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<fS6ZfzZGdc5X7LBK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.85
country_id: 2635167
description:
Dec 18 14:52:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.85, lip=66.85.158.92, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<wo6egTZG4ZG594lV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.79
country_id: 2635167
description:
Dec 18 14:53:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.79, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<+GWSgzZG3+y594lP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.78
country_id: 2635167
description:
Dec 18 14:54:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.78, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<dJ+dhTZG1eNX7LBO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.84
country_id: 2635167
description:
Dec 18 14:55:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.84, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<E12SiTZGzZ9X7LBU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.104
country_id: 2635167
description:
Dec 18 14:54:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.104, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<nwuZhzZGRdhX7LBo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.104
country_id: 2635167
description:
Dec 18 14:55:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.104, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<JL+NizZGgaRX7LBo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.180
country_id: 99237
description:
2025-12-18 14:56:49 dovecot_login authenticator failed for ([65.20.250.180]) [65.20.250.180]:52373: 535 Incorrect authentication data (set_id=v-deploy@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.48.229.117
country_id: 3469034
description:
2025-12-18 14:57:55 dovecot_login authenticator failed for ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:56382: 535 Incorrect authentication data (set_id=v-deploy)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 18 14:58:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<OlDvkzZGOLQ+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2025-12-18 15:02:04 dovecot_login authenticator failed for (nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:55755: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.188.98
country_id: 1269750
description:
2025-12-18 15:01:36 dovecot_login authenticator failed for ([125.19.165.242]) [125.19.188.98]:42778: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.124.13
country_id: 3042225
description:
2025-12-18 15:01:35 dovecot_login authenticator failed for (ADMIN) [91.90.124.13]:46374: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 18 15:02:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<4XmypDZG/Kg+PIdl>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.60.170.241
country_id: 1694008
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 103.60.170.241 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 18 15:04:37 host2 sshd[3162895]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.53.82
country_id: 1733045
description:
2025-12-18 15:06:04 dovecot_login authenticator failed for ([183.171.53.82]) [183.171.53.82]:59778: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.195.66
country_id: 1269750
description:
2025-12-18 15:05:44 dovecot_login authenticator failed for ([125.19.195.66]) [125.19.195.66]:59774: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 18 15:06:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<uZ+jsTZGvtI+PIdl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.1
country_id: 798549
description:
Dec 18 15:07:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.140.1, lip=66.85.158.91, TLS: Connection closed, session=<NwHxtjZG/qxV2YwB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.1
country_id: 798549
description:
Dec 18 15:08:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=85.217.140.1, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<NyPVuDZGKIxV2YwB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 18 15:10:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<dIkFwTZGeuI+PIMh>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 18 15:11:26 host2 sshd[3168300]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 18 15:12:14 host2 pure-ftpd[3168625]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.181
country_id: 1733045
description:
2025-12-18 15:15:10 dovecot_login authenticator failed for ([49.124.159.181]) [49.124.159.181]:57642: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.40.63
country_id: 1819730
description:
2025-12-18 15:14:57 dovecot_login authenticator failed for 063.40.246.220.static.netvigator.com [220.246.40.63]:59988: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.188.149.243
country_id: 3923057
description:
2025-12-18 15:15:08 dovecot_login authenticator failed for (scz-181-188-149-00243.tigo.bo) [181.188.149.243]:37602: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.110.96
country_id: 3144096
description:
2025-12-18 15:15:16 dovecot_login authenticator failed for ([84.215.110.96]) [84.215.110.96]:50579: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.225.28.238
country_id: 718075
description:
2025-12-18 15:19:25 dovecot_login authenticator failed for (ADMIN) [185.225.28.238]:64275: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.86.61.76
country_id: 6252001
description:
2025-12-18 15:19:29 dovecot_login authenticator failed for ([208.86.61.76]) [208.86.61.76]:52629: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 18 15:21:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<eQaW5jZGwKs+PIcm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 18 15:22:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<lkCE6zZGorM+PIcg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.109.13.50
country_id: 1269750
description:
2025-12-18 15:23:25 dovecot_login authenticator failed for ([103.109.13.50]) [103.109.13.50]:39260: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.128.112.204
country_id: 3017382
description:
2025-12-18 15:24:01 dovecot_login authenticator failed for 217-128-112-204.ftth.fr.orangecustomers.net [217.128.112.204]:50426: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 18 15:24:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<PJEn8jZGDOg+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.43.172
country_id: 1819730
description:
2025-12-18 15:26:24 dovecot_login authenticator failed for 172.43.246.220.static.netvigator.com [220.246.43.172]:59768: 535 Incorrect authentication data (set_id=v-deploy@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2025-12-18 15:26:44 dovecot_login authenticator failed for ([182.95.226.118]) [182.95.226.118]:60990: 535 Incorrect authentication data (set_id=v-deploy)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.176
country_id: 6252001
description:
Dec 18 15:28:46 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.176, lip=66.85.158.91, TLS, session=<uNy+ATdGDvDN0h+w>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.9.22.30
country_id: 1643084
description:
2025-12-18 15:31:53 dovecot_login authenticator failed for ([114.9.22.30]) [114.9.22.30]:42925: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2025-12-18 15:32:01 dovecot_login authenticator failed for ([90.161.217.228]) [90.161.217.228]:51413: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 18 15:36:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<KmafGzdGqsY+PIcm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.196.92
country_id: 1819730
description:
2025-12-18 15:37:52 dovecot_login authenticator failed for (223-197-196-92.static.imsbiz.com) [223.197.196.92]:56760: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 18 15:38:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<g+PZIjdGCMg+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.8.48.178
country_id: 1605651
description:
2025-12-18 15:38:04 dovecot_login authenticator failed for ppp-58-8-48-178.revip2.asianet.co.th [58.8.48.178]:34519: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 18 15:38:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<hIsAJTdGLI4+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec 18 15:40:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<hM+/KjdGIK0+PIdc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Dec 18 15:42:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<uMqbMTdG5LE+PIco>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.130.207.177
country_id: 597427
description:
2025-12-18 15:43:39 dovecot_login authenticator failed for static-213-130-207-177.cust.tele2.lt [213.130.207.177]:57280: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.166.123
country_id: 1605651
description:
2025-12-18 15:43:49 dovecot_login authenticator failed for ([106.0.166.123]) [106.0.166.123]:43490: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.98.186.174
country_id: 3017382
description:
2025-12-18 15:45:06 dovecot_login authenticator failed for ip174.ip-87-98-186.eu (ADMIN) [87.98.186.174]:36508: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 18 15:49:36 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<cfoZTDdGmpE+PIdl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 18 15:50:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<ryYUTzdG5pk+PIM0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec 18 15:52:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<6GDwVjdGvLc+PIds>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 18 15:54:30 host2 sshd[3193941]: Disconnected from invalid user admin 2.57.121.112 port 47038 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 18 15:55:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<dq3pYjdG+q8+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.111.140
country_id: 1269750
description:
2025-12-18 15:57:08 dovecot_login authenticator failed for (abts-mum-static-140.111.170.122.airtelbroadband.in) [122.170.111.140]:39839: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 18 15:59:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<K8UebjdG9rQ+PIdj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 18 15:58:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=</lYcbTdGpLg+PIcs>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 158.69.194.34
country_id: 6251999
description:
Dec 18 15:59:43 host2 sshd[3197160]: Disconnected from invalid user db2fenc1 158.69.194.34 port 51116 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec 18 16:03:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<4FznfTdGPI4+PIdq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.106.194.74
country_id: 1269750
description:
Dec 18 16:07:18 host2 sshd[3202086]: Disconnected from invalid user luis 103.106.194.74 port 59216 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.122.14
country_id: 3042058
description:
2025-12-18 16:08:08 dovecot_login authenticator failed for (ADMIN) [91.90.122.14]:55129: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.106.194.74
country_id: 1269750
description:
Dec 18 16:08:51 host2 sshd[3202960]: Disconnected from invalid user work 103.106.194.74 port 58970 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.100.211.35
country_id: 1819730
description:
Dec 18 16:09:24 host2 sshd[3203277]: Disconnected from invalid user prueba 103.100.211.35 port 49234 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.106.194.74
country_id: 1269750
description:
Dec 18 16:10:15 host2 sshd[3204045]: Disconnected from invalid user ricky 103.106.194.74 port 57496 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.98
country_id: 130758
description:
Dec 18 16:11:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.98, lip=66.85.158.91, session=<GZPDmTdGFq8+PIdi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.100.211.35
country_id: 1819730
description:
Dec 18 16:12:07 host2 sshd[3205144]: Disconnected from invalid user minecraft 103.100.211.35 port 59108 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 18 16:14:39 host2 pure-ftpd[3207115]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.100.211.35
country_id: 1819730
description:
Dec 18 16:16:08 host2 sshd[3208101]: Disconnected from invalid user work 103.100.211.35 port 44080 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2025-12-18 16:16:53 dovecot_login authenticator failed for ([83.136.176.12]) [83.136.176.12]:40215: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.238.247.238
country_id: 3469034
description:
2025-12-18 16:16:36 dovecot_login authenticator failed for ([189.44.251.249]) [186.238.247.238]:32911: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.50
country_id: 1269750
description:
2025-12-18 16:17:20 dovecot_login authenticator failed for (aes-static-225.77.144.59.airtel.in) [182.95.123.50]:47306: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2025-12-18 16:17:40 dovecot_login authenticator failed for ([65.20.143.159]) [65.20.143.159]:57547: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.57.158
country_id: 1269750
description:
2025-12-18 16:18:55 dovecot_login authenticator failed for (aes-static-041.100.144.59.airtel.in) [182.95.57.158]:52782: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.72.143.2
country_id: 1269750
description:
2025-12-18 16:19:29 dovecot_login authenticator failed for (ws99-36-153-203.rcil.gov.in) [182.72.143.2]:44552: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.38
country_id: 1269750
description:
2025-12-18 16:22:39 dovecot_login authenticator failed for (nsg-corporate-38.230.187.122.airtel.in) [122.187.230.38]:54754: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.250.250
country_id: 1269750
description:
2025-12-18 16:22:58 dovecot_login authenticator failed for (nsg-corporate-250.250.187.122.airtel.in) [122.187.250.250]:41671: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.233.246
country_id: 1269750
description:
2025-12-18 16:26:49 dovecot_login authenticator failed for ([125.17.233.246]) [125.17.233.246]:58054: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 18 16:27:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<wvVd0jdGbrw+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 18 16:27:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<Qak81TdGJLU+PIcm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.143.101.69
country_id: 3686110
description:
Dec 18 16:27:30 host2 sshd[3215325]: Disconnected from invalid user tiago 190.143.101.69 port 59196 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.38
country_id: 6252001
description:
2025-12-18 16:27:32 dovecot_login authenticator failed for ([98.181.46.38]) [98.181.46.38]:36220: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.41.7
country_id: 3175395
description:
2025-12-18 16:29:07 dovecot_login authenticator failed for (ADMIN) [156.146.41.7]:56736: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.143.101.69
country_id: 3686110
description:
Dec 18 16:29:40 host2 sshd[3216692]: Disconnected from invalid user webadmin 190.143.101.69 port 47948 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.194.15.228
country_id: 1168579
description:
2025-12-18 16:29:45 dovecot_login authenticator failed for ([45.194.15.228]) [45.194.15.228]:49373: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.118.138
country_id: 3144096
description:
2025-12-18 16:29:59 dovecot_login authenticator failed for (cm-46.212.118.138.get.no) [46.212.118.138]:34266: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.143.101.69
country_id: 3686110
description:
Dec 18 16:30:17 host2 sshd[3217606]: Disconnected from invalid user albert 190.143.101.69 port 47586 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 18 16:30:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<Ww+X3zdGYr4+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 18 16:31:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<Sko04DdGxts+PIde>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec 18 16:31:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<P/Im4DdG7NA+PIdo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 18 16:31:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<s7ss4zdGSL0+PIdl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 18 16:32:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<8+Fl5jdGGpQ+PIM0>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.122.105.182
country_id: 6252001
description:
Dec 18 16:36:14 host2 pure-ftpd[3221160]: (?@34.122.105.182) [INFO] New connection from 34.122.105.182


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec 18 16:36:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<BbnN8zdG2oE+PIdo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 18 16:42:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<2UbICDhG9sU+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.98
country_id: 130758
description:
Dec 18 16:42:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.98, lip=66.85.158.91, session=<3bq8CThGrtw+PIdi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 18 16:42:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<su6FCjhGfoA+PIM0>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 102.54.238.57 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 18 16:43:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<IAEFDDhGksQ+PIdl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 18 16:44:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<gJbZDjhGRuI+PIdf>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 18 16:47:12 host2 sshd[3227959]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.126.105.42
country_id: 3469034
description:
2025-12-18 16:47:04 dovecot_login authenticator failed for 187-126-105-42.user.vtal.net.br (187-126-105-145.user.vtal.net.br) [187.126.105.42]:55984: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.52
country_id: 798544
description:
2025-12-18 16:47:16 dovecot_login authenticator failed for 89-67-37-52.dynamic.play.pl [89.67.37.52]:48746: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.159.234.68
country_id: 2635167
description:
2025-12-18 16:52:18 dovecot_login authenticator failed for (ADMIN) [98.159.234.68]:51304: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 18 16:54:04 host2 sshd[3232368]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 18 16:58:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<7F3eQDhG9tM+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.233.246
country_id: 1269750
description:
2025-12-18 16:58:52 dovecot_login authenticator failed for ([125.17.233.246]) [125.17.233.246]:49452: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.242.112.200
country_id: 1269750
description:
2025-12-18 16:59:08 dovecot_login authenticator failed for (static-154-209-252-178.pol.net.in) [121.242.112.200]:41788: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 18 17:03:39 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<9xwNVThGSrgDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.48.207.245
country_id: 1269750
description:
2025-12-18 17:04:39 dovecot_plain authenticator failed for (P756S1ACH72QLPV) [157.48.207.245]:59090: 535 Incorrect authentication data (set_id=charana.wijesiri@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.143.238.207
country_id: 1819730
description:
Dec 18 17:05:29 host2 sshd[3240833]: Disconnected from invalid user stack 103.143.238.207 port 39412 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 18 17:06:04 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<+9q3XThGXMkDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 18 17:06:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<hpgyXjhGQMM+PIM0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 18 17:06:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<GcPNXjhGluI+PIcl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 18 17:08:07 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<oZUNZThGwtUDgmBb>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 168.167.228.74
country_id: 933860
description:
Dec 18 17:07:30 host2 sshd[3242230]: Disconnected from invalid user ravi 168.167.228.74 port 33269 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.143.238.207
country_id: 1819730
description:
Dec 18 17:07:46 host2 sshd[3242423]: Disconnected from invalid user harish 103.143.238.207 port 32772 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.143.238.207
country_id: 1819730
description:
Dec 18 17:08:19 host2 sshd[3243011]: Disconnected from invalid user ravi 103.143.238.207 port 45228 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.143.238.207
country_id: 1819730
description:
Dec 18 17:08:52 host2 sshd[3243335]: Disconnected from invalid user composeruser 103.143.238.207 port 57684 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 18 17:09:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<eaYRazhGntoDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.194
country_id: 2635167
description:
Dec 18 17:09:31 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=35.203.210.194, lip=66.85.158.91, session=<CewRajhGbvcjy9LC>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 18 17:10:29 host2 dovecot[1284858]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<snuDbThGPt0DgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 18 17:12:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<tm4vdDhG8Oo+PIcr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 18 17:12:35 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<KYMAdThGQJoDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 18 17:13:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<LC6AeThG2tU+PIcm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.59.154
country_id: 1269750
description:
2025-12-18 17:16:54 dovecot_login authenticator failed for ([182.95.25.48]) [182.95.59.154]:50776: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.221.194
country_id: 3144096
description:
2025-12-18 17:17:07 dovecot_login authenticator failed for ([178.232.221.194]) [178.232.221.194]:43899: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 18 17:17:15 host2 pure-ftpd[3250649]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.244.54.12
country_id: 798549
description:
2025-12-18 17:19:17 dovecot_login authenticator failed for (ADMIN) [143.244.54.12]:16459: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.216.119.134
country_id: 1819730
description:
Dec 18 17:20:57 host2 sshd[3252747]: Disconnected from invalid user felix 185.216.119.134 port 52814 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.216.119.134
country_id: 1819730
description:
Dec 18 17:22:54 host2 sshd[3253776]: Disconnected from invalid user felipe 185.216.119.134 port 50150 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.216.119.134
country_id: 1819730
description:
Dec 18 17:23:34 host2 sshd[3254093]: Disconnected from invalid user upload 185.216.119.134 port 34400 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 92.207.4.157
country_id: 2635167
description:
Dec 18 17:24:44 host2 sshd[3255021]: Disconnected from invalid user louwg 92.207.4.157 port 60740 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 18 17:27:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<HxlpqDhGwJU+PIdp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.66.231
country_id: 3469034
description:
2025-12-18 17:27:17 dovecot_login authenticator failed for (industrianaval.fla.gvt.net.br) [187.58.66.231]:42318: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.222.157
country_id: 3996063
description:
2025-12-18 17:27:33 dovecot_login authenticator failed for (187.161.222.157-clientes-izzi.mx) [187.161.222.157]:33036: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.9.247.58
country_id: 3469034
description:
2025-12-18 17:27:45 dovecot_login authenticator failed for (200-153-121-1.customer.tdatabrasil.net.br) [187.9.247.58]:59612: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Dec 18 17:27:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<KawbqzhGTIM+PIcc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.129.20.234
country_id: 1831722
description:
2025-12-18 17:28:10 dovecot_login authenticator failed for ([150.129.20.234]) [150.129.20.234]:54320: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.198.49
country_id: 3996063
description:
2025-12-18 17:30:58 dovecot_login authenticator failed for (187.161.198.49-clientes-izzi.mx) [187.161.198.49]:46142: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.140.54
country_id: 1269750
description:
2025-12-18 17:31:18 dovecot_login authenticator failed for (dsl-mp-dynamic-054.140.23.125.airtelbroadband.in) [125.23.140.54]:34746: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.210.95.88
country_id: 294640
description:
2025-12-18 17:32:05 dovecot_login authenticator failed for ([46.210.95.88]) [46.210.95.88]:39588: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 18 17:34:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<LKcJwzhGuJg+PIMh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.17
country_id: 798549
description:
Dec 18 17:35:38 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.140.17, lip=66.85.158.91, TLS: Connection closed, session=<Wb1zxzhGxMZV2YwR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 18 17:35:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<ASF1yDhGLqE+PIdm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.138
country_id: 1269750
description:
2025-12-18 17:36:17 dovecot_login authenticator failed for ([128.185.201.138]) [128.185.201.138]:43182: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.6.163
country_id: 3144096
description:
2025-12-18 17:37:15 dovecot_login authenticator failed for (cm-78.156.6.163.get.no) [78.156.6.163]:38014: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.215.182.194
country_id: 6252001
description:
2025-12-18 17:41:47 dovecot_login authenticator failed for (ADMIN) [181.215.182.194]:34122: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.25
country_id: 1733045
description:
2025-12-18 17:42:13 dovecot_login authenticator failed for ([49.124.151.25]) [49.124.151.25]:34998: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.190.55
country_id: 3144096
description:
2025-12-18 17:42:35 dovecot_login authenticator failed for ([84.213.190.55]) [84.213.190.55]:44193: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.88.222
country_id: 3996063
description:
2025-12-18 17:44:21 dovecot_login authenticator failed for (201.172.88.222-clientes-izzi.mx) [201.172.88.222]:58165: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.80
country_id: 3144096
description:
2025-12-18 17:44:33 dovecot_login authenticator failed for (80-170-97-62.cust.smartcall.no) [62.97.170.80]:35996: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 18 17:46:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<CvCg7zhGYtU+PIcg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.155.27.128
country_id: 2802361
description:
2025-12-18 17:48:03 dovecot_login authenticator failed for 128.27.155.104.bc.googleusercontent.com [104.155.27.128]:50154: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.154
country_id: 3144096
description:
2025-12-18 17:48:31 dovecot_login authenticator failed for (cm-84.213.189.154.get.no) [84.213.189.154]:58150: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.58.78.20
country_id: 1269750
description:
2025-12-18 17:54:45 dovecot_plain authenticator failed for (I7QG1XB55L1Y) [152.58.78.20]:55426: 535 Incorrect authentication data (set_id=onila.selaka@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 18 17:57:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<JJqnFDlGhJA+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 18 17:57:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<pOwLFTlGNpo+PIcr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.96.131.123
country_id: 102358
description:
2025-12-18 17:59:01 dovecot_plain authenticator failed for (56QUULLY) [94.96.131.123]:51911: 535 Incorrect authentication data (set_id=punsarani.ariyawansha@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 18 17:59:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<LSgbHDlGjtg+PIdf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 18 18:02:05 host2 sshd[3280973]: Disconnected from invalid user admin 2.57.121.112 port 13353 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 18 18:03:34 host2 sshd[3282031]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.97
country_id: 130758
description:
Dec 18 18:06:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.97, lip=66.85.158.91, session=<pkl4NDlGvIs+PIdh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.3
country_id: 798549
description:
Dec 18 18:06:49 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.140.3, lip=66.85.158.91, TLS: Connection closed, session=<c7X6NjlGOLFV2YwD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.238.56
country_id: 6252001
description:
2025-12-18 18:07:59 dovecot_login authenticator failed for (ADMIN) [95.181.238.56]:33162: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.177.228
country_id: 1269750
description:
2025-12-18 18:18:41 dovecot_login authenticator failed for ([111.93.177.228]) [111.93.177.228]:54542: 535 Incorrect authentication data (set_id=v-deploy.com@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.69.251.106
country_id: 597427
description:
2025-12-18 18:19:03 dovecot_login authenticator failed for (md-188-69-251-106.omni.lt) [188.69.251.106]:33811: 535 Incorrect authentication data (set_id=v-deploy.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 18 18:20:12 host2 pure-ftpd[3292548]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 143.198.152.193
country_id: 6252001
description:
Dec 18 18:24:12 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=143.198.152.193, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<ZQohdTlGWIKPxpjB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.203.22.221
country_id: 6251999
description:
Dec 18 18:25:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=159.203.22.221, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<FsROejlG4pmfyxbd>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 18 18:30:33 host2 sshd[3298996]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.89.82
country_id: 660013
description:
2025-12-18 18:32:02 dovecot_login authenticator failed for (ADMIN) [188.126.89.82]:11163: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.171
country_id: 2635167
description:
Dec 18 18:31:18 host2 dovecot[1284858]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.171, lip=66.85.158.92, TLS, session=<U+iJjjlGb62594mr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.206
country_id: 2635167
description:
Dec 18 18:31:19 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.206, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<QGuUjjlGn5+594nO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.204
country_id: 2635167
description:
Dec 18 18:31:52 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.204, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<uLOPkDlGV55X7LDM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.192
country_id: 2635167
description:
Dec 18 18:32:28 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=87.236.176.192, lip=66.85.158.92, TLS handshaking: Connection closed, session=<2GWskjlG4ddX7LDA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.183
country_id: 2635167
description:
Dec 18 18:33:01 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.183, lip=66.85.158.92, TLS handshaking: Connection closed, session=<gemmlDlGEalX7LC3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.28.151
country_id: 798544
description:
Dec 18 18:33:36 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=178.216.28.151, lip=66.85.158.91, TLS, session=<LVzAlTlGFYyy2ByX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.107.81.125
country_id: 732800
description:
Dec 18 18:33:46 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=109.107.81.125, lip=66.85.158.91, TLS, session=<z5NbljlG2udta1F9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.188
country_id: 2635167
description:
Dec 18 18:33:34 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.188, lip=66.85.158.92, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<IzqiljlGuYy594m8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.196.111.103
country_id: 798544
description:
Dec 18 18:33:40 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=91.196.111.103, lip=66.85.158.91, TLS, session=</dDulTlGnphbxG9n>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 154.119.55.110
country_id: 953987
description:
Dec 18 18:33:40 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=154.119.55.110, lip=66.85.158.91, TLS, session=<zHbQlTlG2eaadzdu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.63.133.50
country_id: 3175395
description:
Dec 18 18:33:57 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<careers>, method=PLAIN, rip=185.63.133.50, lip=66.85.158.91, TLS, session=<pU7dljlGQoW5P4Uy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.74.243.19
country_id: 2510769
description:
Dec 18 18:33:59 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers>, method=PLAIN, rip=185.74.243.19, lip=66.85.158.91, TLS, session=<D3oWlzlG3Lq5SvMT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.226.115.156
country_id: 3057568
description:
Dec 18 18:34:00 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<careers>, method=PLAIN, rip=91.226.115.156, lip=66.85.158.91, TLS, session=<V8gQlzlGINFb4nOc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.239.103.122
country_id: 3277605
description:
Dec 18 18:34:05 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers>, method=PLAIN, rip=104.239.103.122, lip=66.85.158.91, TLS, session=<SDN6lzlGjpFo72d6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.213
country_id: 2635167
description:
Dec 18 18:34:07 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.213, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<cxScmDlGvYhX7LDV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.191
country_id: 2635167
description:
Dec 18 18:34:42 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.191, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<rOanmjlGHa6594m/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.202
country_id: 2635167
description:
Dec 18 18:35:15 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.202, lip=66.85.158.92, TLS handshaking: Connection closed, session=<AGKjnDlGb89X7LDK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.208
country_id: 2635167
description:
Dec 18 18:35:48 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (disconnected before auth was ready, waited 0 secs): user=<>, rip=185.247.137.208, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<UMScnjlGwbK594nQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.201
country_id: 2635167
description:
Dec 18 18:36:21 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=</FuaoDlGBa2594nJ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 18 18:37:27 host2 sshd[3302607]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.130.111.146
country_id: 6252001
description:
Dec 18 18:38:30 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=35.130.111.146, lip=66.85.158.91, TLS, session=<T+tKpzlGcJkjgm+S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 84.1.34.242
country_id: 719819
description:
Dec 18 18:38:48 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<hr>, method=PLAIN, rip=84.1.34.242, lip=66.85.158.91, TLS, session=<mEJdqDlG5otUASLy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.15.223.148
country_id: 3017382
description:
2025-12-18 18:40:11 dovecot_login authenticator failed for 80-15-223-148.ftth.fr.orangecustomers.net [80.15.223.148]:60672: 535 Incorrect authentication data (set_id=lezzarotech.com@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-12-18 18:40:28 dovecot_login authenticator failed for (46.30.161.197.access.ipnet.ua) [46.30.161.197]:60120: 535 Incorrect authentication data (set_id=lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec 18 18:43:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<5PiYujlGyOg+PIds>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 18 18:46:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<5oL1xDlGZuw+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec 18 18:48:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<tz33yzlGmqU+PIdq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.220.210
country_id: 2403846
description:
2025-12-18 18:49:11 dovecot_login authenticator failed for ([196.216.220.210]) [196.216.220.210]:47306: 535 Incorrect authentication data (set_id=v-deploy.com@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec 18 18:51:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<MnPO1zlGqps+PIcq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.171.154.72
country_id: 783754
description:
2025-12-18 18:54:51 dovecot_login authenticator failed for (ADMIN) [31.171.154.72]:6610: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 18 18:55:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=</K6P5TlGMoA+PIdm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.38
country_id: 6252001
description:
Dec 18 18:58:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=195.184.76.38, lip=66.85.158.92, session=<iaZe7jlGOdzDuEwm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.36
country_id: 6252001
description:
Dec 18 18:58:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=195.184.76.36, lip=66.85.158.92, session=<tmkH7zlGSYLDuEwk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.241
country_id: 6252001
description:
Dec 18 18:58:26 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=195.184.76.241, lip=66.85.158.92, session=<0lKR7zlGYaDDuEzx>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.242
country_id: 6252001
description:
Dec 18 18:58:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.242, lip=66.85.158.92, session=<s3rB7zlGlejDuEzy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 69.164.217.245
country_id: 6252001
description:
Dec 18 19:02:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=69.164.217.245, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<5fP1/TlGMNBFpNn1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.207.181
country_id: 6252001
description:
Dec 18 19:02:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=45.79.207.181, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<MzlR/jlGoZYtT8+1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.104.11.34
country_id: 6252001
description:
Dec 18 19:02:38 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.104.11.34, lip=66.85.158.91, TLS, session=<09CY/jlGPISsaAsi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.222
country_id: 6252001
description:
Dec 18 19:03:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.236.228.222, lip=66.85.158.92, TLS, session=<2DLhADpGdNms7OTe>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 18 19:05:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<VsvnCTpGGNY+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.80.158
country_id: 1269750
description:
2025-12-18 19:06:39 dovecot_login authenticator failed for (victoryent.in) [111.93.80.158]:55550: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2025-12-18 19:07:00 dovecot_login authenticator failed for ([182.95.226.118]) [182.95.226.118]:43000: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.102.40.218
country_id: 6252001
description:
Dec 18 19:09:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=212.102.40.218, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<28FdFjpGvOrUZija>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 18 19:10:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<whXlGDpGhMA+PIdj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 18 19:11:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<emSbHjpGroc+PIde>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 93.118.137.48
country_id: 130758
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 93.118.137.48 - info@melanifinefood.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.95.222.74
country_id: 1269750
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 182.95.222.74 - info@ceylondigest.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 1.212.225.99
country_id: 1835841
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 1.212.225.99 - info@secondcoffeeinternational.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.133.47.11
country_id: 1522867
description:
2025-12-18 19:19:12 dovecot_login authenticator failed for (ADMIN) [62.133.47.11]:28747: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.154.77.48
country_id: 1643084
description:
Dec 18 19:19:25 host2 sshd[3330346]: Disconnected from invalid user prom 103.154.77.48 port 51212 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.49.89
country_id: 6252001
description:
Dec 18 19:19:30 host2 sshd[3330389]: Disconnected from invalid user wing 167.99.49.89 port 46356 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 18 19:20:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<RoSiPDpG/pQ+PIce>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.213.212.133
country_id: 1269750
description:
Dec 18 19:21:03 host2 sshd[3331853]: Disconnected from invalid user matin 4.213.212.133 port 54794 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.190.168
country_id: 1819730
description:
Dec 18 19:21:11 host2 sshd[3331921]: Disconnected from invalid user debian 152.32.190.168 port 52682 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.50.155
country_id: 1269750
description:
2025-12-18 19:22:01 dovecot_login authenticator failed for (abts-north-static-155.50.160.122.airtelbroadband.in) [122.160.50.155]:34211: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.202
country_id: 1149361
description:
2025-12-18 19:22:16 dovecot_login authenticator failed for ([180.94.75.202]) [180.94.75.202]:39517: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.190.168
country_id: 1819730
description:
Dec 18 19:23:04 host2 sshd[3332873]: Disconnected from invalid user myuser 152.32.190.168 port 37612 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 18 19:23:10 host2 pure-ftpd[3332961]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.49.89
country_id: 6252001
description:
Dec 18 19:23:11 host2 sshd[3332974]: Disconnected from invalid user debian 167.99.49.89 port 58716 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.56.59
country_id: 6252001
description:
Dec 18 19:23:51 host2 sshd[3333489]: Disconnected from invalid user samp 104.168.56.59 port 40676 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.213.212.133
country_id: 1269750
description:
Dec 18 19:23:16 host2 sshd[3333009]: Disconnected from invalid user anita 4.213.212.133 port 47196 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.192.46.29
country_id: 2542007
description:
Dec 18 19:23:29 host2 sshd[3333181]: Disconnected from invalid user uat 81.192.46.29 port 52062 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 167.99.49.89
country_id: 6252001
description:
Dec 18 19:24:16 host2 sshd[3334169]: Received disconnect from 167.99.49.89 port 56792:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 167.99.49.89
country_id: 6252001
description:
Dec 18 19:24:16 host2 sshd[3334169]: Disconnected from invalid user myuser 167.99.49.89 port 56792 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.4.244.179
country_id: 2661886
description:
Dec 18 19:24:19 host2 sshd[3334225]: Disconnected from invalid user hadoop 155.4.244.179 port 39342 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.192.46.29
country_id: 2542007
description:
Dec 18 19:24:40 host2 sshd[3334573]: Disconnected from invalid user ubuntu 81.192.46.29 port 48192 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.213.212.133
country_id: 1269750
description:
Dec 18 19:25:19 host2 sshd[3335085]: Disconnected from invalid user yesung 4.213.212.133 port 48710 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 155.4.244.179
country_id: 2661886
description:
Dec 18 19:26:19 host2 sshd[3335557]: Disconnected from invalid user jy 155.4.244.179 port 21848 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.56.59
country_id: 6252001
description:
Dec 18 19:26:55 host2 sshd[3335817]: Disconnected from invalid user reports 104.168.56.59 port 45796 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.213.212.133
country_id: 1269750
description:
Dec 18 19:27:25 host2 sshd[3336048]: Disconnected from invalid user weiqing 4.213.212.133 port 60218 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.56.59
country_id: 6252001
description:
Dec 18 19:27:30 host2 sshd[3336098]: Disconnected from invalid user willem 104.168.56.59 port 36200 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.168.56.59
country_id: 6252001
description:
Dec 18 19:28:04 host2 sshd[3336482]: Disconnected from invalid user deploy 104.168.56.59 port 56962 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.190.168
country_id: 1819730
description:
Dec 18 19:28:43 host2 sshd[3336895]: Disconnected from invalid user depot 152.32.190.168 port 51460 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.56.59
country_id: 6252001
description:
Dec 18 19:29:13 host2 sshd[3337382]: Disconnected from invalid user june 104.168.56.59 port 60710 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 18 19:30:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<y/Y7YTpGyOM+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 18 19:31:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<5IHUZTpGEqA+PIMh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.35
country_id: 6252001
description:
2025-12-18 19:39:11 dovecot_login authenticator failed for ([98.181.46.35]) [98.181.46.35]:51226: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.215.188.195
country_id: 192950
description:
2025-12-18 19:38:39 dovecot_login authenticator failed for ([102.215.188.195]) [102.215.188.195]:44771: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.183.221.168
country_id: 6252001
description:
2025-12-18 19:38:55 dovecot_login authenticator failed for wsip-70-183-221-168.br.br.cox.net [70.183.221.168]:51058: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.37.6
country_id: 6252001
description:
2025-12-18 19:39:16 dovecot_login authenticator failed for (ADMIN) [191.96.37.6]:63439: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 18 19:41:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<FucLizpGIok+PIce>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 18 19:42:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<OnmqjTpGrKo+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 18 19:44:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<e+6/kzpGdt8+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 18 19:45:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<g+qYljpGiow+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 18 19:47:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<1sihnTpGVKk+PIde>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 18 19:48:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<noPOoTpGMJA+PIdj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 18 19:50:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<8eIcqTpGYIw+PIMp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.4.106.201
country_id: 1210997
description:
Dec 18 19:56:13 host2 sshd[3356395]: Disconnected from invalid user up 202.4.106.201 port 54280 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 88.183.12.210
country_id: 3017382
description:
Dec 18 19:57:09 host2 sshd[3356944]: Disconnected from invalid user admin 88.183.12.210 port 5078 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 18 19:56:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<RR44vzpGvrk+PIdm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.31.51
country_id: 1819730
description:
Dec 18 19:57:57 host2 sshd[3357307]: Disconnected from invalid user guest 154.221.31.51 port 45678 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.174.238.116
country_id: 3996063
description:
Dec 18 19:57:24 host2 sshd[3357066]: Disconnected from invalid user parth 187.174.238.116 port 57036 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.143.255
country_id: 1880251
description:
Dec 18 19:58:45 host2 sshd[3357740]: Disconnected from invalid user ivan 101.47.143.255 port 59952 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.31.51
country_id: 1819730
description:
Dec 18 19:58:48 host2 sshd[3357766]: Disconnected from invalid user jack 154.221.31.51 port 57572 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.174.238.116
country_id: 3996063
description:
Dec 18 19:59:09 host2 sshd[3357954]: Disconnected from invalid user alex 187.174.238.116 port 37044 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.4.106.201
country_id: 1210997
description:
Dec 18 19:59:23 host2 sshd[3358060]: Disconnected from invalid user devops 202.4.106.201 port 45860 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.31.51
country_id: 1819730
description:
Dec 18 19:59:36 host2 sshd[3358203]: Disconnected from invalid user proxy 154.221.31.51 port 56810 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.174.238.116
country_id: 3996063
description:
Dec 18 19:59:45 host2 sshd[3358289]: Disconnected from invalid user clara 187.174.238.116 port 49188 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.24.76.30
country_id: 6252001
description:
2025-12-18 20:00:12 dovecot_login authenticator failed for (syn-047-024-076-030.res.spectrum.com) [47.24.76.30]:56610: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.211.96
country_id: 99237
description:
2025-12-18 20:00:45 dovecot_login authenticator failed for ([65.20.211.96]) [65.20.211.96]:51571: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.221.31.51
country_id: 1819730
description:
Dec 18 20:01:11 host2 sshd[3359617]: Disconnected from invalid user trac 154.221.31.51 port 60294 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.31.51
country_id: 1819730
description:
Dec 18 20:00:21 host2 sshd[3359103]: Disconnected from invalid user steamcmd 154.221.31.51 port 43484 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.61.170
country_id: 1861060
description:
Dec 18 20:00:28 host2 sshd[3359166]: Disconnected from invalid user xerox 118.193.61.170 port 48294 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.61.170
country_id: 1861060
description:
Dec 18 20:01:38 host2 sshd[3359949]: Disconnected from invalid user pepper 118.193.61.170 port 34052 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 18 20:01:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<Wey30TpGhqU+PIMp>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.130
country_id: 6252001
description:
Dec 18 20:01:21 host2 pure-ftpd[3359811]: (?@66.132.153.130) [INFO] New connection from 66.132.153.130


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.61.170
country_id: 1861060
description:
Dec 18 20:02:25 host2 sshd[3360490]: Disconnected from invalid user carl 118.193.61.170 port 43504 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.193.61.170
country_id: 1861060
description:
Dec 18 20:03:07 host2 sshd[3361151]: Disconnected from invalid user ec2-user 118.193.61.170 port 40004 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.11
country_id: 6252001
description:
Dec 18 20:02:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 18 secs): user=<>, rip=162.216.150.11, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<WOYl1DpGCdqi2JYL>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 18 20:04:03 host2 sshd[3361894]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.11
country_id: 6252001
description:
Dec 18 20:03:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=162.216.150.11, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<rWV52DpGRuyi2JYL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 18 20:03:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<MLTX2DpG6pQ+PIcd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 18 20:05:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<u1mw3TpGrpY+PIMh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.11
country_id: 6252001
description:
Dec 18 20:04:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 12 secs): user=<>, rip=162.216.150.11, lip=66.85.158.92, TLS: read(size=429) failed: Connection reset by peer, session=<mxn+2jpG8uSi2JYL>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 165.227.230.95
country_id: 2635167
description:
Dec 18 20:04:43 host2 sshd[3362423]: Received disconnect from 165.227.230.95 port 59286:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.227.230.95
country_id: 2635167
description:
Dec 18 20:04:43 host2 sshd[3362423]: Disconnected from invalid user ubuntu 165.227.230.95 port 59286 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 18 20:05:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<Z1Gu3zpGKus+PIdj>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.227.230.95
country_id: 2635167
description:
Dec 18 20:06:52 host2 sshd[3364153]: Disconnected from invalid user mary 165.227.230.95 port 45488 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.153.57.103
country_id: 2542007
description:
Dec 18 20:07:15 host2 sshd[3364521]: Disconnected from invalid user ales 197.153.57.103 port 36713 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.157.169
country_id: 2921044
description:
2025-12-18 20:07:22 dovecot_login authenticator failed for (ADMIN) [191.101.157.169]:53444: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.153.57.103
country_id: 2542007
description:
Dec 18 20:08:28 host2 sshd[3365375]: Disconnected from invalid user deploy 197.153.57.103 port 46797 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.153.57.103
country_id: 2542007
description:
Dec 18 20:09:03 host2 sshd[3365778]: Disconnected from invalid user user1 197.153.57.103 port 53619 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.27.94
country_id: 1643084
description:
Dec 18 20:09:26 host2 sshd[3365978]: Disconnected from invalid user user 103.179.27.94 port 57240 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.11
country_id: 6252001
description:
Dec 18 20:11:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.11, lip=66.85.158.92, TLS, session=<7hMX8zpGCuyi2JYL>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.179.27.94
country_id: 1643084
description:
Dec 18 20:11:57 host2 sshd[3367838]: Disconnected from invalid user applmgr 103.179.27.94 port 36386 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.11
country_id: 6252001
description:
Dec 18 20:12:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.11, lip=66.85.158.92, TLS, session=<J63Z9jpGIPGi2JYL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.143.255
country_id: 1880251
description:
Dec 18 20:11:26 host2 sshd[3367567]: Disconnected from invalid user wp 101.47.143.255 port 57022 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 18 20:14:13 host2 sshd[3369933]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.179.27.94
country_id: 1643084
description:
Dec 18 20:14:28 host2 sshd[3370112]: Disconnected from invalid user installer 103.179.27.94 port 52214 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 18 20:21:06 host2 sshd[3374954]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 18 20:20:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<Beg4FjtG2tHBHmEh>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.147.190.241
country_id: 1861060
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 141.147.190.241 - info@euroentertainmentlk.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 18 20:23:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<fY9JITtGCM8+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 18 20:25:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<3HFSJjtGVMs+PIcf>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 18 20:25:56 host2 pure-ftpd[3378235]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.94.79
country_id: 2623032
description:
2025-12-18 20:27:50 dovecot_login authenticator failed for (ADMIN) [188.126.94.79]:60442: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 18 20:29:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<WQ6mMztGDtM+PIdp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 18 20:28:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<W7wIMTtG3Jo+PIdf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.51.126.17
country_id: 6252001
description:
Dec 18 20:29:48 host2 sshd[3380416]: Disconnected from invalid user debian 158.51.126.17 port 48248 [preauth]


