# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-01-09 17:19:04 dovecot_login authenticator failed for H=([197.219.228.242]) [197.219.228.242]:56394: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.136
country_id: 6252001
description:
Jan  9 17:17:30 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.136, lip=66.85.158.92, TLS: Connection closed, session=<Ay0bF/NHWNdChJmI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.222
country_id: 2186224
description:
2026-01-09 17:18:45 dovecot_login authenticator failed for H=([121.73.169.222]) [121.73.169.222]:39806: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 17:27:12 host2 sshd[1723263]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.228.7
country_id: 2589581
description:
2026-01-09 17:32:18 dovecot_login authenticator failed for H=(ADMIN) [176.125.228.7]:27926: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.80.41.90
country_id: 3469034
description:
Jan  9 17:37:06 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=170.80.41.90, lip=66.85.158.91, TLS, session=<D47jW/NHatyqUCla>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.73.94
country_id: 1269750
description:
2026-01-09 17:36:23 dovecot_login authenticator failed for H=([125.19.196.193]) [182.78.73.94]:44982: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.184.80
country_id: 99237
description:
2026-01-09 17:37:23 dovecot_plain authenticator failed for H=(witormony) [65.20.184.80]:39711: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.170.1
country_id: 3175395
description:
Jan  9 17:37:29 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=185.15.170.1, lip=66.85.158.91, TLS, session=<ybNtXfNHkZa5D6oB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.162
country_id: 2993457
description:
Jan  9 17:40:04 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.162, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<XPHOZ/NHOf7CpRCi>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 17:41:37 host2 sshd[1734407]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.114
country_id: 1269750
description:
2026-01-09 17:42:48 dovecot_login authenticator failed for H=([152.52.238.86]) [182.95.184.114]:39298: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.208.46.130
country_id: 1522867
description:
2026-01-09 17:43:12 dovecot_login authenticator failed for H=([37.208.46.130]) [37.208.46.130]:39544: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.129.90.215
country_id: 2921044
description:
2026-01-09 17:43:49 dovecot_login authenticator failed for H=ns3241969.ip-57-129-90.eu [57.129.90.215]:55124: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.164.93.136
country_id: 6252001
description:
2026-01-09 17:45:49 dovecot_login authenticator failed for H=(syn-024-164-093-136.res.spectrum.com) [24.164.93.136]:44041: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2026-01-09 17:46:06 dovecot_login authenticator failed for H=([94.201.22.158]) [94.201.22.158]:60966: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.52.119.193
country_id: 6252001
description:
2026-01-09 17:55:10 dovecot_plain authenticator failed for H=c-68-52-119-193.hsd1.tn.comcast.net (recinspid) [68.52.119.193]:58028: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.57.224.221
country_id: 1168579
description:
2026-01-09 17:59:56 dovecot_login authenticator failed for H=([103.57.224.221]) [103.57.224.221]:44411: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 192.3.179.41
country_id: 6252001
description:
Jan  9 18:00:56 host2 sshd[1750779]: Disconnected from invalid user ubuntu 192.3.179.41 port 33114 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.81.142.124
country_id: 3996063
description:
2026-01-09 18:02:06 dovecot_login authenticator failed for H=(ADMIN) [77.81.142.124]:37796: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.3.179.41
country_id: 6252001
description:
Jan  9 18:02:31 host2 sshd[1751888]: Disconnected from invalid user admin 192.3.179.41 port 49968 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2026-01-09 18:03:06 dovecot_plain authenticator failed for H=c-174-166-153-20.hsd1.nj.comcast.net (copic) [174.166.153.20]:44588: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.161
country_id: 2993457
description:
Jan  9 18:03:18 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.161, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<jgnfuvNHuf/CpRCh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.67.22
country_id: 1269750
description:
2026-01-09 18:05:48 dovecot_login authenticator failed for H=([182.95.2.9]) [182.78.67.22]:37828: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.237.191
country_id: 99237
description:
2026-01-09 18:06:02 dovecot_login authenticator failed for H=([65.20.237.191]) [65.20.237.191]:55370: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.86
country_id: 1269750
description:
2026-01-09 18:06:09 dovecot_login authenticator failed for H=([27.123.119.191]) [122.184.127.86]:58824: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 4.213.160.153
country_id: 1269750
description:
Jan  9 18:05:16 host2 sshd[1754278]: Disconnected from invalid user ubuntu 4.213.160.153 port 60426 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2026-01-09 18:06:28 dovecot_plain authenticator failed for H=(ightner) [176.113.155.132]:38103: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.138
country_id: 1269750
description:
2026-01-09 18:06:13 dovecot_login authenticator failed for H=([125.19.174.244]) [128.185.201.138]:33390: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 134.209.102.173
country_id: 1880251
description:
2026-01-09 18:11:47 dovecot_login authenticator failed for H=([134.209.102.173]) [134.209.102.173]:42344: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.36.108
country_id: 3932488
description:
2026-01-09 18:11:22 dovecot_login authenticator failed for H=([190.223.36.108]) [190.223.36.108]:55244: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2026-01-09 18:16:29 dovecot_plain authenticator failed for H=(ratiocal) [80.227.102.242]:58963: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  9 18:24:53 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<t3L6B/RH+g6i8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  9 18:28:22 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<ZdxrFPRHSkyi8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.127.181.54
country_id: 390903
description:
2026-01-09 18:28:06 dovecot_login authenticator failed for H=(ADMIN) [79.127.181.54]:4818: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.248
country_id: 1880251
description:
Jan  9 18:28:18 host2 sshd[1776146]: Disconnected from invalid user user 45.78.201.248 port 39506 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2026-01-09 18:28:31 dovecot_plain authenticator failed for H=c-73-213-237-28.hsd1.va.comcast.net (petemet) [73.213.237.28]:59886: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.174.73.209
country_id: 798544
description:
Jan  9 18:32:54 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=46.174.73.209, lip=66.85.158.91, TLS, session=<mpLHI/RHStEurknR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.96.106.156
country_id: 3686110
description:
Jan  9 18:32:37 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=186.96.106.156, lip=66.85.158.91, TLS, session=<ohCrIvRHaLK6YGqc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.158.216
country_id: 2510769
description:
2026-01-09 18:35:31 dovecot_login authenticator failed for H=([207.188.158.216]) [207.188.158.216]:42707: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.130.148.217
country_id: 1512440
description:
2026-01-09 18:35:52 dovecot_login authenticator failed for H=([45.130.148.217]) [45.130.148.217]:49676: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.201.248
country_id: 1880251
description:
Jan  9 18:36:49 host2 sshd[1783586]: Disconnected from invalid user ubuntu 45.78.201.248 port 53424 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.128.229
country_id: 2921044
description:
Jan  9 18:36:51 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=46.101.128.229, lip=66.85.158.92, session=<vgvfMvRHVUYuZYDl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.248
country_id: 1880251
description:
Jan  9 18:38:11 host2 sshd[1784769]: Disconnected from invalid user admin 45.78.201.248 port 55098 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.158.10
country_id: 99237
description:
2026-01-09 18:44:56 dovecot_login authenticator failed for H=([65.20.158.10]) [65.20.158.10]:58169: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.177
country_id: 3175395
description:
Jan  9 18:44:59 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 27 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=185.15.171.177, lip=66.85.158.91, TLS, session=<V0phTvRHDq+5D6ux>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.202
country_id: 1269750
description:
2026-01-09 18:45:12 dovecot_login authenticator failed for H=([128.185.247.100]) [182.95.222.202]:44052: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.11.62
country_id: 690791
description:
Jan  9 18:45:15 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=176.103.11.62, lip=66.85.158.91, TLS, session=<0KnyT/RHAJSwZws+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.227.146.235
country_id: 2921044
description:
Jan  9 18:49:07 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=165.227.146.235, lip=66.85.158.92, session=<92fBXvRHBn2l45Lr>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.105.235.55
country_id: 3017382
description:
[2026-01-09 18:51:19 +0530] info [cpaneld] 46.105.235.55 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.237.27
country_id: 3625428
description:
2026-01-09 18:52:26 dovecot_login authenticator failed for H=(ADMIN) [95.181.237.27]:17617: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.10
country_id: 1269750
description:
2026-01-09 18:53:36 dovecot_login authenticator failed for H=([128.185.241.106]) [182.95.54.10]:41708: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2026-01-09 18:53:56 dovecot_login authenticator failed for H=([125.18.154.73]) [182.95.226.118]:52040: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.195.19.75
country_id: 1269750
description:
2026-01-09 18:55:20 dovecot_login authenticator failed for H=([47.247.80.227]) [14.195.19.75]:38408: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.102.148.242
country_id: 6252001
description:
2026-01-09 18:54:50 dovecot_login authenticator failed for H=syn-098-102-148-242.biz.spectrum.com [98.102.148.242]:33276: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.170.52
country_id: 3175395
description:
Jan  9 18:59:18 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=185.15.170.52, lip=66.85.158.91, TLS, session=<rEQlgvRHg9i5D6o0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.64.95.24
country_id: 3865483
description:
Jan  9 18:59:22 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=186.64.95.24, lip=66.85.158.91, TLS, session=<Ce41gvRHCMi6QF8Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2026-01-09 18:59:09 dovecot_plain authenticator failed for H=c-73-197-194-98.hsd1.nj.comcast.net (coning) [73.197.194.98]:43340: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.134.98.210
country_id: 3057568
description:
Jan  9 18:59:36 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<hr>, method=PLAIN, rip=31.134.98.210, lip=66.85.158.91, TLS, session=<bllGg/RHy84fhmLS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.101
country_id: 3469034
description:
Jan  9 18:59:44 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<hr>, method=PLAIN, rip=187.120.72.101, lip=66.85.158.91, TLS, session=<udaQg/RHXb67eEhl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.96.189.27
country_id: 298795
description:
2026-01-09 19:01:34 dovecot_plain authenticator failed for H=(unprobast) [85.96.189.27]:34798: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 19:02:59 host2 sshd[1809185]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 19:03:29 host2 sshd[1809778]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 19:06:00 host2 sshd[1810838]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.3.227.160
country_id: 1861060
description:
2026-01-09 19:06:09 dovecot_login authenticator failed for H=p7001161-ipoefx.ipoe.ocn.ne.jp [118.3.227.160]:46494: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.134
country_id: 1269750
description:
2026-01-09 19:05:31 dovecot_login authenticator failed for H=([182.95.230.134]) [182.95.230.134]:59450: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.254
country_id: 6252001
description:
2026-01-09 19:05:55 dovecot_login authenticator failed for H=([209.23.72.254]) [209.23.72.254]:52920: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  9 19:06:32 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<4pvunPRHQrMvWfaQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.111.136.21
country_id: 294640
description:
2026-01-09 19:06:35 dovecot_login authenticator failed for H=([84.111.136.21]) [84.111.136.21]:52523: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  9 19:08:37 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<ClZTpPRHhjii8Jp9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.68.70.41
country_id: 2921044
description:
Jan  9 19:09:49 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=138.68.70.41, lip=66.85.158.91, TLS handshaking: Connection closed, session=<eOrFqPRHQJyKREYp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  9 19:10:27 host2 sshd[1817937]: Disconnected from invalid user user 2.57.121.25 port 35923 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 19:10:34 host2 sshd[1817906]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 19:12:09 host2 sshd[1819526]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  9 19:12:01 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<0oKNsPRHSt8vWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  9 19:12:10 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<qBMNsfRHJiCi8Jp9>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 19:12:33 host2 sshd[1819981]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.33.130
country_id: 1149361
description:
2026-01-09 19:34:01 dovecot_login authenticator failed for H=([149.54.33.130]) [149.54.33.130]:49767: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.146
country_id: 1819730
description:
2026-01-09 19:34:10 dovecot_login authenticator failed for H=146.47.246.220.static.netvigator.com [220.246.47.146]:51495: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.195.66
country_id: 1269750
description:
2026-01-09 19:34:19 dovecot_login authenticator failed for H=([125.19.195.66]) [125.19.195.66]:57586: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.110
country_id: 1269750
description:
2026-01-09 19:34:27 dovecot_login authenticator failed for H=([27.123.111.110]) [27.123.111.110]:60518: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 34.122.105.182
country_id: 6252001
description:
Jan  9 19:35:13 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=34.122.105.182, lip=66.85.158.92, TLS: Connection closed, session=<KF2lA/VHGKEiemm2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.142.134
country_id: 1733045
description:
2026-01-09 19:34:53 dovecot_login authenticator failed for H=([49.124.142.134]) [49.124.142.134]:41970: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.115.144.103
country_id: 3469034
description:
2026-01-09 19:36:14 dovecot_login authenticator failed for H=(191.34.253.17.dynamic.adsl.gvt.net.br) [187.115.144.103]:53871: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.109.56.72
country_id: 6252001
description:
2026-01-09 19:36:54 dovecot_login authenticator failed for H=(dfw-206-109-56-72.ip4.99.network) [206.109.56.72]:55752: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  9 19:40:51 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<gpuhF/VHxKovWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.96.192.41
country_id: 3865483
description:
Jan  9 19:44:49 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=186.96.192.41, lip=66.85.158.91, TLS, session=<48bXJPVHEN26YMAp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2026-01-09 19:44:58 dovecot_plain authenticator failed for H=(herobtrows) [102.53.15.180]:46885: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.8
country_id: 3865483
description:
Jan  9 19:45:10 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=179.0.251.8, lip=66.85.158.91, TLS, session=<VSIaJvVHrsuzAPsI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.106.49.2
country_id: 6252001
description:
Jan  9 19:45:15 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.106.49.2, lip=66.85.158.92, session=<sBWHJ/VHmM8UajEC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  9 19:46:06 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<nSJoKvVHaoovWfaQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2026-01-09 19:47:18 dovecot_login authenticator failed for H=([182.95.226.118]) [182.95.226.118]:40476: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.51.40
country_id: 953987
description:
Jan  9 19:47:18 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=102.129.51.40, lip=66.85.158.91, TLS, session=<WxW0LfVHGtJmgTMo>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan  9 19:46:39 host2 pure-ftpd[1847803]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.143.216
country_id: 99237
description:
Jan  9 19:47:37 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=65.20.143.216, lip=66.85.158.91, TLS, session=<RCbyLvVH45NBFI/Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.7.171
country_id: 1733045
description:
2026-01-09 19:48:10 dovecot_login authenticator failed for H=([183.171.7.171]) [183.171.7.171]:46430: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.122.91.196
country_id: 2921044
description:
Jan  9 19:49:41 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=134.122.91.196, lip=66.85.158.92, TLS handshaking: Connection closed, session=<6atVN/VHWFSGelvE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  9 19:52:20 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<ZGmyQPVHYGWi8Jp9>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 19:54:41 host2 sshd[1853808]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan  9 19:55:04 host2 pure-ftpd[1854204]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.80.73
country_id: 2077456
description:
2026-01-09 19:55:10 dovecot_login authenticator failed for H=([120.157.80.73]) [120.157.80.73]:45818: 535 Incorrect authentication data (set_id=bostonlanka)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.195.19.75
country_id: 1269750
description:
2026-01-09 19:54:32 dovecot_login authenticator failed for H=([47.247.80.227]) [14.195.19.75]:33554: 535 Incorrect authentication data (set_id=bostonlanka@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  9 19:55:51 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<TVxETfVH9K+i8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.222.54
country_id: 1269750
description:
2026-01-09 19:56:37 dovecot_login authenticator failed for H=(nsg-corporate-54.222.187.122.airtel.in) [122.187.222.54]:41984: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.220.90
country_id: 1269750
description:
2026-01-09 19:56:51 dovecot_login authenticator failed for H=(dsl-tn-dynamic-137.209.22.125.airtelbroadband.in) [128.185.220.90]:60254: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.165
country_id: 99237
description:
2026-01-09 20:01:15 dovecot_plain authenticator failed for H=(entoot) [65.20.148.165]:60611: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.62
country_id: 1269750
description:
2026-01-09 20:05:54 dovecot_login authenticator failed for H=([182.95.58.62]) [182.95.58.62]:51686: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.244.34.15
country_id: 6252001
description:
2026-01-09 20:06:08 dovecot_login authenticator failed for H=(ADMIN) [143.244.34.15]:1599: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.196.42.114
country_id: 2077456
description:
2026-01-09 20:06:23 dovecot_login authenticator failed for H=([203.196.42.114]) [203.196.42.114]:41956: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 20:09:09 host2 sshd[1866182]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.193.105
country_id: 6252001
description:
Jan  9 20:09:37 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=20.65.193.105, lip=66.85.158.91, session=<7a+cfvVHSL8UQcFp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.223.232.26
country_id: 3469034
description:
2026-01-09 20:11:26 dovecot_login authenticator failed for H=(187-40-1-41.user.veloxzone.com.br) [200.223.232.26]:53015: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.109.56.74
country_id: 6252001
description:
2026-01-09 20:11:43 dovecot_login authenticator failed for H=(dfw-206-109-56-74.ip4.99.network) [206.109.56.74]:40208: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  9 20:13:19 host2 sshd[1870021]: Disconnected from invalid user admin 2.57.121.112 port 35461 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.142.134
country_id: 1733045
description:
2026-01-09 20:13:54 dovecot_login authenticator failed for H=([49.124.142.134]) [49.124.142.134]:54234: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.166
country_id: 1269750
description:
2026-01-09 20:14:07 dovecot_login authenticator failed for H=([125.19.175.250]) [122.185.146.166]:43764: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  9 20:14:51 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@lankaherbalsolutions.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<Sy04kfVH6LMvWfaQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.194.128.158
country_id: 1269750
description:
2026-01-09 20:16:59 dovecot_login authenticator failed for H=(static-158.128.194.14-tataidc.co.in) [14.194.128.158]:40950: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  9 20:20:07 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@sobaherbal.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<za0KpPVH+KsvWfaQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2026-01-09 20:26:16 dovecot_plain authenticator failed for H=c-73-213-237-28.hsd1.va.comcast.net (odichidan) [73.213.237.28]:45414: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.122
country_id: 6252001
description:
Jan  9 20:30:51 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 16 secs): user=<>, rip=66.132.153.122, lip=66.85.158.92, TLS handshaking: Connection closed, session=<AqWXyvVHoLZChJl6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.252.239
country_id: 6252001
description:
2026-01-09 20:31:39 dovecot_login authenticator failed for H=(ADMIN) [102.129.252.239]:46561: 535 Incorrect authentication data (set_id=hellow@venee.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.10
country_id: 1269750
description:
2026-01-09 20:32:35 dovecot_login authenticator failed for H=([125.20.249.192]) [27.123.113.10]:44460: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.138
country_id: 6252001
description:
Jan  9 20:34:29 host2 pure-ftpd[1886737]: (?@205.210.31.138) [INFO] New connection from 205.210.31.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.209.30
country_id: 1269750
description:
2026-01-09 20:35:32 dovecot_login authenticator failed for H=([128.185.209.30]) [128.185.209.30]:60114: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  9 20:36:30 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<g/Gv3vVHLuWi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  9 20:40:08 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<9E+e6/VHQumi8Jp9>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 1.52.36.172
country_id: 1562822
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 1.52.36.172 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.11.252.160
country_id: 3469034
description:
2026-01-09 20:39:26 dovecot_login authenticator failed for H=(187-11-252-160.dsl.telesp.net.br) [187.11.252.160]:52932: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.47.92.86
country_id: 1643084
description:
Jan  9 20:39:38 host2 sshd[1890797]: Disconnected from invalid user sandeep 38.47.92.86 port 43810 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.6.147
country_id: 3144096
description:
2026-01-09 20:40:05 dovecot_login authenticator failed for H=([78.156.6.147]) [78.156.6.147]:34383: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.38.215.165
country_id: 3175395
description:
Jan  9 20:41:31 host2 sshd[1892328]: Disconnected from invalid user subhadra 151.38.215.165 port 4080 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
country_id: 1880251
description:
2026-01-09 20:43:59 dovecot_login authenticator failed for H=(bb128-106-196-150.singnet.com.sg) [128.106.196.150]:19602: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.86
country_id: 1269750
description:
2026-01-09 20:44:26 dovecot_login authenticator failed for H=([27.123.119.191]) [122.184.127.86]:36536: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.47.92.86
country_id: 1643084
description:
Jan  9 20:45:17 host2 sshd[1895433]: Disconnected from invalid user bimal 38.47.92.86 port 50908 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.47.92.86
country_id: 1643084
description:
Jan  9 20:45:59 host2 sshd[1896201]: Disconnected from invalid user sivataben 38.47.92.86 port 49022 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.163
country_id: 2993457
description:
Jan  9 20:47:04 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.163, lip=66.85.158.92, session=<YhiTBPZHbf7CpRCj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.47.92.86
country_id: 1643084
description:
Jan  9 20:47:58 host2 sshd[1898196]: Disconnected from invalid user rupali 38.47.92.86 port 42510 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-09 20:47:25 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (unburidne) [87.103.126.54]:58837: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.228.7.54
country_id: 2510769
description:
2026-01-09 20:47:29 dovecot_login authenticator failed for H=54.net-94.228.7.isbl.embou.net [94.228.7.54]:50094: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.8
country_id: 2186224
description:
2026-01-09 20:47:56 dovecot_login authenticator failed for H=([121.73.163.8]) [121.73.163.8]:47876: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  9 20:49:03 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<U1GOC/ZHoJAvWfaQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.251.174
country_id: 1819730
description:
Jan  9 20:49:06 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=152.32.251.174, lip=66.85.158.91, TLS, session=<HJnUC/ZHliiYIPuu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.219
country_id: 798544
description:
2026-01-09 20:48:31 dovecot_login authenticator failed for H=89-67-37-219.dynamic.play.pl [89.67.37.219]:44481: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.55
country_id: 6252001
description:
Jan  9 20:48:37 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.55, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ILIgCvZHNbpAPsU3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.47
country_id: 6252001
description:
Jan  9 20:48:56 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.47, lip=66.85.158.91, TLS handshaking: Connection closed, session=<quQ4C/ZH6PVAPsUv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.251.174
country_id: 1819730
description:
Jan  9 20:49:12 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 3 secs): user=<>, rip=152.32.251.174, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<JfkzDPZHpiuYIPuu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.47
country_id: 6252001
description:
Jan  9 20:49:11 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.47, lip=66.85.158.91, TLS: Connection closed, session=<EpYmDPZHeLFAPsUv>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.38.215.165
country_id: 3175395
description:
Jan  9 20:54:10 host2 sshd[1902966]: Disconnected from invalid user surjit 151.38.215.165 port 4159 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  9 20:54:24 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<pWeyHvZHkNQvWfaQ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.38.215.165
country_id: 3175395
description:
Jan  9 20:54:48 host2 sshd[1903702]: Disconnected from invalid user vasant 151.38.215.165 port 4657 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.38.215.165
country_id: 3175395
description:
Jan  9 20:56:11 host2 sshd[1905067]: Disconnected from invalid user jayamma 151.38.215.165 port 4116 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.161.96.107
country_id: 6252001
description:
2026-01-09 20:59:34 dovecot_plain authenticator failed for H=c-73-161-96-107.hsd1.mi.comcast.net (salanded) [73.161.96.107]:40488: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2026-01-09 21:01:21 dovecot_plain authenticator failed for H=c-98-204-134-124.hsd1.md.comcast.net (butfughety) [98.204.134.124]:60694: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-09 21:04:27 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (sotering) [87.103.126.54]:44359: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 163.44.173.168
country_id: 1861060
description:
Jan  9 21:05:31 host2 sshd[1912939]: Disconnected from invalid user claude 163.44.173.168 port 43118 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2026-01-09 21:06:01 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:56436: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 163.44.173.168
country_id: 1861060
description:
Jan  9 21:06:15 host2 sshd[1913542]: Disconnected from invalid user test1 163.44.173.168 port 53970 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.0.212.86
country_id: 3469034
description:
Jan  9 21:06:27 host2 sshd[1913666]: Disconnected from invalid user teamspeak 177.0.212.86 port 40343 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.247.137.65
country_id: 3017382
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 84.247.137.65 - cloudtourssrilan "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.0.212.86
country_id: 3469034
description:
Jan  9 21:07:48 host2 sshd[1914615]: Disconnected from invalid user admin1 177.0.212.86 port 38326 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.170.3.81
country_id: 3996063
description:
Jan  9 21:08:08 host2 sshd[1914895]: Disconnected from invalid user postgres 187.170.3.81 port 51922 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.0.212.86
country_id: 3469034
description:
Jan  9 21:08:26 host2 sshd[1915213]: Disconnected from invalid user postgres 177.0.212.86 port 41081 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2026-01-09 21:08:42 dovecot_plain authenticator failed for H=c-67-172-54-29.hsd1.pa.comcast.net (fiereplary) [67.172.54.29]:58432: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.170.3.81
country_id: 3996063
description:
Jan  9 21:09:18 host2 sshd[1915873]: Disconnected from invalid user user 187.170.3.81 port 45836 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.170.3.81
country_id: 3996063
description:
Jan  9 21:10:31 host2 sshd[1917166]: Disconnected from invalid user claude 187.170.3.81 port 41828 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.170.3.81
country_id: 3996063
description:
Jan  9 21:11:32 host2 sshd[1917973]: Disconnected from invalid user teamspeak 187.170.3.81 port 35654 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 107.150.117.121
country_id: 2921044
description:
Jan  9 21:12:00 host2 pure-ftpd[1918335]: (?@107.150.117.121) [INFO] New connection from 107.150.117.121


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 107.150.117.121
country_id: 2921044
description:
Jan  9 21:12:19 host2 pure-ftpd[1918642]: (?@107.150.117.121) [INFO] New connection from 107.150.117.121


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 107.150.117.121
country_id: 2921044
description:
Jan  9 21:13:36 host2 pure-ftpd[1919917]: (?@107.150.117.121) [INFO] New connection from 107.150.117.121


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.217.144.65
country_id: 1643084
description:
Jan  9 21:13:54 host2 sshd[1920068]: Disconnected from invalid user claude 103.217.144.65 port 47566 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  9 21:21:38 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<vg/xf/ZH0mSi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  9 21:23:44 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<O3yVh/ZHoqUvWfaQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.18
country_id: 1269750
description:
2026-01-09 21:23:53 dovecot_login authenticator failed for H=([182.78.64.18]) [182.78.64.18]:34318: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.32.248
country_id: 1269750
description:
2026-01-09 21:25:04 dovecot_login authenticator failed for H=([136.232.73.130]) [49.37.32.248]:55500: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.196.92
country_id: 1819730
description:
2026-01-09 21:24:20 dovecot_login authenticator failed for H=(223-197-196-92.static.imsbiz.com) [223.197.196.92]:56072: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.247
country_id: 1269750
description:
2026-01-09 21:24:44 dovecot_login authenticator failed for H=(nsg-corporate-247.229.187.122.airtel.in) [122.187.229.247]:46474: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 21:25:56 host2 sshd[1928753]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  9 21:25:32 host2 sshd[1930053]: Disconnected from invalid user admin 2.57.121.112 port 52459 [preauth]


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 162.240.154.125
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[162.240.154.125] [Remote Port]=[41140] [Authentication Database]=[mail] [Username]=[support@bostonlanka.com] (10/10 failures) (blocked until [Sat Jan 10 15:55:20 2026 UTC/Sat Jan 10 21:25:20 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  9 21:25:22 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<9ghwjfZHtKCi8Jp9>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 47.89.246.144
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[47.89.246.144] [Remote Port]=[60564] [Authentication Database]=[mail] [Username]=[support@sobaherbal.com] (10/10 failures) (blocked until [Sat Jan 10 15:59:00 2026 UTC/Sat Jan 10 21:29:00 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  9 21:29:02 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<2lCNmvZHlOwvWfaQ>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.133
country_id: 6252001
description:
Jan  9 21:29:04 host2 pure-ftpd[1932560]: (?@66.132.153.133) [INFO] New connection from 66.132.153.133


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.47.136.38
country_id: 3175395
description:
Jan  9 21:32:06 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=185.47.136.38, lip=66.85.158.91, TLS, session=<J4SApPZHoIS5L4gm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.148.8.172
country_id: 1269750
description:
Jan  9 21:32:29 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=103.148.8.172, lip=66.85.158.91, TLS, session=<AR2+pfZHZrZnlAis>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.45.132.96
country_id: 3175395
description:
2026-01-09 21:38:04 dovecot_login authenticator failed for H=([151.45.132.96]) [151.45.132.96]:42690: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.134
country_id: 1269750
description:
2026-01-09 21:38:21 dovecot_login authenticator failed for H=([182.95.230.134]) [182.95.230.134]:42556: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-09 21:38:22 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (pyloid) [87.103.126.54]:13493: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.161.93.53
country_id: 1269750
description:
2026-01-09 21:38:44 dovecot_login authenticator failed for H=([103.161.93.53]) [103.161.93.53]:41825: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.188.130
country_id: 3144096
description:
2026-01-09 21:39:44 dovecot_login authenticator failed for H=([84.213.188.130]) [84.213.188.130]:55686: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.249.241
country_id: 3865483
description:
Jan  9 21:41:45 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info>, method=PLAIN, rip=179.0.249.241, lip=66.85.158.91, TLS, session=<lK3XxvZHRqKzAPnx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.202.108.134
country_id: 798544
description:
Jan  9 21:41:53 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=85.202.108.134, lip=66.85.158.91, TLS, session=<EaScx/ZHOM9VymyG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.22.233.230
country_id: 3175395
description:
Jan  9 21:41:20 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@jrdc.lk>, method=PLAIN, rip=171.22.233.230, lip=66.85.158.91, TLS, session=<XWWuxfZHMsarFunm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.254.163.126
country_id: 458258
description:
Jan  9 21:41:20 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@jrdc.lk>, method=PLAIN, rip=89.254.163.126, lip=66.85.158.91, TLS, session=<F+euxfZHKJNZ/qN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.143.216
country_id: 99237
description:
Jan  9 21:41:40 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=65.20.143.216, lip=66.85.158.91, TLS, session=<KgbFxvZHtbxBFI/Y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.192.106.243
country_id: 3469034
description:
Jan  9 21:41:32 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info@jrdc.lk>, method=PLAIN, rip=181.192.106.243, lip=66.85.158.91, TLS, session=<YHwDxvZHRuK1wGrz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.10.98
country_id: 226074
description:
Jan  9 21:41:36 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 27 secs): user=<info@jrdc.lk>, method=PLAIN, rip=196.0.10.98, lip=66.85.158.91, TLS, session=<MoD+xfZHkIPEAApi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.61.252
country_id: 953987
description:
Jan  9 21:41:44 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info>, method=PLAIN, rip=102.129.61.252, lip=66.85.158.91, TLS, session=<fFzKxvZHI6NmgT38>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.27.188
country_id: 798544
description:
Jan  9 21:41:51 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=178.216.27.188, lip=66.85.158.91, TLS, session=<DgZzx/ZHAe6y2Bu8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 128.127.94.77
country_id: 798544
description:
Jan  9 21:41:20 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@jrdc.lk>, method=PLAIN, rip=128.127.94.77, lip=66.85.158.91, TLS, session=<rpGuxfZHHM6Af15N>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.134.120
country_id: 1269750
description:
2026-01-09 21:42:22 dovecot_login authenticator failed for H=(abts-mum-static-120.134.179.122.airtelbroadband.in) [122.179.134.120]:58573: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.1.105.105
country_id: 1269750
description:
2026-01-09 21:42:44 dovecot_login authenticator failed for H=([61.1.105.105]) [61.1.105.105]:44791: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.129.13.184
country_id: 1880251
description:
2026-01-09 21:43:07 dovecot_login authenticator failed for H=(184.13.129.180.unknown.m1.com.sg) [180.129.13.184]:53723: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.84.162.177
country_id: 1861060
description:
2026-01-09 21:43:34 dovecot_login authenticator failed for H=177.162.84.34.bc.googleusercontent.com [34.84.162.177]:60634: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 21:44:21 host2 sshd[1944197]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  9 21:57:11 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<vksm//ZHeNkvWfaQ>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.76
country_id: 6252001
description:
Jan  9 21:57:54 host2 pure-ftpd[1955061]: (?@198.235.24.76) [INFO] New connection from 198.235.24.76


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 21:58:46 host2 sshd[1955705]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan  9 22:02:16 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<aX5jEfdHNsUvWfaQ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.249.192.30
country_id: 3625428
description:
Jan  9 22:02:18 host2 sshd[1958994]: Disconnected from invalid user laxman 201.249.192.30 port 54934 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2026-01-09 22:02:49 dovecot_plain authenticator failed for H=c-73-137-7-97.hsd1.ga.comcast.net (hially) [73.137.7.97]:49556: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.249.192.30
country_id: 3625428
description:
Jan  9 22:02:57 host2 sshd[1959655]: Disconnected from invalid user rajiya 201.249.192.30 port 13164 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.187.114.229
country_id: 2802361
description:
Jan  9 22:04:40 host2 pure-ftpd[1963040]: (?@35.187.114.229) [INFO] New connection from 35.187.114.229


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.67.155.120
country_id: 298795
description:
Jan  9 22:07:02 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=45.67.155.120, lip=66.85.158.91, TLS, session=<UxpvIfdH2cctQ5t4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.97.251.202
country_id: 798544
description:
Jan  9 22:06:41 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=176.97.251.202, lip=66.85.158.91, TLS, session=<GTY+IPdHcoqwYfvK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  9 22:07:36 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@nsteeleng.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<OaxoJPdHSFCi8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.188.130
country_id: 3144096
description:
2026-01-09 22:08:04 dovecot_login authenticator failed for H=(cm-84.213.188.130.get.no) [84.213.188.130]:45511: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.190.46
country_id: 2542007
description:
2026-01-09 22:08:33 dovecot_login authenticator failed for H=([105.73.190.46]) [105.73.190.46]:33070: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.91.0.68
country_id: 2750405
description:
Jan  9 22:09:40 host2 sshd[1977822]: Disconnected from invalid user vpn 34.91.0.68 port 35390 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.186.186.168
country_id: 49518
description:
Jan  9 22:10:51 host2 sshd[1978969]: Disconnected from invalid user testuser 41.186.186.168 port 38052 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  9 22:10:16 host2 sshd[1978454]: Disconnected from invalid user admin 2.57.121.112 port 27957 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  9 22:11:18 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<tsqsMfdHuu6i8Jp9>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.0.120.211
country_id: 226074
description:
Jan  9 22:11:21 host2 sshd[1979356]: Disconnected from invalid user vpn 196.0.120.211 port 38210 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.147.37.185
country_id: 3996063
description:
Jan  9 22:13:25 host2 sshd[1981574]: Disconnected from invalid user user 189.147.37.185 port 51308 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.147.37.185
country_id: 3996063
description:
Jan  9 22:14:02 host2 sshd[1982203]: Disconnected from invalid user vpn 189.147.37.185 port 35586 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.186.186.168
country_id: 49518
description:
Jan  9 22:16:51 host2 sshd[1985132]: Disconnected from invalid user server 41.186.186.168 port 58144 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan  9 22:16:57 host2 pure-ftpd[1985227]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.79.182.243
country_id: 2802361
description:
Jan  9 22:17:17 host2 pure-ftpd[1985520]: (?@34.79.182.243) [INFO] New connection from 34.79.182.243


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.128.128.212
country_id: 2077456
description:
2026-01-09 22:20:31 dovecot_login authenticator failed for H=(115-128-128-212.tpgi.com.au) [115.128.128.212]:59316: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.167
country_id: 2993457
description:
Jan  9 22:22:31 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.167, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<1U/uWfdHH//CpRCn>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan  9 22:24:30 host2 pure-ftpd[1991085]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 18.97.26.39
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 18.97.26.39: 250 connections per 30 seconds to 2078 port.


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 54.163.33.187
country_id: 6252001
description:
Jan  9 22:26:01 host2 pure-ftpd[1992868]: (?@54.163.33.187) [INFO] New connection from 54.163.33.187


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.221.216.189
country_id: 2635167
description:
Jan  9 22:29:07 host2 sshd[1995029]: Disconnected from invalid user claude 185.221.216.189 port 54954 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.221.216.189
country_id: 2635167
description:
Jan  9 22:29:40 host2 sshd[1995518]: Disconnected from invalid user ftpuser 185.221.216.189 port 38450 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.221.216.189
country_id: 2635167
description:
Jan  9 22:30:36 host2 sshd[1996274]: Disconnected from invalid user server 185.221.216.189 port 33702 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.128.181.199
country_id: 357994
description:
Jan  9 22:32:33 host2 sshd[1997584]: Disconnected from invalid user user2 41.128.181.199 port 39830 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.128.181.199
country_id: 357994
description:
Jan  9 22:33:39 host2 sshd[1998298]: Disconnected from invalid user test 41.128.181.199 port 50608 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.64
country_id: 6252001
description:
Jan  9 22:34:46 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.64, lip=66.85.158.91, session=<pJK4hfdHt2BBMQFA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.52
country_id: 6252001
description:
Jan  9 22:34:57 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.52, lip=66.85.158.91, TLS: Connection closed, session=<IjdnhvdHykhBMQE0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.128.181.199
country_id: 357994
description:
Jan  9 22:34:41 host2 sshd[1999266]: Disconnected from invalid user server 41.128.181.199 port 49390 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.137
country_id: 6252001
description:
Jan  9 22:34:46 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.137, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Swa6hfdHlrBAPsWJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.137
country_id: 6252001
description:
Jan  9 22:35:13 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.137, lip=66.85.158.91, TLS: Connection closed, session=<i09fh/dH9k9APsWJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-09 22:36:07 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (subclus) [87.103.126.54]:16737: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.227
country_id: 6252001
description:
Jan  9 22:38:09 host2 dovecot[1180436]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.227, lip=66.85.158.92, session=<DSrYkfdHDG2s7OTj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.157.244
country_id: 2264397
description:
2026-01-09 22:38:08 dovecot_plain authenticator failed for H=bl23-157-244.dsl.telepac.pt (fulity) [144.64.157.244]:37618: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.252
country_id: 2186224
description:
2026-01-09 22:37:39 dovecot_login authenticator failed for H=([121.73.168.252]) [121.73.168.252]:53606: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.220.90
country_id: 1269750
description:
2026-01-09 22:38:05 dovecot_login authenticator failed for H=(dsl-tn-dynamic-137.209.22.125.airtelbroadband.in) [128.185.220.90]:34310: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.227.236.175
country_id: 1861060
description:
Jan  9 22:41:50 host2 sshd[2005705]: Disconnected from invalid user pwan 156.227.236.175 port 50810 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.186
country_id: 6252001
description:
Jan  9 22:42:29 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 17 secs): user=<>, rip=147.185.133.186, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<AXJYofdHOM2TuYW6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  9 22:43:41 host2 sshd[2006869]: Disconnected from invalid user user 2.57.121.25 port 36771 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.161.145
country_id: 3469034
description:
2026-01-09 22:43:55 dovecot_login authenticator failed for H=(csbrasil.static.gvt.net.br) [179.185.161.145]:34725: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.76.55.177
country_id: 3175395
description:
2026-01-09 22:43:33 dovecot_login authenticator failed for H=([151.76.55.177]) [151.76.55.177]:40340: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.186
country_id: 6252001
description:
Jan  9 22:43:35 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 21 secs): user=<>, rip=147.185.133.186, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<jrNLpfdHnveTuYW6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.186
country_id: 6252001
description:
Jan  9 22:44:15 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 16 secs): user=<>, rip=147.185.133.186, lip=66.85.158.92, TLS: read(size=429) failed: Connection reset by peer, session=<XoWhp/dHKuGTuYW6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.112.102
country_id: 1269750
description:
2026-01-09 22:44:39 dovecot_login authenticator failed for H=([182.95.112.102]) [182.95.112.102]:51202: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.151.158
country_id: 3144096
description:
2026-01-09 22:44:55 dovecot_login authenticator failed for H=([84.210.151.158]) [84.210.151.158]:58567: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.227.236.175
country_id: 1861060
description:
Jan  9 22:45:43 host2 sshd[2009164]: Disconnected from invalid user ainal 156.227.236.175 port 59602 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.190.155.43
country_id: 6252001
description:
2026-01-09 22:46:47 dovecot_plain authenticator failed for H=(undionta) [76.190.155.43]:37136: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.227.236.175
country_id: 1861060
description:
Jan  9 22:46:21 host2 sshd[2009651]: Disconnected from invalid user pawan 156.227.236.175 port 54294 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.227.236.175
country_id: 1861060
description:
Jan  9 22:49:30 host2 sshd[2012145]: Disconnected from invalid user nasim 156.227.236.175 port 60598 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.186
country_id: 6252001
description:
Jan  9 22:50:47 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.133.186, lip=66.85.158.92, TLS, session=<IgQBv/dHQOuTuYW6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.72.184.60
country_id: 6252001
description:
2026-01-09 22:52:01 dovecot_login authenticator failed for H=24-72-184-24-72-184-60.cpe.sparklight.net [24.72.184.60]:34638: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.186
country_id: 6252001
description:
Jan  9 22:51:27 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.133.186, lip=66.85.158.92, TLS, session=<STthwfdHfvOTuYW6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.60.142
country_id: 1269750
description:
2026-01-09 22:51:26 dovecot_login authenticator failed for H=(nsg-corporate-142.60.186.122.airtel.in) [122.186.60.142]:38574: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  9 22:52:44 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<Ui/jxfdHXKei8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.142
country_id: 3865483
description:
Jan  9 22:53:01 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=179.0.251.142, lip=66.85.158.91, TLS, session=<RH/GxfdHHJSzAPuO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.18.99.10
country_id: 1269750
description:
2026-01-09 22:52:23 dovecot_login authenticator failed for H=([125.18.136.89]) [125.18.99.10]:51838: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.106.159
country_id: 3865483
description:
Jan  9 22:53:22 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=45.238.106.159, lip=66.85.158.91, TLS, session=<DOAkx/dHpI4t7mqf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.10
country_id: 798549
description:
Jan  9 22:55:16 host2 dovecot[1180436]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=85.217.149.10, lip=66.85.158.91, session=<l7gLz/dHTp9V2ZUK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.11
country_id: 6252001
description:
Jan  9 22:55:43 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.11, lip=66.85.158.92, TLS handshaking: Connection closed, session=<LFeu0PdHK6DDuEwL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.13
country_id: 6252001
description:
Jan  9 22:55:53 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=195.184.76.13, lip=66.85.158.92, TLS: Connection closed, session=<fQFJ0fdHf7fDuEwN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.14
country_id: 6252001
description:
Jan  9 22:56:07 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=195.184.76.14, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<Meoa0vdHT7nDuEwO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.232
country_id: 6252001
description:
Jan  9 22:56:10 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.232, lip=66.85.158.92, TLS: Connection closed, session=<HeBJ0vdHSZDDuEzo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2026-01-09 22:57:05 dovecot_plain authenticator failed for H=c-98-40-101-10.hsd1.tn.comcast.net (suppe) [98.40.101.10]:60470: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.6.147
country_id: 3144096
description:
2026-01-09 22:57:11 dovecot_login authenticator failed for H=([78.156.6.147]) [78.156.6.147]:48866: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  9 22:56:20 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<PwrB0vdHlDKi8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.75.93
country_id: 1880251
description:
2026-01-09 22:57:47 dovecot_login authenticator failed for H=([49.245.75.93]) [49.245.75.93]:46068: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.241.36.24
country_id: 1269750
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 43.241.36.24 - yashihol "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yashihol (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.233
country_id: 6252001
description:
Jan  9 23:01:56 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=195.184.76.233, lip=66.85.158.92, TLS: Connection closed, session=<EEzm5vdHtZPDuEzp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.13
country_id: 6252001
description:
Jan  9 23:02:11 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.13, lip=66.85.158.92, TLS: Connection closed, session=<yVLN5/dH36LDuEwN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.8
country_id: 6252001
description:
Jan  9 23:01:46 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.8, lip=66.85.158.92, TLS handshaking: Connection closed, session=<8ztK5vdHJeTDuEwI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.92
country_id: 1733045
description:
2026-01-09 23:07:04 dovecot_login authenticator failed for H=([49.125.201.92]) [49.125.201.92]:36616: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.177.9.119
country_id: 3865483
description:
2026-01-09 23:06:38 dovecot_login authenticator failed for H=(181-177-9-119.fiberway.com.ar) [181.177.9.119]:34802: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.204.127.54
country_id: 3469034
description:
Jan  9 23:09:21 host2 sshd[2029797]: Disconnected from invalid user test 138.204.127.54 port 46289 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.246.222.33
country_id: 732800
description:
Jan  9 23:11:05 host2 sshd[2031573]: Disconnected from invalid user postgres 185.246.222.33 port 54166 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2026-01-09 23:11:28 dovecot_login authenticator failed for H=([193.46.192.20]) [193.46.192.20]:42395: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.246.222.33
country_id: 732800
description:
Jan  9 23:11:35 host2 sshd[2031906]: Disconnected from invalid user steam 185.246.222.33 port 59644 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.59
country_id: 1733045
description:
2026-01-09 23:11:53 dovecot_login authenticator failed for H=([49.124.151.59]) [49.124.151.59]:39326: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.138
country_id: 2635167
description:
Jan  9 23:11:54 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 14 secs): user=<>, rip=35.203.211.138, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<oVuICvhHZ8gjy9OK>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.246.222.33
country_id: 732800
description:
Jan  9 23:12:06 host2 sshd[2032296]: Disconnected from invalid user testuser 185.246.222.33 port 41148 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.18
country_id: 1269750
description:
2026-01-09 23:12:19 dovecot_login authenticator failed for H=([182.95.58.18]) [182.95.58.18]:54266: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.246.222.33
country_id: 732800
description:
Jan  9 23:12:36 host2 sshd[2032826]: Disconnected from invalid user vpn 185.246.222.33 port 38950 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.138
country_id: 2635167
description:
Jan  9 23:13:24 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 13 secs): user=<>, rip=35.203.211.138, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<YkvpD/hHwOwjy9OK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.152
country_id: 6252001
description:
Jan  9 23:15:32 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.152, lip=66.85.158.92, TLS handshaking: Connection closed, session=<9daLF/hH0H1BMQGY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.156
country_id: 6252001
description:
Jan  9 23:15:14 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.156, lip=66.85.158.92, TLS handshaking: Connection closed, session=<0TB7FvhHj+xBMQGc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2026-01-09 23:17:43 dovecot_plain authenticator failed for H=(biveromens) [103.51.26.198]:47644: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.238.64
country_id: 6252001
description:
2026-01-09 23:18:39 dovecot_login authenticator failed for H=(ADMIN) [95.181.238.64]:18193: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.138
country_id: 2635167
description:
Jan  9 23:20:08 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.138, lip=66.85.158.91, TLS, session=<8H3+J/hHjvcjy9OK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  9 23:21:29 host2 sshd[2040446]: Disconnected from invalid user admin 2.57.121.112 port 16417 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.60.186
country_id: 1819730
description:
2026-01-09 23:26:29 dovecot_login authenticator failed for H=42-200-60-186.static.imsbiz.com [42.200.60.186]:64220: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.222
country_id: 3996063
description:
2026-01-09 23:27:04 dovecot_login authenticator failed for H=([177.236.146.222]) [177.236.146.222]:34300: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.207.4.58
country_id: 1269750
description:
Jan  9 23:27:50 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=103.207.4.58, lip=66.85.158.91, TLS, session=<tHdvQvhHY59nzwQ6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.28.190.207
country_id: 2510769
description:
Jan  9 23:28:08 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=139.28.190.207, lip=66.85.158.91, TLS, session=<+vCTQ/hH3rGLHL7P>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 23:32:57 host2 sshd[2051484]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.222
country_id: 1733045
description:
2026-01-09 23:32:41 dovecot_login authenticator failed for H=([49.124.152.222]) [49.124.152.222]:34054: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2026-01-09 23:37:13 dovecot_plain authenticator failed for H=c-98-204-134-124.hsd1.md.comcast.net (distitic) [98.204.134.124]:46666: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  9 23:37:44 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@nsteeleng.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<OqvFZvhHWtei8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  9 23:41:22 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<H3TPc/hHspGi8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.194.231
country_id: 3144096
description:
2026-01-09 23:43:08 dovecot_login authenticator failed for H=([178.232.194.231]) [178.232.194.231]:59857: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2026-01-09 23:44:03 dovecot_login authenticator failed for H=42-200-70-134.static.imsbiz.com [42.200.70.134]:39016: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.83.98
country_id: 1269750
description:
2026-01-09 23:43:46 dovecot_login authenticator failed for H=([182.71.132.193]) [182.79.83.98]:35920: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  9 23:47:18 host2 sshd[2065210]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-09 23:47:32 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (gatis) [87.103.126.54]:13900: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.159.14.187
country_id: 3469034
description:
2026-01-09 23:49:32 dovecot_login authenticator failed for H=(200-168-190-81.jandaia.com) [200.159.14.187]:35797: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 115.42.173.64
country_id: 1880251
description:
2026-01-09 23:49:44 H=([115.42.173.64]) [115.42.173.64]:55512 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<contact@bostonlanka.com> A=dovecot_login:contact@bostonlanka.com rejected RCPT <u1@frosttree.xyz>: Sender verify failed


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.146.90
country_id: 1643084
description:
Jan  9 23:55:13 host2 sshd[2073497]: Disconnected from invalid user teamspeak 103.187.146.90 port 60436 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.121.61.198
country_id: 3017382
description:
2026-01-09 23:55:38 dovecot_login authenticator failed for H=ip198.ip-91-121-61.eu (ADMIN) [91.121.61.198]:60454: 535 Incorrect authentication data (set_id=info@venee.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.187.146.90
country_id: 1643084
description:
Jan  9 23:55:55 host2 sshd[2074355]: Disconnected from invalid user admin 103.187.146.90 port 57884 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2026-01-09 23:57:03 dovecot_login authenticator failed for H=(ip-arana.net.id.as132673) [103.90.27.83]:38580: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.151.158
country_id: 3144096
description:
2026-01-09 23:56:42 dovecot_login authenticator failed for H=([84.210.151.158]) [84.210.151.158]:34223: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.96
country_id: 6252001
description:
Jan 10 00:03:21 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.96, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ooOPwvhHSdPG6xhg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.124
country_id: 1036973
description:
2026-01-10 00:13:06 dovecot_login authenticator failed for H=([196.28.226.124]) [196.28.226.124]:36627: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.21
country_id: 241170
description:
Jan 10 00:17:11 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.21, lip=66.85.158.91, session=<1s3b8/hHlqXE+2YV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.28.86.1
country_id: 1819730
description:
2026-01-10 00:16:55 dovecot_login authenticator failed for H=(113-28-86-1.static.imsbiz.com) [113.28.86.1]:63843: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.142.135
country_id: 1733045
description:
2026-01-10 00:18:17 dovecot_login authenticator failed for H=([49.124.142.135]) [49.124.142.135]:44124: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2026-01-10 00:18:33 dovecot_login authenticator failed for H=([125.20.249.39]) [128.185.214.78]:53246: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.210.91.174
country_id: 2963597
description:
Jan 10 00:18:37 host2 sshd[2097433]: Disconnected from invalid user deployerer 4.210.91.174 port 1024 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.23.160.197
country_id: 6252001
description:
Jan 10 00:19:28 host2 sshd[2098135]: Disconnected from invalid user vpn 198.23.160.197 port 39406 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.210.91.174
country_id: 2963597
description:
Jan 10 00:19:32 host2 sshd[2098161]: Disconnected from invalid user deployerer 4.210.91.174 port 1024 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 4.210.91.174
country_id: 2963597
description:
Jan 10 00:20:34 host2 sshd[2099365]: Disconnected from invalid user test1 4.210.91.174 port 1024 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 184.105.139.68
country_id: 6252001
description:
Jan 10 00:22:45 host2 pure-ftpd[2101550]: (?@184.105.139.68) [INFO] New connection from 184.105.139.68


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.118
country_id: 1269750
description:
2026-01-10 00:25:07 dovecot_login authenticator failed for H=([128.185.223.220]) [27.123.111.118]:57944: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.55.191.16
country_id: 3469034
description:
Jan 10 00:24:38 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=201.55.191.16, lip=66.85.158.91, TLS, session=<sLJ5DflHD7TJN78Q>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.231.114
country_id: 1269750
description:
2026-01-10 00:24:53 dovecot_login authenticator failed for H=([128.185.231.114]) [128.185.231.114]:43534: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.196.143.171
country_id: 3469034
description:
Jan 10 00:24:57 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=200.196.143.171, lip=66.85.158.91, TLS, session=<8Dm8DvlHJNfIxI+r>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.131
country_id: 6252001
description:
Jan 10 00:25:30 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.131, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<iG+7EflHRsLN0h+D>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.20
country_id: 241170
description:
Jan 10 00:27:29 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.20, lip=66.85.158.91, session=<l/CrGPlH1LjE+2YU>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan 10 00:32:42 host2 pure-ftpd[2110289]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.139.77
country_id: 3144096
description:
2026-01-10 00:34:53 dovecot_login authenticator failed for H=([188.124.139.77]) [188.124.139.77]:38133: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.114
country_id: 1149361
description:
2026-01-10 00:35:13 dovecot_login authenticator failed for H=([149.54.62.114]) [149.54.62.114]:54874: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.108
country_id: 1819730
description:
Jan 10 00:36:01 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=45.142.154.108, lip=66.85.158.92, TLS, session=<70BaN/lH1qktjpps>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.108
country_id: 1819730
description:
Jan 10 00:36:14 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=45.142.154.108, lip=66.85.158.92, TLS handshaking: Connection closed, session=<OLAgOPlHbLYtjpps>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan 10 00:39:44 host2 pure-ftpd[2116843]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.54.70.40
country_id: 3686110
description:
2026-01-10 00:40:55 dovecot_login authenticator failed for H=(static-ip-1815407040.cable.net.co) [181.54.70.40]:34578: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.59.154
country_id: 1269750
description:
2026-01-10 00:41:16 dovecot_login authenticator failed for H=([182.95.25.48]) [182.95.59.154]:43206: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.123.45.2
country_id: 1269750
description:
2026-01-10 00:41:34 dovecot_login authenticator failed for H=([103.123.45.2]) [103.123.45.2]:60602: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.181.79.60
country_id: 1819730
description:
2026-01-10 00:46:12 dovecot_login authenticator failed for H=([65.181.79.60]) [65.181.79.60]:50472: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 104.234.152.3
country_id: 3469034
description:
Denial of Service (DoS) attack was discovered from 104.234.152.3: 250 connections per 30 seconds to 443 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 104.234.152.1
country_id: 3469034
description:
Denial of Service (DoS) attack was discovered from 104.234.152.1: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.164.251.182
country_id: 6252001
description:
2026-01-10 00:46:31 dovecot_login authenticator failed for H=216-164-251-182.s9140.c3-0.eas-cbr4.atw-eas.pa.cable.rcncustomer.com [216.164.251.182]:44358: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.194
country_id: 1269750
description:
2026-01-10 00:48:57 dovecot_login authenticator failed for H=(nsg-corporate-194.229.187.122.airtel.in) [122.187.229.194]:43112: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.53.234
country_id: 3932488
description:
2026-01-10 00:49:06 dovecot_login authenticator failed for H=([190.223.53.234]) [190.223.53.234]:34238: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.203
country_id: 3469034
description:
Jan 10 00:48:21 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=190.89.136.203, lip=66.85.158.91, TLS, session=<bapVYvlHmsK+WYjL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2026-01-10 00:48:23 dovecot_login authenticator failed for H=([178.150.135.19]) [178.150.135.19]:28481: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.213
country_id: 1269750
description:
2026-01-10 00:48:37 dovecot_login authenticator failed for H=([122.187.230.213]) [122.187.230.213]:37271: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.111
country_id: 3469034
description:
Jan 10 00:48:43 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=187.120.72.111, lip=66.85.158.91, TLS, session=<cAijY/lHAtm7eEhv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.239.213.201
country_id: 3175395
description:
2026-01-10 00:48:50 dovecot_login authenticator failed for H=2-239-213-201.ip251.fastwebnet.it [2.239.213.201]:5681: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.237.47.214
country_id: 3996063
description:
2026-01-10 00:48:23 dovecot_login authenticator failed for H=(customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:36324: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.18
country_id: 6252001
description:
Jan 10 00:49:48 host2 dovecot[1180436]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=162.216.150.18, lip=66.85.158.92, session=<Wc6gaPlHLuSi2JYS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-10 00:52:08 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (desting) [87.103.126.54]:52376: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2026-01-10 00:53:44 dovecot_login authenticator failed for H=(ip-arana.net.id.as132673) [103.90.27.83]:42894: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.132.40.41
country_id: 6252001
description:
2026-01-10 00:53:58 dovecot_login authenticator failed for H=([216.132.40.41]) [216.132.40.41]:37803: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2026-01-10 00:55:35 dovecot_plain authenticator failed for H=(fiege) [23.30.11.253]:49227: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2026-01-10 01:01:46 dovecot_plain authenticator failed for H=c-71-235-225-181.hsd1.ct.comcast.net (guffe) [71.235.225.181]:57078: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.55
country_id: 6252001
description:
Jan 10 01:04:37 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.55, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<r0WjnflHTMvG6xg3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.67
country_id: 6252001
description:
Jan 10 01:05:09 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.139.67, lip=66.85.158.91, session=<kLyIn/lH6pS4aYtD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.67
country_id: 6252001
description:
Jan 10 01:05:22 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.139.67, lip=66.85.158.91, TLS: Connection closed, session=<koxUoPlHWv+4aYtD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2026-01-10 01:09:43 dovecot_plain authenticator failed for H=(uncuset) [24.104.225.201]:39031: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2026-01-10 01:10:04 dovecot_plain authenticator failed for H=(heomi) [91.73.188.251]:57393: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.228.190.124
country_id: 3865483
description:
2026-01-10 01:11:13 dovecot_login authenticator failed for H=(45-228-190-124.obercom.net.ar) [45.228.190.124]:37338: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.205
country_id: 337996
description:
2026-01-10 01:11:41 dovecot_login authenticator failed for H=([196.188.187.205]) [196.188.187.205]:34076: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.211.94.35
country_id: 289688
description:
2026-01-10 01:15:37 dovecot_login authenticator failed for H=([37.211.94.35]) [37.211.94.35]:22753: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.105.218.147
country_id: 1694008
description:
2026-01-10 01:15:57 dovecot_login authenticator failed for H=([124.105.219.170]) [124.105.218.147]:40834: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 01:21:04 host2 sshd[2156263]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.118
country_id: 6252001
description:
Jan 10 01:23:38 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.118, lip=66.85.158.92, TLS, session=<rT2t4flHUunG6xh2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.46.148.180
country_id: 6252001
description:
2026-01-10 01:29:42 dovecot_plain authenticator failed for H=c-68-46-148-180.hsd1.mi.comcast.net (gertemism) [68.46.148.180]:54438: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2026-01-10 01:29:45 dovecot_plain authenticator failed for H=217-215-74-195-no2620.tbcn.telia.com (ungal) [217.215.74.195]:39128: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.50
country_id: 1269750
description:
2026-01-10 01:32:29 dovecot_login authenticator failed for H=([182.95.63.50]) [182.95.63.50]:36792: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.62.87.27
country_id: 3469034
description:
Jan 10 01:32:41 host2 sshd[2166119]: Disconnected from invalid user postgres 187.62.87.27 port 57646 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.112.6
country_id: 1269750
description:
2026-01-10 01:32:43 dovecot_login authenticator failed for H=(nsg-corporate-129.186.186.122.airtel.in) [27.123.112.6]:36204: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.62.87.27
country_id: 3469034
description:
Jan 10 01:33:38 host2 sshd[2166695]: Disconnected from invalid user user 187.62.87.27 port 37606 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 207.90.244.14
country_id: 6252001
description:
Jan 10 01:35:07 host2 dovecot[1180436]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=207.90.244.14, lip=66.85.158.92, session=<ZPe7CvpHpLvPWvQO>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.62.87.27
country_id: 3469034
description:
Jan 10 01:34:15 host2 sshd[2167067]: Disconnected from invalid user user 187.62.87.27 port 44000 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 01:35:17 host2 sshd[2167962]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.14
country_id: 6252001
description:
Jan 10 01:35:08 host2 dovecot[1180436]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=207.90.244.14, lip=66.85.158.92, session=<3wDJCvpHwLvPWvQO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.10.252.119
country_id: 1643084
description:
Jan 10 01:36:44 host2 sshd[2168901]: Disconnected from invalid user server 157.10.252.119 port 42674 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 157.10.252.119
country_id: 1643084
description:
Jan 10 01:37:22 host2 sshd[2169432]: Disconnected from invalid user testuser 157.10.252.119 port 43326 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.88.10.10
country_id: 2328926
description:
2026-01-10 01:40:05 dovecot_plain authenticator failed for H=(obale) [102.88.10.10]:49616: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 10 01:42:03 host2 sshd[2173494]: Disconnected from invalid user admin 2.57.121.112 port 35888 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.111.208.241
country_id: 1149361
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 172.111.208.241 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.142.157
country_id: 3017382
description:
2026-01-10 01:49:55 dovecot_login authenticator failed for H=157.ip-51-75-142.eu [51.75.142.157]:50824: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.174
country_id: 1269750
description:
2026-01-10 01:50:07 dovecot_login authenticator failed for H=([182.95.178.174]) [182.95.178.174]:36002: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.246.106
country_id: 1269750
description:
2026-01-10 01:51:26 dovecot_login authenticator failed for H=([125.16.255.97]) [125.20.246.106]:41230: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.10
country_id: 1269750
description:
2026-01-10 01:51:52 dovecot_login authenticator failed for H=(abts-north-dynamic-121.212.66.182.airtelbroadband.in) [27.123.113.10]:57650: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.192.74.183
country_id: 6252001
description:
2026-01-10 01:52:57 dovecot_plain authenticator failed for H=c-98-192-74-183.hsd1.ga.comcast.net (vieverida) [98.192.74.183]:53084: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.142
country_id: 6252001
description:
Jan 10 01:54:56 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.142, lip=66.85.158.92, TLS: Connection closed, session=<xJ2aUfpHMsNAPpyO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.68
country_id: 6252001
description:
Jan 10 01:54:29 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=216.218.206.68, lip=66.85.158.92, session=<KA8BUPpHFFTY2s5E>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.149
country_id: 6252001
description:
Jan 10 01:54:45 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.149, lip=66.85.158.92, session=<LHbuUPpHOYxAPpyV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.142
country_id: 6252001
description:
Jan 10 01:55:08 host2 dovecot[1180436]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=64.62.156.142, lip=66.85.158.92, session=<vJVSUvpHvqpAPpyO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.9.133
country_id: 2635167
description:
Jan 10 02:00:48 host2 sshd[2189827]: Disconnected from invalid user ftpuser 185.196.9.133 port 56498 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.196.9.133
country_id: 2635167
description:
Jan 10 02:01:16 host2 sshd[2190253]: Disconnected from invalid user admin 185.196.9.133 port 47492 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.9.133
country_id: 2635167
description:
Jan 10 02:02:14 host2 sshd[2191039]: Disconnected from invalid user steam 185.196.9.133 port 48722 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2026-01-10 02:02:50 dovecot_login authenticator failed for H=(ip-arana.net.id.as132673) [103.90.27.83]:52372: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.106
country_id: 1269750
description:
2026-01-10 02:03:25 dovecot_login authenticator failed for H=(nsg-corporate-121.229.185.122.airtel.in) [122.186.202.106]:44066: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.106
country_id: 1880251
description:
Jan 10 02:04:57 host2 sshd[2192953]: Disconnected from invalid user test 45.78.230.106 port 47110 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Jan 10 02:06:13 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.91, TLS: Connection closed, session=<vezuefpH1JSLonHU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.144.14.204
country_id: 1210997
description:
2026-01-10 02:07:26 dovecot_login authenticator failed for H=([122.144.14.204]) [122.144.14.204]:59621: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.18
country_id: 1269750
description:
2026-01-10 02:07:55 dovecot_login authenticator failed for H=([125.20.231.218]) [182.95.58.18]:38112: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.230.106
country_id: 1880251
description:
Jan 10 02:08:03 host2 sshd[2195761]: Disconnected from invalid user test 45.78.230.106 port 33134 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.144.20
country_id: 3996063
description:
2026-01-10 02:08:08 dovecot_login authenticator failed for H=([177.236.144.20]) [177.236.144.20]:50744: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.22.116.94
country_id: 1269750
description:
2026-01-10 02:15:52 dovecot_login authenticator failed for H=([152.52.234.222]) [125.22.116.94]:56224: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.150.115
country_id: 1819730
description:
2026-01-10 02:16:11 dovecot_login authenticator failed for H=115.150.48.116.static.netvigator.com [116.48.150.115]:58247: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.250.36
country_id: 1562822
description:
Jan 10 02:17:24 host2 dovecot[1180436]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=152.32.250.36, lip=66.85.158.91, session=<MVb0ofpHQpuYIPok>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.166
country_id: 2635167
description:
Jan 10 02:17:44 host2 dovecot[1180436]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.166, lip=66.85.158.91, TLS, session=<NCkmo/pHke2594mm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.250.36
country_id: 1562822
description:
Jan 10 02:19:17 host2 dovecot[1180436]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=152.32.250.36, lip=66.85.158.92, session=<mx2rqPpHkJqYIPok>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.252
country_id: 1880251
description:
Jan 10 02:21:00 host2 sshd[2207235]: Disconnected from invalid user steam 45.78.201.252 port 38162 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.118.215.192
country_id: 3865483
description:
2026-01-10 02:21:29 dovecot_login authenticator failed for H=(red.138.118.215.192.ssservicios.com.ar) [138.118.215.192]:38487: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.165
country_id: 6252001
description:
Jan 10 02:21:40 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=205.210.31.165, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<w8E0sfpHcNfN0h+l>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.134.27.194
country_id: 1210997
description:
2026-01-10 02:21:17 dovecot_login authenticator failed for H=([103.134.27.194]) [103.134.27.194]:40244: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.205.169
country_id: 1733045
description:
2026-01-10 02:23:36 dovecot_login authenticator failed for H=([49.124.205.169]) [49.124.205.169]:33528: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.214.209.153
country_id: 6252001
description:
Jan 10 02:29:56 host2 sshd[2210793]: Disconnected from invalid user ftpuser 172.214.209.153 port 58504 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.214.209.153
country_id: 6252001
description:
Jan 10 02:30:33 host2 sshd[2211460]: Disconnected from invalid user deployerer 172.214.209.153 port 56760 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.214.209.153
country_id: 6252001
description:
Jan 10 02:31:09 host2 sshd[2211735]: Disconnected from invalid user ftpuser 172.214.209.153 port 50354 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.214.209.153
country_id: 6252001
description:
Jan 10 02:31:46 host2 sshd[2211888]: Disconnected from invalid user vpn 172.214.209.153 port 50570 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.201.252
country_id: 1880251
description:
Jan 10 02:33:02 host2 sshd[2212250]: Disconnected from invalid user steam 45.78.201.252 port 59418 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.54
country_id: 1733045
description:
2026-01-10 02:34:35 dovecot_login authenticator failed for H=([49.124.151.54]) [49.124.151.54]:42638: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.194.190
country_id: 1269750
description:
2026-01-10 02:35:12 dovecot_login authenticator failed for H=([128.185.194.190]) [128.185.194.190]:33952: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.183
country_id: 3144096
description:
2026-01-10 02:35:40 dovecot_login authenticator failed for H=([84.213.189.183]) [84.213.189.183]:52697: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.174.182.38
country_id: 2077456
description:
2026-01-10 02:35:59 dovecot_login authenticator failed for H=203-174-182-38.ade.static-ipl.aapt.com.au [203.174.182.38]:59837: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.224.240.74
country_id: 6252001
description:
Jan 10 02:39:30 host2 sshd[2215353]: Disconnected from invalid user user1 52.224.240.74 port 60296 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.197.41
country_id: 1861060
description:
Jan 10 02:40:18 host2 sshd[2215869]: Disconnected from invalid user deployerer 160.251.197.41 port 46638 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 146.190.79.63
country_id: 6252001
description:
Jan 10 02:40:51 host2 sshd[2216168]: Disconnected from invalid user frappe 146.190.79.63 port 45416 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.197.41
country_id: 1861060
description:
Jan 10 02:40:57 host2 sshd[2216204]: Disconnected from invalid user steam 160.251.197.41 port 59328 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.109.221
country_id: 2921044
description:
Jan 10 02:41:19 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=157.230.109.221, lip=66.85.158.92, TLS, session=<wlNx9/pHftSd5m3d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.19
country_id: 241170
description:
Jan 10 02:41:23 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.19, lip=66.85.158.91, session=<ncCO9/pHOtXE+2YT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.89.154.59
country_id: 285570
description:
Jan 10 02:41:26 host2 sshd[2216420]: Disconnected from invalid user steam 78.89.154.59 port 54298 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.89.154.59
country_id: 285570
description:
Jan 10 02:41:59 host2 sshd[2216576]: Disconnected from invalid user user2 78.89.154.59 port 39366 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.10
country_id: 241170
description:
Jan 10 02:42:08 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.10, lip=66.85.158.91, session=<Jp9I+vpHdIHE+2YK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.79.63
country_id: 6252001
description:
Jan 10 02:42:10 host2 sshd[2216672]: Disconnected from invalid user server 146.190.79.63 port 36910 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 78.89.154.59
country_id: 285570
description:
Jan 10 02:42:32 host2 sshd[2216779]: Disconnected from invalid user steam 78.89.154.59 port 39502 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.193
country_id: 3865483
description:
Jan 10 02:44:36 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=179.0.252.193, lip=66.85.158.91, TLS, session=<XG0KAvtHGJyzAPzB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 189.201.197.8
country_id: 3469034
description:
Jan 10 02:44:14 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=189.201.197.8, lip=66.85.158.91, TLS, session=<RevXAPtHPMG9ycUI>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 52.224.240.74
country_id: 6252001
description:
Jan 10 02:45:55 host2 sshd[2218802]: Disconnected from invalid user server 52.224.240.74 port 34890 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan 10 02:46:14 host2 pure-ftpd[2218943]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2026-01-10 02:48:36 dovecot_plain authenticator failed for H=(huctomat) [91.73.188.251]:57161: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2026-01-10 02:50:02 dovecot_plain authenticator failed for H=c-71-224-169-28.hsd1.pa.comcast.net (cabing) [71.224.169.28]:53282: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan 10 02:53:07 host2 pure-ftpd[2223969]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.19.197
country_id: 6252001
description:
Jan 10 03:01:45 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=18.97.19.197, lip=66.85.158.92, TLS handshaking: Connection closed, session=<PMqLQPtHNsISYRPF>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 03:07:56 host2 sshd[2236422]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.190
country_id: 1269750
description:
2026-01-10 03:13:11 dovecot_login authenticator failed for H=([27.123.98.190]) [27.123.98.190]:58532: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Jan 10 03:15:35 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.92, TLS: Connection closed, session=<I1oIcvtHCJKLonHU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 10 03:17:48 host2 sshd[2245205]: Disconnected from invalid user admin 2.57.121.112 port 27465 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.116.31.97
country_id: 3017382
description:
Jan 10 03:17:54 host2 sshd[2245317]: Disconnected from invalid user vpn 89.116.31.97 port 36158 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.67.56.52
country_id: 1643084
description:
Jan 10 03:19:07 host2 sshd[2246322]: Disconnected from invalid user claude 36.67.56.52 port 5043 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.242.142
country_id: 1269750
description:
2026-01-10 03:20:43 dovecot_login authenticator failed for H=([125.19.172.137]) [182.78.242.142]:39376: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.50
country_id: 1269750
description:
2026-01-10 03:21:05 dovecot_login authenticator failed for H=(aes-static-225.77.144.59.airtel.in) [182.95.123.50]:41202: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 03:22:03 host2 sshd[2249237]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.67.56.52
country_id: 1643084
description:
Jan 10 03:21:32 host2 sshd[2248786]: Disconnected from invalid user vpn 36.67.56.52 port 5046 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.67.56.52
country_id: 1643084
description:
Jan 10 03:22:09 host2 sshd[2249280]: Disconnected from invalid user tester 36.67.56.52 port 5047 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.116.31.97
country_id: 3017382
description:
Jan 10 03:23:22 host2 sshd[2250290]: Disconnected from invalid user user2 89.116.31.97 port 57660 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.27.237
country_id: 2077456
description:
2026-01-10 03:25:04 dovecot_login authenticator failed for H=([120.157.27.237]) [120.157.27.237]:46396: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 89.116.31.97
country_id: 3017382
description:
Jan 10 03:24:32 host2 sshd[2251214]: Disconnected from invalid user admin1 89.116.31.97 port 47506 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.116.31.97
country_id: 3017382
description:
Jan 10 03:25:07 host2 sshd[2251806]: Disconnected from invalid user teamspeak 89.116.31.97 port 59370 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.96.62.29
country_id: 1269750
description:
2026-01-10 03:25:45 dovecot_login authenticator failed for H=([59.96.62.29]) [59.96.62.29]:56728: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.27
country_id: 2186224
description:
2026-01-10 03:30:12 dovecot_login authenticator failed for H=([121.73.163.27]) [121.73.163.27]:58740: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.63.52.54
country_id: 3469034
description:
2026-01-10 03:30:40 dovecot_login authenticator failed for H=(201-91-74-17.customer.tdatabrasil.net.br) [201.63.52.54]:41619: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.165.130.26
country_id: 1643084
description:
Jan 10 03:30:59 host2 sshd[2257466]: Disconnected from invalid user user 103.165.130.26 port 2763 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.74
country_id: 6252001
description:
Jan 10 03:34:01 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.74, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<D4Dts/tHg8vN0h9K>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2026-01-10 03:33:38 dovecot_plain authenticator failed for H=(puthitie) [24.105.248.218]:40692: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2026-01-10 03:34:50 dovecot_plain authenticator failed for H=c-73-168-136-150.hsd1.il.comcast.net (verodizo) [73.168.136.150]:33724: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.210.246.54
country_id: 289688
description:
2026-01-10 03:35:03 dovecot_login authenticator failed for H=([37.210.246.54]) [37.210.246.54]:19523: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.44.40
country_id: 1522867
description:
2026-01-10 03:40:35 dovecot_plain authenticator failed for H=(unwash) [5.76.44.40]:35415: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.82
country_id: 1269750
description:
2026-01-10 03:42:33 dovecot_login authenticator failed for H=([125.17.225.97]) [182.95.61.82]:43040: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.214.49.194
country_id: 6252001
description:
2026-01-10 03:42:47 dovecot_login authenticator failed for H=wsip-72-214-49-194.hr.hr.cox.net [72.214.49.194]:39478: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.83.130.80
country_id: 1269750
description:
2026-01-10 03:45:18 dovecot_login authenticator failed for H=(80.130.83.103.static.rapidnet.in) [103.83.130.80]:51626: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.30
country_id: 1269750
description:
2026-01-10 03:46:27 dovecot_login authenticator failed for H=([125.22.154.57]) [182.95.119.30]:46186: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.29.26
country_id: 3144096
description:
2026-01-10 03:47:36 dovecot_login authenticator failed for H=(cm-178.232.29.26.get.no) [178.232.29.26]:48009: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 192.155.90.118
country_id: 6252001
description:
Jan 10 03:47:40 host2 dovecot[1180436]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=192.155.90.118, lip=66.85.158.92, TLS, session=<ykPI5PtHUGrAm1p2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 128.203.200.235
country_id: 6251999
description:
Jan 10 03:49:08 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=128.203.200.235, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<VEv86ftHus6Ay8jr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.233.116.124
country_id: 1269750
description:
Jan 10 03:52:53 host2 sshd[2279089]: Disconnected from invalid user ubuntu 68.233.116.124 port 20542 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2026-01-10 03:54:41 dovecot_login authenticator failed for H=([83.136.176.12]) [83.136.176.12]:46818: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.233.116.124
country_id: 1269750
description:
Jan 10 03:55:04 host2 sshd[2281531]: Disconnected from invalid user server 68.233.116.124 port 49968 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.233.116.124
country_id: 1269750
description:
Jan 10 03:56:14 host2 sshd[2282737]: Disconnected from invalid user teamspeak 68.233.116.124 port 16486 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.202
country_id: 1149361
description:
2026-01-10 04:00:41 dovecot_login authenticator failed for H=([180.94.75.202]) [180.94.75.202]:48046: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.146
country_id: 1819730
description:
2026-01-10 04:00:53 dovecot_login authenticator failed for H=146.47.246.220.static.netvigator.com [220.246.47.146]:56542: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.207.252
country_id: 6252001
description:
Jan 10 04:02:51 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=45.79.207.252, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<rFsPG/xHW5otT8/8>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.154.234.9
country_id: 1522867
description:
Jan 10 04:03:21 host2 sshd[2289403]: Disconnected from invalid user ftpuser 212.154.234.9 port 32218 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-10 04:05:01 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (ephaurnic) [87.103.126.54]:53179: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.144.124.91
country_id: 6252001
description:
Jan 10 04:05:27 host2 sshd[2291868]: Disconnected from invalid user user1 24.144.124.91 port 49956 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 212.154.234.9
country_id: 1522867
description:
Jan 10 04:05:53 host2 sshd[2292340]: Disconnected from invalid user frappe 212.154.234.9 port 54541 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.144.124.91
country_id: 6252001
description:
Jan 10 04:08:40 host2 sshd[2295219]: Disconnected from invalid user ftpuser 24.144.124.91 port 43590 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 24.144.124.91
country_id: 6252001
description:
Jan 10 04:09:37 host2 sshd[2296326]: Disconnected from invalid user frappe 24.144.124.91 port 57574 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.106.155
country_id: 3469034
description:
2026-01-10 04:11:00 dovecot_login authenticator failed for H=(177-174-106-155.user.vivozap.com.br) [177.174.106.155]:34527: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.102.40.218
country_id: 6252001
description:
Jan 10 04:10:13 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=212.102.40.218, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<JQlhNfxHEC3UZija>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.22
country_id: 241170
description:
Jan 10 04:10:26 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.22, lip=66.85.158.91, session=<d2oENvxHfsjE+2YW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.41.122
country_id: 1269750
description:
2026-01-10 04:10:37 dovecot_login authenticator failed for H=([125.23.243.66]) [125.23.41.122]:47198: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.228.53.174
country_id: 6252001
description:
Jan 10 04:11:40 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.228.53.174, lip=66.85.158.92, TLS, session=<2NuZOvxHGjVC5DWu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.19.200.63
country_id: 660013
description:
2026-01-10 04:13:28 dovecot_login authenticator failed for H=([146.19.200.63]) [146.19.200.63]:34222: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.51
country_id: 3144096
description:
2026-01-10 04:14:07 dovecot_login authenticator failed for H=(51-170-97-62.cust.smartcall.no) [62.97.170.51]:39600: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 128.203.201.155
country_id: 6251999
description:
Jan 10 04:14:20 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=128.203.201.155, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<w+MfRPxHjoCAy8mb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 10 04:16:23 host2 sshd[2304314]: Disconnected from invalid user admin 2.57.121.112 port 12580 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.209.108.42
country_id: 6254930
description:
2026-01-10 04:17:54 dovecot_plain authenticator failed for H=(oyane) [185.209.108.42]:37406: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2026-01-10 04:17:49 dovecot_plain authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net (calerify) [71.62.34.216]:34950: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.242.73.39
country_id: 6252001
description:
[2026-01-10 04:18:12 +0530] info [webmaild] 91.242.73.39 - env_eng@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.179.59.99
country_id: 6252001
description:
[2026-01-10 04:18:13 +0530] info [webmaild] 186.179.59.99 - lezzarotech@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.221.130
country_id: 1269750
description:
2026-01-10 04:18:53 dovecot_login authenticator failed for H=(nsg-corporate-130.221.187.122.airtel.in) [122.187.221.130]:43202: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2026-01-10 04:19:11 dovecot_login authenticator failed for H=([103.251.31.154]) [103.251.31.154]:51032: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.227.254.155
country_id: 3703430
description:
Jan 10 04:19:11 host2 pure-ftpd[2307226]: (?@45.227.254.155) [INFO] New connection from 45.227.254.155


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.132.221.84
country_id: 1210997
description:
2026-01-10 04:19:25 dovecot_login authenticator failed for H=([103.132.220.252]) [103.132.221.84]:52208: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.146
country_id: 1819730
description:
2026-01-10 04:19:39 dovecot_login authenticator failed for H=146.47.246.220.static.netvigator.com [220.246.47.146]:52300: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.129
country_id: 6252001
description:
Jan 10 04:20:40 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 22 secs): user=<>, rip=66.132.153.129, lip=66.85.158.92, TLS handshaking: Connection closed, session=<nULHWvxHfulChJmB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-10 04:23:01 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (windo) [87.103.126.54]:7098: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.124
country_id: 6252001
description:
Jan 10 04:24:52 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.124, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<r6XGafxHbMzG6xh8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.207
country_id: 1733045
description:
2026-01-10 04:26:36 dovecot_login authenticator failed for H=([49.124.148.207]) [49.124.148.207]:56904: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.63.110
country_id: 3144096
description:
2026-01-10 04:26:45 dovecot_login authenticator failed for H=([84.214.63.110]) [84.214.63.110]:46066: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.190.155.43
country_id: 6252001
description:
2026-01-10 04:27:32 dovecot_plain authenticator failed for H=(agery) [76.190.155.43]:53833: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.83.98
country_id: 1269750
description:
2026-01-10 04:29:46 dovecot_login authenticator failed for H=([182.71.132.193]) [182.79.83.98]:55888: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2026-01-10 04:30:24 dovecot_login authenticator failed for H=(syn-065-191-211-033.res.spectrum.com) [65.191.211.33]:51828: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.110.189.45
country_id: 2750405
description:
2026-01-10 04:33:37 dovecot_login authenticator failed for H=([193.110.189.45]) [193.110.189.45]:45123: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.126
country_id: 1269750
description:
2026-01-10 04:34:16 dovecot_login authenticator failed for H=(nsg-corporate-190.152.185.122.airtel.in) [182.95.178.126]:56514: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2026-01-10 04:34:27 dovecot_plain authenticator failed for H=c-73-197-194-98.hsd1.nj.comcast.net (mitingly) [73.197.194.98]:58662: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2026-01-10 04:35:58 dovecot_login authenticator failed for H=([90.160.139.163]) [90.160.139.163]:51418: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2026-01-10 04:36:26 dovecot_login authenticator failed for H=([193.46.192.20]) [193.46.192.20]:52201: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.0.183.222
country_id: 3865483
description:
Jan 10 04:39:14 host2 sshd[2329859]: Disconnected from invalid user hari 200.0.183.222 port 51476 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.196.92
country_id: 1819730
description:
2026-01-10 04:42:20 dovecot_login authenticator failed for H=([223.197.196.92]) [223.197.196.92]:60698: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.201.62
country_id: 1269750
description:
2026-01-10 04:42:26 dovecot_login authenticator failed for H=(nsg-corporate-226.215.186.122.airtel.in) [122.186.201.62]:57466: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.253.154
country_id: 1269750
description:
2026-01-10 04:42:36 dovecot_login authenticator failed for H=([125.21.56.137]) [125.19.253.154]:53106: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.161.232.9
country_id: 6252001
description:
2026-01-10 04:43:11 dovecot_login authenticator failed for H=ip98-161-232-9.ph.ph.cox.net [98.161.232.9]:47706: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.0.183.222
country_id: 3865483
description:
Jan 10 04:44:47 host2 sshd[2334130]: Disconnected from invalid user sameer 200.0.183.222 port 50964 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.0.183.222
country_id: 3865483
description:
Jan 10 04:45:33 host2 sshd[2335025]: Disconnected from invalid user lavanya 200.0.183.222 port 36508 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.26.82.247
country_id: 298795
description:
2026-01-10 04:46:09 dovecot_plain authenticator failed for H=(enich) [5.26.82.247]:43192: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 5.181.87.33
country_id: 298795
description:
Jan 10 04:46:17 host2 sshd[2335507]: Disconnected from invalid user sameer 5.181.87.33 port 43310 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.0.183.222
country_id: 3865483
description:
Jan 10 04:46:26 host2 sshd[2335585]: Disconnected from invalid user krishan 200.0.183.222 port 45290 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.181.87.33
country_id: 298795
description:
Jan 10 04:47:22 host2 sshd[2336578]: Disconnected from invalid user a 5.181.87.33 port 38966 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2026-01-10 04:54:03 dovecot_plain authenticator failed for H=(undisker) [12.150.243.22]:28976: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.23
country_id: 241170
description:
Jan 10 04:54:02 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.23, lip=66.85.158.91, session=<WDX10fxHrJ7E+2YX>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 04:54:43 host2 sshd[2342456]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 13.89.125.227
country_id: 6252001
description:
Jan 10 04:56:43 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=13.89.125.227, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<rjG12/xHIskNWX3j>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.165.200
country_id: 6252001
description:
Jan 10 04:57:59 host2 dovecot[1180436]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=71.6.165.200, lip=66.85.158.91, TLS, session=<czc+4PxHhNlHBqXI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.165.200
country_id: 6252001
description:
Jan 10 04:57:59 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=71.6.165.200, lip=66.85.158.91, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<lGY/4PxHZtpHBqXI>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan 10 04:59:20 host2 pure-ftpd[2346062]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.33.186.151
country_id: 3686110
description:
Jan 10 05:03:51 host2 sshd[2348168]: Disconnected from invalid user claude 179.33.186.151 port 37014 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.93
country_id: 2750405
description:
Jan 10 05:04:36 host2 sshd[2348404]: Disconnected from invalid user jyotsna 20.123.146.93 port 48467 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 68.183.3.153
country_id: 2750405
description:
Jan 10 05:04:45 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=68.183.3.153, lip=66.85.158.91, TLS: Connection closed, session=<FaRz+PxHgoJEtwOZ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.33.186.151
country_id: 3686110
description:
Jan 10 05:05:43 host2 sshd[2349155]: Disconnected from invalid user test1 179.33.186.151 port 17433 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan 10 05:06:16 host2 pure-ftpd[2349369]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.33.186.151
country_id: 3686110
description:
Jan 10 05:06:26 host2 sshd[2349403]: Disconnected from invalid user deployerer 179.33.186.151 port 15650 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.33.186.151
country_id: 3686110
description:
Jan 10 05:07:40 host2 sshd[2349807]: Disconnected from invalid user claude 179.33.186.151 port 52263 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 05:08:47 host2 sshd[2350240]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.20
country_id: 6252001
description:
Jan 10 05:08:43 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.20, lip=66.85.158.92, session=<LV+XBv1HUenDuEwU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.22
country_id: 6252001
description:
Jan 10 05:08:53 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=195.184.76.22, lip=66.85.158.92, session=<ykcyB/1H85nDuEwW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.117
country_id: 6252001
description:
Jan 10 05:09:07 host2 dovecot[1180436]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=195.184.76.117, lip=66.85.158.92, session=<X7kGCP1H1czDuEx1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.114
country_id: 6252001
description:
Jan 10 05:09:10 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.114, lip=66.85.158.92, session=<l302CP1Hw8vDuExy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.200.181.42
country_id: 3686110
description:
Jan 10 05:09:30 host2 sshd[2350519]: Disconnected from invalid user test1 152.200.181.42 port 59338 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.238.104
country_id: 1643084
description:
Jan 10 05:09:39 host2 sshd[2350576]: Disconnected from invalid user test1 103.49.238.104 port 37670 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.200.181.42
country_id: 3686110
description:
Jan 10 05:10:32 host2 sshd[2351356]: Disconnected from invalid user user2 152.200.181.42 port 37572 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.190.22.247
country_id: 2750405
description:
Jan 10 05:11:35 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=146.190.22.247, lip=66.85.158.91, session=<WvfEEP1HyN2Svhb3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.200.181.42
country_id: 3686110
description:
Jan 10 05:11:46 host2 sshd[2351894]: Disconnected from invalid user ubuntu 152.200.181.42 port 44040 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.154
country_id: 3144096
description:
2026-01-10 05:11:52 dovecot_login authenticator failed for H=(cm-84.213.189.154.get.no) [84.213.189.154]:39334: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.49.238.104
country_id: 1643084
description:
Jan 10 05:11:54 host2 sshd[2351947]: Disconnected from invalid user testuser 103.49.238.104 port 51658 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.238.2.7
country_id: 3469034
description:
2026-01-10 05:12:14 dovecot_login authenticator failed for H=45-238-2-7.netmaisfibra.net.br [45.238.2.7]:55024: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.130
country_id: 6252001
description:
Jan 10 05:14:13 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.130, lip=66.85.158.92, TLS: Connection closed, session=<S5dOGv1HxmxChJmC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-10 05:15:29 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (fersishea) [87.103.126.54]:45048: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.150.115
country_id: 1819730
description:
2026-01-10 05:15:40 dovecot_login authenticator failed for H=115.150.48.116.static.netvigator.com [116.48.150.115]:57538: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.213.242
country_id: 3469034
description:
2026-01-10 05:16:25 dovecot_login authenticator failed for H=([200.149.213.242]) [200.149.213.242]:34708: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.207.210.23
country_id: 2960313
description:
2026-01-10 05:16:33 dovecot_plain authenticator failed for H=(scushes) [88.207.210.23]:64172: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.166.137.91
country_id: 6252001
description:
2026-01-10 05:16:54 dovecot_login authenticator failed for H=wsip-70-166-137-91.fv.ks.cox.net [70.166.137.91]:48372: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.110.150
country_id: 660013
description:
2026-01-10 05:17:02 dovecot_login authenticator failed for H=([45.82.110.150]) [45.82.110.150]:33664: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.238.122
country_id: 2542007
description:
2026-01-10 05:17:19 dovecot_login authenticator failed for H=([154.146.238.122]) [154.146.238.122]:56024: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.93
country_id: 2750405
description:
Jan 10 05:19:40 host2 sshd[2356068]: Disconnected from invalid user mary 20.123.146.93 port 50371 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2026-01-10 05:19:53 dovecot_login authenticator failed for H=([62.220.236.203]) [62.220.236.203]:48012: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.49.63.41
country_id: 3469034
description:
2026-01-10 05:20:22 dovecot_login authenticator failed for H=customer-187-49-63-41.f1net.com.br [187.49.63.41]:44264: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.94
country_id: 2750405
description:
Jan 10 05:21:27 host2 sshd[2357428]: Disconnected from invalid user radheshyam 20.123.146.94 port 36673 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.42.225.40
country_id: 2510769
description:
2026-01-10 05:24:23 dovecot_login authenticator failed for H=40.red-81-42-225.staticip.rima-tde.net [81.42.225.40]:35050: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.144.27.228
country_id: 6252001
description:
2026-01-10 05:25:04 dovecot_plain authenticator failed for H=c-73-144-27-228.hsd1.mi.comcast.net (repteed) [73.144.27.228]:39020: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.79.182.243
country_id: 2802361
description:
Jan 10 05:25:05 host2 pure-ftpd[2360564]: (?@34.79.182.243) [INFO] New connection from 34.79.182.243


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2026-01-10 05:25:11 dovecot_login authenticator failed for H=(138.219.244.10.static.softdados.net) [177.128.209.48]:58160: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.95
country_id: 2750405
description:
Jan 10 05:25:13 host2 sshd[2360592]: Disconnected from invalid user httpd 20.123.146.95 port 14888 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.76.134.123
country_id: 2802361
description:
Jan 10 05:25:56 host2 pure-ftpd[2361273]: (?@34.76.134.123) [INFO] New connection from 34.76.134.123


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.246.209.138
country_id: 798544
description:
Jan 10 05:26:23 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=91.246.209.138, lip=66.85.158.91, TLS, session=<WA3SRP1HC8tb9tGK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.117.16.118
country_id: 3865483
description:
Jan 10 05:26:43 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=138.117.16.118, lip=66.85.158.91, TLS, session=<Bk7qRf1HZsiKdRB2>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.92
country_id: 2750405
description:
Jan 10 05:26:59 host2 sshd[2362012]: Disconnected from invalid user krishan 20.123.146.92 port 24313 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 130.250.191.228
country_id: 1269750
description:
Jan 10 05:35:07 host2 sshd[2368467]: Disconnected from invalid user server 130.250.191.228 port 43926 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 130.250.191.228
country_id: 1269750
description:
Jan 10 05:35:47 host2 sshd[2369097]: Disconnected from invalid user test1 130.250.191.228 port 55448 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.195.66
country_id: 1269750
description:
2026-01-10 05:37:29 dovecot_login authenticator failed for H=([128.185.169.25]) [125.19.195.66]:50746: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.204.124.32
country_id: 1269750
description:
2026-01-10 05:37:40 dovecot_login authenticator failed for H=([49.204.124.32]) [49.204.124.32]:51630: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.57.141
country_id: 6252001
description:
Jan 10 05:37:49 host2 sshd[2370825]: Disconnected from invalid user frappe 198.98.57.141 port 54492 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2026-01-10 05:38:06 dovecot_login authenticator failed for H=(85-19-195-12.telia-isp.no) [85.19.195.12]:40892: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.98.57.141
country_id: 6252001
description:
Jan 10 05:37:08 host2 sshd[2370252]: Disconnected from invalid user test 198.98.57.141 port 43370 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.57.141
country_id: 6252001
description:
Jan 10 05:38:25 host2 sshd[2371288]: Disconnected from invalid user test1 198.98.57.141 port 37386 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2026-01-10 05:40:32 dovecot_login authenticator failed for H=([189.59.210.1]) [186.215.245.175]:38272: 535 Incorrect authentication data (set_id=postmaster@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.82
country_id: 2077456
description:
2026-01-10 05:40:55 dovecot_login authenticator failed for H=210.0.90.82.static.nexnet.net.au [210.0.90.82]:37506: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.209.108.42
country_id: 6254930
description:
2026-01-10 05:43:28 dovecot_plain authenticator failed for H=(selly) [185.209.108.42]:51208: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.122.91.196
country_id: 2921044
description:
Jan 10 05:44:01 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=134.122.91.196, lip=66.85.158.92, TLS, session=<HYrchP1H+GGGelvE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.122.91.196
country_id: 2921044
description:
Jan 10 05:44:11 host2 dovecot[1180436]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=134.122.91.196, lip=66.85.158.92, session=<c2Jthf1H/JKGelvE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.229.197.38
country_id: 3996063
description:
Jan 10 05:48:38 host2 sshd[2379831]: Disconnected from invalid user user1 177.229.197.38 port 35480 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.156.67.18
country_id: 6252001
description:
Jan 10 05:50:47 host2 sshd[2382050]: Disconnected from invalid user teamspeak 12.156.67.18 port 45176 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.229.197.38
country_id: 3996063
description:
Jan 10 05:52:29 host2 sshd[2383211]: Disconnected from invalid user user 177.229.197.38 port 49572 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.229.197.38
country_id: 3996063
description:
Jan 10 05:53:01 host2 sshd[2383694]: Disconnected from invalid user user 177.229.197.38 port 40188 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.6.193.137
country_id: 6252001
description:
Jan 10 05:53:45 host2 sshd[2384280]: Disconnected from invalid user claude 50.6.193.137 port 43364 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.229.197.38
country_id: 3996063
description:
Jan 10 05:54:07 host2 sshd[2384587]: Disconnected from invalid user server 177.229.197.38 port 33600 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.77.220.188
country_id: 203312
description:
Jan 10 05:56:00 host2 sshd[2387134]: Disconnected from invalid user server 41.77.220.188 port 52512 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.132.181.70
country_id: 1522867
description:
2026-01-10 05:56:09 dovecot_login authenticator failed for H=2.132.181.70.dynamic.telecom.kz [2.132.181.70]:53869: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.255.189.56
country_id: 298795
description:
2026-01-10 05:56:18 dovecot_login authenticator failed for H=(88.255.189.56.static.ttnet.com.tr) [88.255.189.56]:36363: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.202
country_id: 2186224
description:
2026-01-10 05:56:34 dovecot_login authenticator failed for H=([121.73.163.202]) [121.73.163.202]:33602: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 85.121.54.7
country_id: 2750405
description:
Jan 10 05:57:02 host2 sshd[2388065]: Disconnected from invalid user azureuser 85.121.54.7 port 38542 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.6.193.137
country_id: 6252001
description:
Jan 10 05:56:28 host2 sshd[2387594]: Disconnected from invalid user azureuser 50.6.193.137 port 39162 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.6.193.137
country_id: 6252001
description:
Jan 10 05:58:03 host2 sshd[2388912]: Disconnected from invalid user ubuntu 50.6.193.137 port 37192 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.227.237.176
country_id: 1861060
description:
Jan 10 05:58:25 host2 sshd[2389126]: Disconnected from invalid user user2 156.227.237.176 port 37808 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 15.235.140.46
country_id: 1880251
description:
Jan 10 05:58:43 host2 sshd[2389296]: Disconnected from invalid user teamspeak 15.235.140.46 port 61572 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.230.3
country_id: 1880251
description:
Jan 10 06:02:22 host2 sshd[2392614]: Disconnected from invalid user ubuntu 45.78.230.3 port 36690 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-01-10 06:01:44 dovecot_plain authenticator failed for H=(soncon) [64.72.74.162]:40273: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.3
country_id: 1880251
description:
Jan 10 06:03:35 host2 sshd[2393623]: Disconnected from invalid user vpn 45.78.230.3 port 53626 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.133.156.133
country_id: 294640
description:
2026-01-10 06:06:17 dovecot_login authenticator failed for H=([195.133.156.133]) [195.133.156.133]:51383: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.255.189.56
country_id: 298795
description:
2026-01-10 06:06:40 dovecot_login authenticator failed for H=([88.255.189.56]) [88.255.189.56]:50192: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.216.213.140
country_id: 2921044
description:
[2026-01-10 06:07:07 +0530] info [cpaneld] 185.216.213.140 - lezzarotech "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2026-01-10 06:07:36 dovecot_plain authenticator failed for H=c-73-197-194-98.hsd1.nj.comcast.net (quition) [73.197.194.98]:41066: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2026-01-10 06:08:47 dovecot_plain authenticator failed for H=(thempion) [176.113.155.132]:41358: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 06:10:01 host2 sshd[2399611]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.134.100
country_id: 690791
description:
Jan 10 06:10:27 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=37.221.134.100, lip=66.85.158.91, TLS, session=<NHFl4v1HJI4l3YZk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.63.133.72
country_id: 3175395
description:
Jan 10 06:10:45 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=185.63.133.72, lip=66.85.158.91, TLS, session=</1J64/1H84C5P4VI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.206.54
country_id: 1269750
description:
2026-01-10 06:11:21 dovecot_login authenticator failed for H=([182.95.3.57]) [125.19.206.54]:35092: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-01-10 06:11:40 dovecot_login authenticator failed for H=([197.219.228.242]) [197.219.228.242]:49394: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.119.2
country_id: 226074
description:
Jan 10 06:12:04 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=196.0.119.2, lip=66.85.158.91, TLS, session=<C0kJ6P1HKrbEAHcC>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 06:12:24 host2 sshd[2402304]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 154.72.27.202
country_id: 51537
description:
Jan 10 06:12:26 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=154.72.27.202, lip=66.85.158.91, TLS, session=<99hI6f1HupeaSBvK>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 06:13:38 host2 sshd[2403928]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-10 06:13:54 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (mospast) [87.103.126.54]:16760: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 06:15:08 host2 sshd[2404093]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 06:15:39 host2 sshd[2406176]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 06:16:34 host2 sshd[2407116]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-01-10 06:17:08 dovecot_login authenticator failed for H=([103.168.241.32]) [103.168.241.32]:49815: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.149.161.131
country_id: 6252001
description:
2026-01-10 06:17:20 dovecot_login authenticator failed for H=c-50-149-161-131.hsd1.tn.comcast.net [50.149.161.131]:61571: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 209.38.96.38
country_id: 2750405
description:
Jan 10 06:16:54 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=209.38.96.38, lip=66.85.158.92, TLS: Connection closed, session=<m2Z1+v1HwE7RJmAm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.126
country_id: 6252001
description:
Jan 10 06:16:56 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=66.132.153.126, lip=66.85.158.92, TLS: Connection closed, session=<ObOZ+v1HOK1ChJl+>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 06:17:25 host2 sshd[2407747]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.12.112.186
country_id: 3469034
description:
2026-01-10 06:18:00 dovecot_login authenticator failed for H=([187.12.112.186]) [187.12.112.186]:37335: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.147.85
country_id: 3144096
description:
2026-01-10 06:18:00 dovecot_login authenticator failed for H=([178.232.147.85]) [178.232.147.85]:53044: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.122
country_id: 1269750
description:
2026-01-10 06:18:14 dovecot_login authenticator failed for H=([59.145.116.161]) [182.95.230.122]:53492: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 06:18:57 host2 sshd[2408609]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 06:19:48 host2 sshd[2410824]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.201.62
country_id: 1269750
description:
2026-01-10 06:19:30 dovecot_login authenticator failed for H=(nsg-corporate-62.201.186.122.airtel.in) [122.186.201.62]:56396: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.18
country_id: 1269750
description:
2026-01-10 06:20:07 dovecot_login authenticator failed for H=([182.95.58.18]) [182.95.58.18]:59588: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.151.158
country_id: 3144096
description:
2026-01-10 06:20:16 dovecot_login authenticator failed for H=([84.210.151.158]) [84.210.151.158]:39081: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 06:20:32 host2 sshd[2411927]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.111
country_id: 6252001
description:
Jan 10 06:20:53 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.111, lip=66.85.158.91, TLS, session=<YW6xCP5HVOvG6xhv>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 06:21:32 host2 sshd[2412874]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.50
country_id: 1269750
description:
2026-01-10 06:23:32 dovecot_login authenticator failed for H=(aes-static-225.77.144.59.airtel.in) [182.95.123.50]:39156: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.73.187
country_id: 6252001
description:
2026-01-10 06:24:25 dovecot_login authenticator failed for H=([209.23.73.187]) [209.23.73.187]:35522: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 18.97.5.30
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 18.97.5.30: 250 connections per 30 seconds to 2078 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
country_id: 3469034
description:
2026-01-10 06:25:29 dovecot_login authenticator failed for H=([179.125.124.14]) [179.125.124.14]:33898: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.80.146.46
country_id: 3469034
description:
2026-01-10 06:29:28 dovecot_login authenticator failed for H=(18980204017.user.veloxzone.com.br) [189.80.146.46]:41504: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.22
country_id: 1269750
description:
2026-01-10 06:30:00 dovecot_login authenticator failed for H=(aes-static-105.28.22.125.airtel.in) [182.95.228.22]:35134: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.202.197.108
country_id: 6252001
description:
2026-01-10 06:35:32 dovecot_plain authenticator failed for H=(covent) [50.202.197.108]:37664: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.161
country_id: 2993457
description:
Jan 10 06:36:56 host2 pure-ftpd[2427720]: (?@194.165.16.161) [INFO] New connection from 194.165.16.161


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.111.220.249
country_id: 2963597
description:
[2026-01-10 06:36:44 +0530] info [webmaild] 172.111.220.249 - washeera@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.47.217
country_id: 6252001
description:
Jan 10 06:39:51 host2 sshd[2430012]: Disconnected from invalid user postgres 209.141.47.217 port 55584 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.194.164
country_id: 6252001
description:
Jan 10 06:42:07 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.65.194.164, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<nd6gVP5H0qsUQcKk>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.47.217
country_id: 6252001
description:
Jan 10 06:43:57 host2 sshd[2433136]: Disconnected from invalid user test 209.141.47.217 port 46290 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.254.244.211
country_id: 798544
description:
2026-01-10 06:44:12 dovecot_plain authenticator failed for H=(kiford) [94.254.244.211]:43980: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.133.157.163
country_id: 1643084
description:
Jan 10 06:43:50 host2 sshd[2433060]: Disconnected from invalid user estest 43.133.157.163 port 60008 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.133.157.163
country_id: 1643084
description:
Jan 10 06:44:29 host2 sshd[2433573]: Disconnected from invalid user vpsuser 43.133.157.163 port 33510 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.141.47.217
country_id: 6252001
description:
Jan 10 06:45:33 host2 sshd[2434515]: Disconnected from invalid user vpsuser 209.141.47.217 port 44252 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.250
country_id: 3865483
description:
Jan 10 06:46:57 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<hr>, method=PLAIN, rip=179.0.251.250, lip=66.85.158.91, TLS, session=<39l9ZP5H4+qzAPv6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.71.89.208
country_id: 3469034
description:
Jan 10 06:46:27 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=177.71.89.208, lip=66.85.158.91, TLS, session=<1g4BY/5HfrSxR1nQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.8.251.93
country_id: 3469034
description:
Jan 10 06:46:32 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=177.8.251.93, lip=66.85.158.91, TLS, session=<IrwLY/5HS+KxCPtd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.137.62
country_id: 99237
description:
Jan 10 06:46:51 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<hr>, method=PLAIN, rip=65.20.137.62, lip=66.85.158.91, TLS, session=<yJSEZP5HsoBBFIk+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.139.77
country_id: 3144096
description:
2026-01-10 06:49:55 dovecot_login authenticator failed for H=([188.124.139.77]) [188.124.139.77]:34500: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-10 06:49:25 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (disurden) [87.103.126.54]:55031: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2026-01-10 06:49:35 dovecot_login authenticator failed for H=([50.188.204.213]) [50.188.204.213]:34655: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 85.217.149.11
country_id: 798549
description:
Jan 10 06:52:49 host2 pure-ftpd[2440155]: (?@85.217.149.11) [INFO] New connection from 85.217.149.11


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 85.217.149.11
country_id: 798549
description:
Jan 10 06:52:56 host2 pure-ftpd[2440271]: (?@85.217.149.11) [INFO] New connection from 85.217.149.11


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.158
country_id: 1269750
description:
2026-01-10 06:54:34 dovecot_login authenticator failed for H=([125.19.175.68]) [152.52.236.158]:45382: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.215.202
country_id: 1269750
description:
2026-01-10 06:55:00 dovecot_login authenticator failed for H=([125.20.249.53]) [128.185.215.202]:37584: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.48.229.117
country_id: 3469034
description:
2026-01-10 07:00:50 dovecot_login authenticator failed for H=ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:50442: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 96.44.159.120
country_id: 6251999
description:
Jan 10 07:00:58 host2 sshd[2447318]: Disconnected from invalid user testuser 96.44.159.120 port 56208 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 96.44.159.120
country_id: 6251999
description:
Jan 10 07:01:31 host2 sshd[2447714]: Disconnected from invalid user deployerer 96.44.159.120 port 40310 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.149.88
country_id: 294640
description:
2026-01-10 07:01:33 dovecot_login authenticator failed for H=([82.102.149.88]) [82.102.149.88]:38271: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.10
country_id: 1814991
description:
Jan 10 07:02:17 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=94.231.206.10, lip=66.85.158.92, session=<WR27nP5HyZde584K>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.63.25.203
country_id: 1643084
description:
Jan 10 07:02:22 host2 sshd[2448387]: Disconnected from invalid user teamspeak 103.63.25.203 port 56752 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.6
country_id: 1814991
description:
Jan 10 07:02:42 host2 dovecot[1180436]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=94.231.206.6, lip=66.85.158.92, session=<vfg/nv5Hyexe584G>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.2
country_id: 1814991
description:
Jan 10 07:02:46 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=94.231.206.2, lip=66.85.158.92, session=<sIV7nv5H66Re584C>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.11
country_id: 1814991
description:
Jan 10 07:02:27 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=94.231.206.11, lip=66.85.158.92, session=<jl5anf5Hjble584L>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 07:04:17 host2 sshd[2449903]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.153.123.178
country_id: 6252001
description:
Jan 10 07:04:53 host2 sshd[2450260]: Disconnected from invalid user frappe 43.153.123.178 port 49678 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 83.168.69.214
country_id: 798544
description:
Jan 10 07:05:09 host2 sshd[2450808]: Disconnected from invalid user server 83.168.69.214 port 57438 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.153.123.178
country_id: 6252001
description:
Jan 10 07:05:24 host2 sshd[2451045]: Disconnected from invalid user testuser 43.153.123.178 port 53994 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.63.25.203
country_id: 1643084
description:
Jan 10 07:06:39 host2 sshd[2451888]: Disconnected from invalid user server 103.63.25.203 port 47980 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.63.25.203
country_id: 1643084
description:
Jan 10 07:07:24 host2 sshd[2452609]: Disconnected from invalid user testuser 103.63.25.203 port 47900 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.63.25.203
country_id: 1643084
description:
Jan 10 07:08:55 host2 sshd[2453667]: Disconnected from invalid user user1 103.63.25.203 port 33576 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.63.25.203
country_id: 1643084
description:
Jan 10 07:09:38 host2 sshd[2454141]: Disconnected from invalid user ubuntu 103.63.25.203 port 38860 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.195
country_id: 6252001
description:
Jan 10 07:10:52 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.195, lip=66.85.158.92, session=<e+92u/5H4vWTuYTD>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan 10 07:15:21 host2 pure-ftpd[2458885]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.5
country_id: 798549
description:
Jan 10 07:17:22 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.5, lip=66.85.158.91, TLS: Connection closed, session=<hWy20v5HnrhV2ZUF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.11.67
country_id: 2077456
description:
2026-01-10 07:17:26 dovecot_login authenticator failed for H=([101.168.11.67]) [101.168.11.67]:59044: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.5
country_id: 798549
description:
Jan 10 07:17:31 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=85.217.149.5, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<Ai830/5HXIRV2ZUF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.21.104
country_id: 1269750
description:
2026-01-10 07:17:47 dovecot_login authenticator failed for H=(abts-north-static-104.21.176.122.airtelbroadband.in) [122.176.21.104]:53953: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.224.171.101
country_id: 6252001
description:
2026-01-10 07:19:35 dovecot_plain authenticator failed for H=c-73-224-171-101.hsd1.fl.comcast.net (maidon) [73.224.171.101]:47428: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.18.99.38
country_id: 1269750
description:
2026-01-10 07:21:22 dovecot_login authenticator failed for H=([125.18.99.38]) [125.18.99.38]:59886: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.194.94
country_id: 1733045
description:
2026-01-10 07:21:47 dovecot_login authenticator failed for H=([51.162.194.94]) [51.162.194.94]:48669: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.49.11
country_id: 3144096
description:
2026-01-10 07:21:57 dovecot_login authenticator failed for H=(cm-84.214.49.11.get.no) [84.214.49.11]:44370: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan 10 07:22:35 host2 pure-ftpd[2464179]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.83
country_id: 6252001
description:
Jan 10 07:22:51 host2 pure-ftpd[2464335]: (?@198.235.24.83) [INFO] New connection from 198.235.24.83


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.255.247.143
country_id: 1819730
description:
2026-01-10 07:24:06 dovecot_login authenticator failed for H=(72-255-247-143.static.imsbiz.com) [72.255.247.143]:36516: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.183
country_id: 3144096
description:
2026-01-10 07:23:51 dovecot_login authenticator failed for H=(cm-84.213.189.183.get.no) [84.213.189.183]:33872: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.39
country_id: 1643084
description:
2026-01-10 07:24:35 dovecot_login authenticator failed for H=([157.15.40.39]) [157.15.40.39]:49870: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.142
country_id: 1269750
description:
2026-01-10 07:26:57 dovecot_login authenticator failed for H=([182.95.215.71]) [182.95.230.142]:50002: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.213.242
country_id: 3469034
description:
2026-01-10 07:27:28 dovecot_login authenticator failed for H=([200.149.213.242]) [200.149.213.242]:39559: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.27
country_id: 6252001
description:
Jan 10 07:33:13 host2 pure-ftpd[2472758]: (?@147.185.132.27) [INFO] New connection from 147.185.132.27


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 07:34:16 host2 sshd[2473459]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.218
country_id: 337996
description:
2026-01-10 07:43:26 dovecot_login authenticator failed for H=([196.189.124.218]) [196.189.124.218]:34894: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.89
country_id: 1733045
description:
2026-01-10 07:43:45 dovecot_login authenticator failed for H=([49.125.201.89]) [49.125.201.89]:48716: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.209.30
country_id: 1269750
description:
2026-01-10 07:44:49 dovecot_login authenticator failed for H=([125.18.43.161]) [128.185.209.30]:54056: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.144
country_id: 6252001
description:
Jan 10 07:45:54 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.144, lip=66.85.158.91, TLS handshaking: Connection closed, session=<HkXBOP9Hh45BMQGQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.142
country_id: 6252001
description:
Jan 10 07:46:13 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.142, lip=66.85.158.91, TLS handshaking: Connection closed, session=<p9HZOf9HsDpBMQGO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.142
country_id: 6252001
description:
Jan 10 07:46:28 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.142, lip=66.85.158.91, TLS: Connection closed, session=<WrvFOv9HuO9BMQGO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 168.0.224.119
country_id: 3469034
description:
Jan 10 07:49:50 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=168.0.224.119, lip=66.85.158.91, TLS, session=<eCWtRf9HFu2oAOB3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.227.39.222
country_id: 798544
description:
Jan 10 07:50:07 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=46.227.39.222, lip=66.85.158.91, TLS, session=<I9fXRv9H3J0u4yfe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.86
country_id: 1269750
description:
2026-01-10 07:51:41 dovecot_login authenticator failed for H=([122.184.127.86]) [122.184.127.86]:36380: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.212
country_id: 6252001
description:
Jan 10 07:51:43 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.212, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<inWRTf9H1szG6xjU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.145.54
country_id: 1269750
description:
2026-01-10 07:51:56 dovecot_login authenticator failed for H=(nsg-corporate-54.145.185.122.airtel.in) [122.185.145.54]:52996: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.125
country_id: 1036973
description:
2026-01-10 07:59:33 dovecot_login authenticator failed for H=([196.28.226.125]) [196.28.226.125]:52034: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.224.215.23
country_id: 1269750
description:
2026-01-10 07:59:56 dovecot_login authenticator failed for H=([135.13.8.246]) [74.224.215.23]:10250: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.253.56.73
country_id: 6252001
description:
Jan 10 08:01:54 host2 sshd[2495377]: Disconnected from invalid user kaushalya 47.253.56.73 port 51262 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.253.56.73
country_id: 6252001
description:
Jan 10 08:05:06 host2 sshd[2497761]: Disconnected from invalid user kanchan 47.253.56.73 port 44204 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 47.253.56.73
country_id: 6252001
description:
Jan 10 08:05:38 host2 sshd[2498325]: Disconnected from invalid user amita 47.253.56.73 port 46302 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.253.56.73
country_id: 6252001
description:
Jan 10 08:06:43 host2 sshd[2499139]: Disconnected from invalid user lakhan 47.253.56.73 port 53826 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 24.165.211.107
country_id: 6252001
description:
Jan 10 08:07:38 host2 dovecot[1180436]: imap-login: Disconnected: Aborted login by logging out (auth failed, 1 attempts in 3 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=24.165.211.107, lip=66.85.158.91, TLS, session=</J9Dhv9H7rAYpdNr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.202
country_id: 6252001
description:
Jan 10 08:14:03 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=147.185.133.202, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<LJNonf9HqO6TuYXK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.202
country_id: 6252001
description:
Jan 10 08:14:14 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=147.185.133.202, lip=66.85.158.91, TLS: read(size=429) failed: Connection reset by peer, session=<iHURnv9HeumTuYXK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.23.199.107
country_id: 2921044
description:
Jan 10 08:15:03 host2 sshd[2505761]: Disconnected from invalid user postgres 193.23.199.107 port 39280 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.177.93.21
country_id: 1269750
description:
Jan 10 08:16:41 host2 sshd[2507348]: Disconnected from invalid user server 122.177.93.21 port 58234 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.23.199.107
country_id: 2921044
description:
Jan 10 08:17:11 host2 sshd[2507787]: Disconnected from invalid user postgres 193.23.199.107 port 53684 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 193.23.199.107
country_id: 2921044
description:
Jan 10 08:17:41 host2 sshd[2508131]: Disconnected from invalid user postgres 193.23.199.107 port 39284 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan 10 08:18:57 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<j0rPrv9HeMEz0msW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.36.82
country_id: 1210997
description:
2026-01-10 08:20:13 dovecot_login authenticator failed for H=([49.0.36.82]) [49.0.36.82]:59752: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.177.93.21
country_id: 1269750
description:
Jan 10 08:19:36 host2 sshd[2509425]: Disconnected from invalid user frappe 122.177.93.21 port 58160 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.114
country_id: 1269750
description:
2026-01-10 08:19:57 dovecot_login authenticator failed for H=([152.52.238.86]) [182.95.184.114]:45960: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.237.119.118
country_id: 6252001
description:
2026-01-10 08:19:58 dovecot_login authenticator failed for H=118-119-237-24.gci.net [24.237.119.118]:38423: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.138.74
country_id: 1269750
description:
2026-01-10 08:20:17 dovecot_login authenticator failed for H=([128.185.241.213]) [125.19.138.74]:50368: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 68.178.207.8
country_id: 6252001
description:
Jan 10 08:20:33 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=68.178.207.8, lip=66.85.158.91, session=<WrmGtP9HPKdEss8I>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.202
country_id: 6252001
description:
Jan 10 08:20:38 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.202, lip=66.85.158.91, TLS, session=<CMH1tP9HWvyTuYXK>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.177.93.21
country_id: 1269750
description:
Jan 10 08:20:50 host2 sshd[2510504]: Disconnected from invalid user test1 122.177.93.21 port 36560 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan 10 08:21:00 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@dataesite.lk>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<wNwetv9Hooui8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.68.110.207
country_id: 2921044
description:
Jan 10 08:21:14 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<noreply@anandaobauae.org>, method=PLAIN, rip=138.68.110.207, lip=66.85.158.91, session=<XIvktv9HpLOKRG7P>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.177.191.168
country_id: 357994
description:
2026-01-10 08:21:50 dovecot_plain authenticator failed for H=(bagoly) [154.177.191.168]:57894: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan 10 08:22:02 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<savIuf9H2tiOq2dI>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.207.55.167
country_id: 2921044
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 104.207.55.167 - topviewuser "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user topviewuser (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.3.34.35
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 45.3.34.35 - topview "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user topview (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.50.187.174
country_id: 6251999
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 209.50.187.174 - admin_venee "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin_venee (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.3.36.190
country_id: 6252001
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 45.3.36.190 - topviewl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2026-01-10 08:23:26 dovecot_login authenticator failed for H=([128.185.247.14]) [122.184.124.46]:56488: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.83.98
country_id: 1269750
description:
2026-01-10 08:24:20 dovecot_login authenticator failed for H=([182.79.83.98]) [182.79.83.98]:60986: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 130.185.85.106
country_id: 2264397
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 130.185.85.106 - env_eng@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan 10 08:24:28 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<5JmNwv9Ha5cz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.236.237.105
country_id: 3469034
description:
Jan 10 08:24:58 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@seyawin.com>, method=PLAIN, rip=186.236.237.105, lip=66.85.158.91, session=<erNRxP9H3sm67O1p>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.68.110.207
country_id: 2921044
description:
Jan 10 08:27:11 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@seyawin.com>, method=PLAIN, rip=138.68.110.207, lip=66.85.158.91, session=<4sNIzP9HDL2KRG7P>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.161.96.107
country_id: 6252001
description:
2026-01-10 08:26:20 dovecot_plain authenticator failed for H=c-73-161-96-107.hsd1.mi.comcast.net (crones) [73.161.96.107]:54496: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 10 08:27:29 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Ylduzf9H5qEDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan 10 08:27:41 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@venee.lk>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<IXUKzv9HgrQFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 105.174.17.50
country_id: 3351879
description:
Jan 10 08:28:55 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=105.174.17.50, lip=66.85.158.91, session=<HRJx0v9H4m1prhEy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan 10 08:29:18 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<CcPX0/9H37gz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan 10 08:29:20 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<HY/v0/9HtJYvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 97.74.84.186
country_id: 1880251
description:
Jan 10 08:29:39 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=97.74.84.186, lip=66.85.158.91, session=<CLAb1f9HFrxhSlS6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.27.203.227
country_id: 3439705
description:
Jan 10 08:31:11 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=179.27.203.227, lip=66.85.158.91, session=<pEGU2v9HfJezG8vj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 10 08:31:13 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<9FrU2v9HqIQDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan 10 08:32:19 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@rehanseo.online>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<1KuQ3v9HUthnmud6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.43
country_id: 6252001
description:
Jan 10 08:32:35 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.43, lip=66.85.158.92, TLS, session=<Pb+v3/9HxPTN0h8r>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 10 08:33:25 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<Qcep4v9HdIQDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.75.93
country_id: 1880251
description:
2026-01-10 08:35:04 dovecot_login authenticator failed for H=(93.75.245.49.unknown.m1.com.sg) [49.245.75.93]:36877: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2026-01-10 08:34:42 dovecot_login authenticator failed for H=([189.59.210.1]) [186.215.245.175]:49844: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Jan 10 08:35:49 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<L4kn6/9HdmCnYwhf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 10 08:36:10 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<i1+B7P9HiLsDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Jan 10 08:36:18 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@nsteeleng.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<rsja7P9HRKWPbtX3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.90.12.192
country_id: 6252001
description:
Jan 10 08:36:33 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.90.12.192, lip=66.85.158.92, TLS, session=<s83e7f9HiM0DWgzA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 10 08:36:47 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<slSy7v9HYsEDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 10 08:37:40 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: Connection closed, session=<9rfc8f9Hao0DhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 10 08:38:44 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<2jK49f9H2q0DhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.27.203.227
country_id: 3439705
description:
Jan 10 08:39:12 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 13 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=179.27.203.227, lip=66.85.158.91, session=<VYCW9v9HwJizG8vj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Jan 10 08:39:44 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@venee.lk>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<iY8i+f9HDMGLO0qU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 10 08:41:00 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<S//H/f9HIOwDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan 10 08:41:11 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<mzND/v9HXtcFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan 10 08:40:33 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<oUkV/P9HEJovWfaQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.33.69.253
country_id: 6252001
description:
Jan 10 08:41:45 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.33.69.253, lip=66.85.158.92, TLS handshaking: Connection closed, session=<wVJ8AABIcpstIUX9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 10 08:41:58 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: Connection closed, session=<1vE9AQBI7tkDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 10 08:43:03 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<lQseBQBIrssDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.57.236.167
country_id: 1819730
description:
Jan 10 08:43:16 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@sivagnanamfoundation.com>, method=PLAIN, rip=47.57.236.167, lip=66.85.158.91, session=<jmDIBQBIqI4vOeyn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 10 08:43:43 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<D2qIBwBIZrADhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.68.110.207
country_id: 2921044
description:
Jan 10 08:45:03 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@rehanseo.online>, method=PLAIN, rip=138.68.110.207, lip=66.85.158.91, session=<eTAlDABI4IeKRG7P>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.93
country_id: 99237
description:
2026-01-10 08:44:47 dovecot_login authenticator failed for H=([65.20.250.93]) [65.20.250.93]:33049: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.12
country_id: 1269750
description:
2026-01-10 08:45:05 dovecot_login authenticator failed for H=([122.187.226.12]) [122.187.226.12]:48075: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 10 08:45:21 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<bz9bDQBItJoDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan 10 08:45:25 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<tiJ6DQBIeLyygBt7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.54
country_id: 3144096
description:
2026-01-10 08:45:27 dovecot_login authenticator failed for H=([62.97.170.54]) [62.97.170.54]:47310: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.226.154
country_id: 294640
description:
2026-01-10 08:45:31 dovecot_login authenticator failed for H=([147.235.226.154]) [147.235.226.154]:41000: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan 10 08:45:52 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@kiriaswanu.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<QpMSDwBIhs+i8KbF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.49
country_id: 290557
description:
Jan 10 08:45:56 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=185.93.89.49, lip=66.85.158.91, session=<e4hKDwBIgIG5XVkx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.154
country_id: 1269750
description:
2026-01-10 08:45:17 dovecot_login authenticator failed for H=([128.185.223.87]) [182.95.178.154]:59044: 535 Incorrect authentication data (set_id=v-deploy.com@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.51
country_id: 3144096
description:
2026-01-10 08:45:40 dovecot_login authenticator failed for H=(51-170-97-62.cust.smartcall.no) [62.97.170.51]:34366: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Jan 10 08:45:52 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@sivagnanamfoundation.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<QnURDwBI9um8putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan 10 08:46:14 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<K0pQEABIgs1nmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.50.167.81
country_id: 1269750
description:
2026-01-10 08:46:41 dovecot_login authenticator failed for H=([36.50.167.81]) [36.50.167.81]:34732: 535 Incorrect authentication data (set_id=v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Jan 10 08:48:21 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@dataesite.lk>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<BNLoFwBIYp8vT1jH>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 08:49:42 host2 sshd[2532974]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan 10 08:49:29 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<Je/6GwBICOhnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan 10 08:51:02 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<IXqNIQBIlBcvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan 10 08:51:32 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<2GxVIwBILtKygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Jan 10 08:52:11 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<iSGyJQBIVosI3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.247.20.83
country_id: 1643084
description:
Jan 10 08:53:45 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<noreply@lankaherbalsolutions.com>, method=PLAIN, rip=103.247.20.83, lip=66.85.158.91, session=<9iEyKwBIBONn9xRT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.142
country_id: 1269750
description:
2026-01-10 08:56:05 dovecot_login authenticator failed for H=([128.185.227.142]) [128.185.227.142]:33780: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2026-01-10 08:56:11 dovecot_login authenticator failed for H=([59.145.84.25]) [103.251.31.154]:58492: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.127.90.34
country_id: 2440476
description:
2026-01-10 08:55:34 dovecot_login authenticator failed for H=([154.127.90.34]) [154.127.90.34]:41372: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.85.43.162
country_id: 3686110
description:
2026-01-10 08:55:46 dovecot_login authenticator failed for H=([190.85.43.162]) [190.85.43.162]:44676: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.175.75
country_id: 99237
description:
2026-01-10 08:56:27 dovecot_login authenticator failed for H=([65.20.175.75]) [65.20.175.75]:45849: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.163.16.165
country_id: 6252001
description:
Jan 10 08:56:40 host2 dovecot[1180436]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=20.163.16.165, lip=66.85.158.92, session=<4MTYNQBImosUoxCl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.101.146
country_id: 1269750
description:
2026-01-10 08:56:49 dovecot_login authenticator failed for H=(aes-static-217.70.22.125.airtel.in) [27.123.101.146]:39230: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Jan 10 08:57:18 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<oJ3+NwBIbpEI3tq7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.236.237.105
country_id: 3469034
description:
Jan 10 08:57:24 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=186.236.237.105, lip=66.85.158.91, session=<P1lYOABIeOO67O1p>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.28
country_id: 290557
description:
Jan 10 08:57:59 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=185.93.89.28, lip=66.85.158.91, session=<afhtOgBIKp25XVkc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Jan 10 09:01:10 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<pqnMRQBIQo2PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan 10 09:00:18 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<RJ2vQgBIiLEvWfaQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.163.37.98
country_id: 6252001
description:
Jan 10 09:01:59 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.163.37.98, lip=66.85.158.91, session=<2gDWSABIWIIUoyVi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan 10 09:02:14 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<ZFmcSQBIBo0yBvlc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-10 09:03:46 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (bousids) [87.103.126.54]:4339: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.110
country_id: 3017382
description:
Jan 10 09:03:15 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=91.196.152.110, lip=66.85.158.91, session=<zoReTQBIc+RbxJhu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.232.170.229
country_id: 6252001
description:
Jan 10 09:03:16 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low (no auth attempts in 6 secs): user=<>, rip=172.232.170.229, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<dUJnTQBIvPCs6Krl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.18
country_id: 3017382
description:
Jan 10 09:03:41 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.18, lip=66.85.158.91, session=<ZX3lTgBI38hbxJgS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.232.170.229
country_id: 6252001
description:
Jan 10 09:04:32 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090FC:SSL routines:tls_early_post_process_client_hello:unknown protocol (no auth attempts in 0 secs): user=<>, rip=172.232.170.229, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090FC:SSL routines:tls_early_post_process_client_hello:unknown protocol, session=<gSj2UQBINmas6Krl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan 10 09:04:51 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@kiriaswanu.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=</bvxUgBIoiRniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan 10 09:04:54 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<XBYqUwBIqLAUOAHJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.232.170.229
country_id: 6252001
description:
Jan 10 09:05:13 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (tried to use unsupported auth mechanism): user=<>, method=NTLM, rip=172.232.170.229, lip=66.85.158.91, TLS, session=<r1VmVABIrnKs6Krl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.236.237.105
country_id: 3469034
description:
Jan 10 09:07:09 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@rehanseo.online>, method=PLAIN, rip=186.236.237.105, lip=66.85.158.91, session=<V7cyWwBIAJy67O1p>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan 10 09:07:22 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@venee.lk>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<oS3zWwBINJaygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan 10 09:10:20 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<C6yOZgBIeLWOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan 10 09:11:20 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<6gkqagBIuKVCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Jan 10 09:12:20 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<vM2+bQBI8pWLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan 10 09:12:27 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<ytogbgBIHMkFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.59.132.141
country_id: 1269750
description:
Jan 10 09:15:39 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=103.59.132.141, lip=66.85.158.91, TLS, session=<tXKmeABI39BnO4SN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.34.170
country_id: 953987
description:
Jan 10 09:16:01 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=102.64.34.170, lip=66.85.158.91, TLS, session=<GCXWeQBIQOxmQCKq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Jan 10 09:16:58 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@essenceceylontea.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<l5NMfgBIvpGLO0qU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.164.137
country_id: 99237
description:
2026-01-10 09:17:30 dovecot_plain authenticator failed for H=(nomaly) [65.20.164.137]:45503: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Jan 10 09:17:35 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@kiriaswanu.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<0ZN8gABIGn8vWbHj>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 09:19:47 host2 sshd[2559865]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan 10 09:19:17 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@venee.lk>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<DCWLhgBIf7Qz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.68.110.207
country_id: 2921044
description:
Jan 10 09:20:17 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=138.68.110.207, lip=66.85.158.91, session=<ARIsigBI8ouKRG7P>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 68.178.207.8
country_id: 6252001
description:
Jan 10 09:21:17 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@dataesite.lk>, method=PLAIN, rip=68.178.207.8, lip=66.85.158.91, session=<SPS8jQBIoMFEss8I>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2026-01-10 09:22:23 dovecot_plain authenticator failed for H=c-98-227-25-115.hsd1.il.comcast.net (oventic) [98.227.25.115]:48508: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.225.99.151
country_id: 2921044
description:
Jan 10 09:23:25 host2 sshd[2562784]: Disconnected from invalid user test1 64.225.99.151 port 53522 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.157.219.158
country_id: 6252001
description:
2026-01-10 09:23:27 dovecot_plain authenticator failed for H=c-76-157-219-158.hsd1.il.comcast.net (prokma) [76.157.219.158]:39890: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan 10 09:24:01 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<re2FlwBIRN6i8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan 10 09:24:16 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<MchmmABIDLCOq2dI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.225.99.151
country_id: 2921044
description:
Jan 10 09:24:21 host2 sshd[2563658]: Disconnected from invalid user frappe 64.225.99.151 port 60184 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan 10 09:24:59 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<wc38mgBIqosz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.49
country_id: 290557
description:
Jan 10 09:25:51 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=185.93.89.49, lip=66.85.158.91, session=<t6wXngBItoW5XVkx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 77.65.142.78
country_id: 798544
description:
Jan 10 09:27:11 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@jrdc.lk>, method=PLAIN, rip=77.65.142.78, lip=66.85.158.91, TLS, session=<qmQBogBI5AtNQY5O>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.68.110.207
country_id: 2921044
description:
Jan 10 09:26:39 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@seyawin.com>, method=PLAIN, rip=138.68.110.207, lip=66.85.158.91, session=<cmPioABI0r2KRG7P>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.254
country_id: 3865483
description:
Jan 10 09:27:15 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@jrdc.lk>, method=PLAIN, rip=179.0.252.254, lip=66.85.158.91, TLS, session=<Nj4WogBI2c+zAPz+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.103
country_id: 3865483
description:
Jan 10 09:27:22 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info@jrdc.lk>, method=PLAIN, rip=179.0.252.103, lip=66.85.158.91, TLS, session=<tT8+ogBIBruzAPxn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.226.115.168
country_id: 3057568
description:
Jan 10 09:27:29 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=91.226.115.168, lip=66.85.158.91, TLS, session=<dK8HowBIbp9b4nOo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.248.32
country_id: 798544
description:
Jan 10 09:27:34 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=109.125.248.32, lip=66.85.158.91, TLS, session=<PzVUowBIxpJtffgg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.227.32.167
country_id: 3865483
description:
Jan 10 09:27:54 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 29 secs): user=<info>, method=PLAIN, rip=45.227.32.167, lip=66.85.158.91, TLS, session=<HwrIowBI1akt4yCn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.183
country_id: 3865483
description:
Jan 10 09:27:16 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@jrdc.lk>, method=PLAIN, rip=179.0.251.183, lip=66.85.158.91, TLS, session=<FKQVogBIs5mzAPu3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.55.16
country_id: 3144096
description:
2026-01-10 09:27:16 dovecot_login authenticator failed for H=([178.232.55.16]) [178.232.55.16]:57248: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.209
country_id: 3865483
description:
Jan 10 09:27:16 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@jrdc.lk>, method=PLAIN, rip=179.0.252.209, lip=66.85.158.91, TLS, session=<Ez4XogBIy6OzAPzR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 154.127.34.4
country_id: 2395170
description:
Jan 10 09:27:41 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=154.127.34.4, lip=66.85.158.91, TLS, session=<5Fe2owBIK7uafyIE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.133.57
country_id: 690791
description:
Jan 10 09:27:43 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=37.221.133.57, lip=66.85.158.91, TLS, session=<MF7kowBItrsl3YU5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.47.37.18
country_id: 6252001
description:
2026-01-10 09:29:34 dovecot_login authenticator failed for H=([50.47.37.18]) [50.47.37.18]:55255: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.249
country_id: 1168579
description:
2026-01-10 09:29:49 dovecot_login authenticator failed for H=(249.92.zcomnetworks.com.pk) [103.148.92.249]:40979: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan 10 09:30:02 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<6bQOrQBIba4z0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.236.237.105
country_id: 3469034
description:
Jan 10 09:30:45 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=186.236.237.105, lip=66.85.158.91, session=<EnWRrwBI1tC67O1p>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan 10 09:32:17 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<noreply@venee.lk>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<yd8MtQBIEoYFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan 10 09:32:24 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<VHZ9tQBIcsEvWfaQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.97.155.25
country_id: 6252001
description:
2026-01-10 09:32:48 dovecot_plain authenticator failed for H=c-76-97-155-25.hsd1.ga.comcast.net (supethasip) [76.97.155.25]:40824: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2026-01-10 09:33:58 dovecot_login authenticator failed for H=([193.46.192.20]) [193.46.192.20]:43074: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.126.208.241
country_id: 1512440
description:
Jan 10 09:33:29 host2 sshd[2571579]: Disconnected from invalid user test 89.126.208.241 port 44910 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 105.174.17.50
country_id: 3351879
description:
Jan 10 09:33:41 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=105.174.17.50, lip=66.85.158.91, session=<NWkQugBIwflprhEy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.248.8.33
country_id: 192950
description:
Jan 10 09:34:23 host2 sshd[2572383]: Disconnected from invalid user steam 197.248.8.33 port 38424 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.45
country_id: 290557
description:
Jan 10 09:34:36 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=185.93.89.45, lip=66.85.158.91, session=<TP9jvQBInIa5XVkt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan 10 09:35:04 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@rehanseo.online>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<l9wCvwBIYppnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 97.74.84.186
country_id: 1880251
description:
Jan 10 09:35:53 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=97.74.84.186, lip=66.85.158.91, session=<9cLrwQBIKLhhSlS6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 89.126.208.241
country_id: 1512440
description:
Jan 10 09:35:55 host2 sshd[2573527]: Disconnected from invalid user steam 89.126.208.241 port 56452 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.126.208.241
country_id: 1512440
description:
Jan 10 09:35:19 host2 sshd[2573182]: Disconnected from invalid user frappe 89.126.208.241 port 43208 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.93.89.49
country_id: 290557
description:
Jan 10 09:35:28 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=185.93.89.49, lip=66.85.158.91, session=<v2t9wABIdty5XVkx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.27.203.227
country_id: 3439705
description:
Jan 10 09:35:45 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@nsteeleng.com>, method=PLAIN, rip=179.27.203.227, lip=66.85.158.91, session=<v6+AwQBI8JOzG8vj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Jan 10 09:37:00 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<Nyb0xQBIrHunYwhf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 10 09:37:04 host2 dovecot[1180436]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<Ss9RxgBIfKgDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Jan 10 09:37:05 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<5D5CxgBIvpOPbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.126.208.241
country_id: 1512440
description:
Jan 10 09:36:28 host2 sshd[2573880]: Disconnected from invalid user testuser 89.126.208.241 port 41464 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.248.8.33
country_id: 192950
description:
Jan 10 09:36:33 host2 sshd[2573914]: Disconnected from invalid user steam 197.248.8.33 port 44600 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan 10 09:37:35 host2 pure-ftpd[2574712]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.248.8.33
country_id: 192950
description:
Jan 10 09:37:51 host2 sshd[2574923]: Disconnected from invalid user user2 197.248.8.33 port 43110 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 10 09:39:05 host2 dovecot[1180436]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<9JiLzQBInNQDjyE/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.226.118
country_id: 1880251
description:
Jan 10 09:39:29 host2 sshd[2576320]: Disconnected from invalid user steam 45.78.226.118 port 56416 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 10 09:40:02 host2 dovecot[1180436]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<ehTq0ABIdpgDjyE/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.226.118
country_id: 1880251
description:
Jan 10 09:40:19 host2 sshd[2577166]: Disconnected from invalid user testuser 45.78.226.118 port 58780 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.226.118
country_id: 1880251
description:
Jan 10 09:41:09 host2 sshd[2577943]: Disconnected from invalid user server 45.78.226.118 port 58978 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 10 09:42:05 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<Z01A2ABI0K4DjyE/>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 10 09:42:15 host2 dovecot[1180436]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<urLR2ABIkt0DjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.202
country_id: 1269750
description:
2026-01-10 09:43:03 dovecot_login authenticator failed for H=([128.185.247.100]) [182.95.222.202]:33640: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Jan 10 09:43:10 host2 dovecot[1180436]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<lCgY3ABI1LADjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Jan 10 09:43:28 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@venee.lk>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<uMoO3QBIBMeLO0qU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.94.39.65
country_id: 1269750
description:
2026-01-10 09:43:34 dovecot_login authenticator failed for H=([59.94.39.65]) [59.94.39.65]:45522: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.27.203.227
country_id: 3439705
description:
Jan 10 09:43:41 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@ceylondigest.com>, method=PLAIN, rip=179.27.203.227, lip=66.85.158.91, session=<Kz7S3QBIcoqzG8vj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan 10 09:43:45 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@rehanseo.online>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<IxMX3gBIjsYvWfaQ>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan 10 09:44:59 host2 pure-ftpd[2581235]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.68.110.207
country_id: 2921044
description:
Jan 10 09:45:18 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=138.68.110.207, lip=66.85.158.91, session=<mK6h4wBIyrOKRG7P>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.103.245.7
country_id: 1819730
description:
Jan 10 09:45:38 host2 sshd[2581866]: Disconnected from invalid user test 103.103.245.7 port 56530 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan 10 09:46:12 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@essenceceylontea.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<BSnW5gBI3MAFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan 10 09:48:02 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<+jls7QBIWrmi8KbF>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.103.245.7
country_id: 1819730
description:
Jan 10 09:48:14 host2 sshd[2584038]: Disconnected from invalid user admin 103.103.245.7 port 56354 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 96.92.63.243
country_id: 6252001
description:
Jan 10 09:48:16 host2 sshd[2584277]: Disconnected from invalid user pratap 96.92.63.243 port 48698 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.57.236.167
country_id: 1819730
description:
Jan 10 09:48:59 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@sivagnanamfoundation.com>, method=PLAIN, rip=47.57.236.167, lip=66.85.158.91, session=<exfI8ABI0pcvOeyn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan 10 09:49:13 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<hsGh8QBIJodnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.118.142.216
country_id: 3686110
description:
Jan 10 09:49:27 host2 sshd[2585291]: Disconnected from invalid user user2 186.118.142.216 port 47982 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan 10 09:49:51 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<aK/g8wBI1IKygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Jan 10 09:50:36 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<Puac9gBIFN+8putr>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.118.142.216
country_id: 3686110
description:
Jan 10 09:50:51 host2 sshd[2586916]: Disconnected from invalid user teamspeak 186.118.142.216 port 33328 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.118.142.216
country_id: 3686110
description:
Jan 10 09:51:30 host2 sshd[2587591]: Disconnected from invalid user test 186.118.142.216 port 55622 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan 10 09:52:32 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<4ld5/QBIoMRnmud6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.213.52
country_id: 1819730
description:
Jan 10 09:52:53 host2 sshd[2588750]: Disconnected from invalid user deployerer 123.58.213.52 port 60344 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Jan 10 09:55:53 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<7IWBCQFIasQI3tq7>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.143.238.173
country_id: 1819730
description:
Jan 10 09:56:50 host2 sshd[2593018]: Disconnected from invalid user frappe 103.143.238.173 port 36006 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan 10 09:56:53 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<AxgPDQFIupsvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan 10 09:56:15 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<1ezKCgFIyMqygBt7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.77
country_id: 6252001
description:
Jan 10 09:56:29 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=147.185.133.77, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<pBy6CwFIudyTuYVN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.77
country_id: 6252001
description:
Jan 10 09:57:34 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=147.185.133.77, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<O1+mDwFIjPqTuYVN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.176.79.137
country_id: 1643084
description:
Jan 10 09:58:50 host2 sshd[2594706]: Disconnected from invalid user deployerer 103.176.79.137 port 55288 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.74.29.21
country_id: 6252001
description:
Jan 10 09:59:11 host2 sshd[2595007]: Disconnected from invalid user user1 69.74.29.21 port 46948 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.74.29.21
country_id: 6252001
description:
Jan 10 10:00:10 host2 sshd[2595961]: Disconnected from invalid user postgres 69.74.29.21 port 14927 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.247.20.83
country_id: 1643084
description:
Jan 10 09:59:32 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=103.247.20.83, lip=66.85.158.91, session=<5l1pFgFIMoVn9xRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Jan 10 10:00:19 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<OaBNGQFI3pEvT1jH>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 69.74.29.21
country_id: 6252001
description:
Jan 10 10:00:42 host2 sshd[2596759]: Disconnected from invalid user test 69.74.29.21 port 29890 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.222.218.187
country_id: 1880251
description:
Jan 10 10:01:04 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=8.222.218.187, lip=66.85.158.91, session=<mAcLHAFI3rII3tq7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan 10 10:01:45 host2 sshd[2597781]: Disconnected from invalid user user 2.57.121.25 port 23284 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.176.79.137
country_id: 1643084
description:
Jan 10 10:01:50 host2 sshd[2597876]: Disconnected from invalid user user1 103.176.79.137 port 41788 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.49
country_id: 290557
description:
Jan 10 10:01:53 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=185.93.89.49, lip=66.85.158.91, session=<gWv0HgFIorq5XVkx>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 69.74.29.21
country_id: 6252001
description:
Jan 10 10:01:13 host2 sshd[2597384]: Disconnected from invalid user frappe 69.74.29.21 port 62523 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.233.246
country_id: 1269750
description:
2026-01-10 10:02:42 dovecot_login authenticator failed for H=([125.17.236.223]) [125.17.233.246]:41020: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.176.79.137
country_id: 1643084
description:
Jan 10 10:02:41 host2 sshd[2598613]: Disconnected from invalid user dell 103.176.79.137 port 39324 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Jan 10 10:02:45 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<olICIgFIMsGPbtX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.202.225.79
country_id: 6252001
description:
2026-01-10 10:02:53 dovecot_login authenticator failed for H=wsip-72-202-225-79.lv.lv.cox.net [72.202.225.79]:55108: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.236.237.105
country_id: 3469034
description:
Jan 10 10:03:29 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=186.236.237.105, lip=66.85.158.91, session=<y/SFJAFIKMG67O1p>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan 10 10:03:43 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<ZTB4JQFIoNAyBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan 10 10:03:44 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<dA2IJQFIkq4vWfaQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.77
country_id: 6252001
description:
Jan 10 10:04:43 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.77, lip=66.85.158.92, TLS, session=<Bos1KQFIfuaTuYVN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.138.90.195
country_id: 2661886
description:
2026-01-10 10:06:32 dovecot_login authenticator failed for H=h79-138-90-195.cust.bredband2.com [79.138.90.195]:60036: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.200
country_id: 1269750
description:
2026-01-10 10:06:36 dovecot_login authenticator failed for H=([103.146.233.200]) [103.146.233.200]:53670: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.228.146
country_id: 1269750
description:
2026-01-10 10:06:56 dovecot_login authenticator failed for H=([125.16.32.137]) [125.20.228.146]:33182: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2026-01-10 10:07:02 dovecot_login authenticator failed for H=([85.19.195.12]) [85.19.195.12]:58296: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.45
country_id: 290557
description:
Jan 10 10:06:23 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=185.93.89.45, lip=66.85.158.91, session=<gcIMLwFIVKm5XVkt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.124.75
country_id: 1269750
description:
2026-01-10 10:07:20 dovecot_login authenticator failed for H=(aes-static-075.124.17.125.airtel.in) [125.17.124.75]:49146: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan 10 10:08:25 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<iN9NNgFI+JYUOAHJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan 10 10:09:54 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<Ra+bOwFI5gZniu0S>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.67
country_id: 99237
description:
2026-01-10 10:10:25 dovecot_plain authenticator failed for H=(pothrona) [65.20.129.67]:45477: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.173.58.47
country_id: 6252001
description:
2026-01-10 10:12:04 dovecot_plain authenticator failed for H=c-67-173-58-47.hsd1.il.comcast.net (ingloust) [67.173.58.47]:36446: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan 10 10:13:16 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<zYabRwFIKNuOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.236.237.105
country_id: 3469034
description:
Jan 10 10:13:17 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=186.236.237.105, lip=66.85.158.91, session=<Xw2sRwFIho667O1p>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.128.241.207
country_id: 2661886
description:
2026-01-10 10:14:07 dovecot_login authenticator failed for H=195-128-241-207.bredband.obenetwork.net [195.128.241.207]:37458: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.210
country_id: 1269750
description:
2026-01-10 10:14:34 dovecot_login authenticator failed for H=(nsg-corporate-49.218.186.122.airtel.in) [103.251.31.210]:59874: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.118.112.230
country_id: 6252001
description:
2026-01-10 10:14:46 dovecot_login authenticator failed for H=syn-070-118-112-230.biz.spectrum.com [70.118.112.230]:60408: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan 10 10:16:32 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<VohMUwFIjNNCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Jan 10 10:16:52 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<EK6BVAFIRsiLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan 10 10:17:57 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@lankaherbalsolutions.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<xUBlWAFIuqgyBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.84.16.145
country_id: 1880251
description:
Jan 10 10:18:10 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=47.84.16.145, lip=66.85.158.91, session=<GMooWQFIPMwvVBCR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan 10 10:18:39 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@bostonlanka.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<uW/mWgFIBq4FhXlo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan 10 10:19:16 host2 sshd[2615868]: Disconnected from invalid user admin 2.57.121.112 port 21269 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan 10 10:20:50 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@venee.lk>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<rjm7YgFI49gz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Jan 10 10:21:41 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<PB68ZQFIcoOLO0qU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-10 10:22:43 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (rephirant) [87.103.126.54]:9343: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Jan 10 10:24:45 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<IimncAFIiDovWbHj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2026-01-10 10:25:16 dovecot_login authenticator failed for H=([38.226.118.9]) [38.226.118.0]:40548: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.224.62.206
country_id: 2464461
description:
2026-01-10 10:25:41 dovecot_login authenticator failed for H=([41.224.62.206]) [41.224.62.206]:45728: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.229.42
country_id: 1269750
description:
2026-01-10 10:26:20 dovecot_login authenticator failed for H=([152.52.238.53]) [152.52.229.42]:53206: 535 Incorrect authentication data (set_id=postmaster@kamecho.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.45
country_id: 290557
description:
Jan 10 10:26:31 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=185.93.89.45, lip=66.85.158.91, session=<uwYKdwFIQpy5XVkt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.212.140.171
country_id: 1880251
description:
2026-01-10 10:26:33 dovecot_login authenticator failed for H=(171.140.212.218.starhub.net.sg) [218.212.140.171]:20110: 535 Incorrect authentication data (set_id=postmaster@kamecho.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan 10 10:26:41 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<pSqldwFIGe0z0msW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.188.130
country_id: 3144096
description:
2026-01-10 10:26:59 dovecot_login authenticator failed for H=(cm-84.213.188.130.get.no) [84.213.188.130]:45934: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan 10 10:27:44 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<R7ZhewFIVLKOq2dI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.245.178
country_id: 1269750
description:
2026-01-10 10:29:25 dovecot_login authenticator failed for H=(dhcp-192-245-178.in2cable.com) [203.192.245.178]:47958: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.80.65.214
country_id: 6252001
description:
2026-01-10 10:29:39 dovecot_login authenticator failed for H=syn-075-080-065-214.biz.spectrum.com [75.80.65.214]:59571: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan 10 10:29:45 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<T+mYggFI9Hui8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.143.72
country_id: 298795
description:
2026-01-10 10:30:47 dovecot_plain authenticator failed for H=(oversions) [5.11.143.72]:42064: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 10:31:13 host2 sshd[2627352]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.217
country_id: 6252001
description:
Jan 10 10:31:25 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.217, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<RpqxiAFIe8fN0h/Z>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan 10 10:31:50 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<3ncPigFIls4z0msW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.191.100
country_id: 3144096
description:
2026-01-10 10:32:54 dovecot_login authenticator failed for H=([84.213.191.100]) [84.213.191.100]:37368: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.111.136.21
country_id: 294640
description:
2026-01-10 10:33:20 dovecot_login authenticator failed for H=([84.111.136.21]) [84.111.136.21]:43768: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan 10 10:34:05 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@lankaherbalsolutions.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<Y/QYkgFIqLwyBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.84.16.145
country_id: 1880251
description:
Jan 10 10:34:11 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=47.84.16.145, lip=66.85.158.91, session=<M0B5kgFIFOUvVBCR>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 10:35:36 host2 sshd[2631176]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan 10 10:36:36 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<9HcZmwFIUtUvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.28
country_id: 290557
description:
Jan 10 10:36:23 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=185.93.89.28, lip=66.85.158.91, session=<CfBWmgFI8ta5XVkc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.236.237.105
country_id: 3469034
description:
Jan 10 10:37:30 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@seyawin.com>, method=PLAIN, rip=186.236.237.105, lip=66.85.158.91, session=<8FdLngFIOoC67O1p>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-01-10 10:37:50 dovecot_plain authenticator failed for H=host-196-47-172-253.afnet.net (brapprets) [196.47.172.253]:58286: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.68.110.207
country_id: 2921044
description:
Jan 10 10:38:58 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=138.68.110.207, lip=66.85.158.91, session=<K/mQowFIpJeKRG7P>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Jan 10 10:38:38 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<knldogFI7rUvT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Jan 10 10:39:46 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<WjtppgFI4HinYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 105.174.17.50
country_id: 3351879
description:
Jan 10 10:40:07 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=105.174.17.50, lip=66.85.158.91, session=<JiOwpwFIo79prhEy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan 10 10:39:12 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@rehanseo.online>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<ysZopAFIwOdnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan 10 10:39:20 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@venee.lk>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<jovfpAFIVIYFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Jan 10 10:40:38 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<O3GHqQFI0I6PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.27.203.227
country_id: 3439705
description:
Jan 10 10:41:24 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=179.27.203.227, lip=66.85.158.91, session=<mUAprAFI1sKzG8vj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.28
country_id: 290557
description:
Jan 10 10:42:07 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ceylondigest.com>, method=PLAIN, rip=185.93.89.28, lip=66.85.158.91, session=<0h7YrgFIfJe5XVkc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.161.96.107
country_id: 6252001
description:
2026-01-10 10:43:26 dovecot_plain authenticator failed for H=c-73-161-96-107.hsd1.mi.comcast.net (heiddlia) [73.161.96.107]:60834: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 213.14.61.156
country_id: 298795
description:
Jan 10 10:43:54 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=213.14.61.156, lip=66.85.158.91, TLS, session=<8+NVtAFI7L/VDj2c>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 141.94.22.51
country_id: 3017382
description:
Jan 10 10:45:00 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=141.94.22.51, lip=66.85.158.91, session=<zZMcuQFIDtGNXhYz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.214
country_id: 3865483
description:
Jan 10 10:44:16 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=179.0.251.214, lip=66.85.158.91, TLS, session=<y6l7tQFIzt6zAPvW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan 10 10:45:09 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sobaherbal.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<9yayuQFI1MSi8KbF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan 10 10:47:01 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<99pawAFI+I8v+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan 10 10:47:18 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<YEpYwQFINDcvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 141.94.22.51
country_id: 3017382
description:
Jan 10 10:47:38 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=141.94.22.51, lip=66.85.158.91, session=<2oiKwgFIMp2NXhYz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.191.33
country_id: 6252001
description:
2026-01-10 10:47:54 dovecot_plain authenticator failed for H=c-73-0-191-33.hsd1.fl.comcast.net (rawanny) [73.0.191.33]:58606: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan 10 10:48:28 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@rehanseo.online>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<jWGLxQFI5q4vWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Jan 10 10:48:54 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<5xsQxwFIeIaLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.27.203.227
country_id: 3439705
description:
Jan 10 10:49:37 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=179.27.203.227, lip=66.85.158.91, session=<W0KhyQFIAKezG8vj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan 10 10:51:37 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 7 secs): user=<finance@venee.lk>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<HZJ70AFIri9niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan 10 10:51:41 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<bXMH0QFIqpei8KbF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.247.20.83
country_id: 1643084
description:
Jan 10 10:52:39 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@sobaherbal.com>, method=PLAIN, rip=103.247.20.83, lip=66.85.158.91, session=<6x931AFILttn9xRT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.80
country_id: 6252001
description:
Jan 10 10:52:56 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.80, lip=66.85.158.91, TLS, session=<sW2f1QFIYPfN0h9Q>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan 10 10:53:11 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<d/Zm1gFIbLRIpyJ4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan 10 10:53:25 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<19c11wFIJKoFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.236.237.105
country_id: 3469034
description:
Jan 10 10:53:47 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=186.236.237.105, lip=66.85.158.91, session=<VY+G2AFI7IW67O1p>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan 10 10:53:54 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<Jmrz2AFI9NFnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.230.228.16
country_id: 6252001
description:
2026-01-10 10:53:55 dovecot_plain authenticator failed for H=c-71-230-228-16.hsd1.de.comcast.net (ovencer) [71.230.228.16]:33772: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.105.156.165
country_id: 3923057
description:
Jan 10 10:55:05 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=200.105.156.165, lip=66.85.158.91, session=<Es0r3QFIyt/IaZyl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.236.237.105
country_id: 3469034
description:
Jan 10 10:54:26 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=186.236.237.105, lip=66.85.158.91, session=<pBjY2gFI6pC67O1p>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan 10 10:56:45 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<sfgK4wFIIuiygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.247.20.83
country_id: 1643084
description:
Jan 10 10:56:47 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@lankaherbalsolutions.com>, method=PLAIN, rip=103.247.20.83, lip=66.85.158.91, session=<yZpD4wFIxqVn9xRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.57.236.167
country_id: 1819730
description:
Jan 10 10:56:47 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=47.57.236.167, lip=66.85.158.91, session=<8opI4wFI4KEvOeyn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Jan 10 10:57:53 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<pUcy5wFILqe8putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan 10 10:57:19 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<Bx8o5QFI7oBnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan 10 10:57:20 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<i8xD5QFIlzRniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.105.156.165
country_id: 3923057
description:
Jan 10 10:57:34 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=200.105.156.165, lip=66.85.158.91, session=<yUcT5gFINszIaZyl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan 10 10:59:48 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<GgYM7gFIvpkv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 97.74.84.186
country_id: 1880251
description:
Jan 10 11:01:54 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=97.74.84.186, lip=66.85.158.91, session=<FMV49QFIBqdhSlS6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.178
country_id: 1269750
description:
2026-01-10 11:03:26 dovecot_login authenticator failed for H=([122.187.181.57]) [182.95.174.178]:51996: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.135.19.135
country_id: 1819730
description:
Jan 10 11:03:32 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=43.135.19.135, lip=66.85.158.91, session=<cRRm+wFIPoMrhxOH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.27.203.227
country_id: 3439705
description:
Jan 10 11:03:38 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=179.27.203.227, lip=66.85.158.91, session=<Kde/+wFIDOGzG8vj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.8.218.251
country_id: 2661886
description:
2026-01-10 11:03:40 dovecot_login authenticator failed for H=([81.8.218.251]) [81.8.218.251]:50558: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan 10 11:03:18 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=</O2K+gFIpueygBt7>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 11:05:45 host2 sshd[2656944]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.181.181
country_id: 1831722
description:
2026-01-10 11:05:36 dovecot_login authenticator failed for H=([36.37.181.181]) [36.37.181.181]:40544: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.110.176.222
country_id: 1694008
description:
2026-01-10 11:05:58 dovecot_login authenticator failed for H=([27.110.176.222]) [27.110.176.222]:38598: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Jan 10 11:05:10 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@venee.lk>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<SSE9AQJIqvUvWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 202.93.247.247
country_id: 1643084
description:
Jan 10 11:05:11 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@venee.lk>, method=PLAIN, rip=202.93.247.247, lip=66.85.158.91, session=<kIBNAQJIBoXKXff3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Jan 10 11:06:39 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<JRiMBgJISqZAF6S9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.28
country_id: 290557
description:
Jan 10 11:07:01 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=185.93.89.28, lip=66.85.158.91, session=<1Q/kBwJI4IS5XVkc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Jan 10 11:07:55 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ceylondigest.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<dHkbCwJIYOCnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.247.20.83
country_id: 1643084
description:
Jan 10 11:08:22 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=103.247.20.83, lip=66.85.158.91, session=<fga5DAJIsMtn9xRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan 10 11:09:13 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<eoy8DwJIQq4vWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan 10 11:09:44 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<aHaZEQJITsAyBvlc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.164.134.19
country_id: 1835841
description:
Jan 10 11:09:53 host2 sshd[2660146]: Disconnected from invalid user user2 43.164.134.19 port 34054 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 202.93.247.247
country_id: 1643084
description:
Jan 10 11:10:24 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=202.93.247.247, lip=66.85.158.91, session=<NhT8EwJIzt/KXff3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan 10 11:10:25 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ceylondigest.com>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<keALFAJI2queRdvj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.10.86.130
country_id: 3895114
description:
Jan 10 11:10:28 host2 sshd[2660859]: Disconnected from invalid user ftpuser 186.10.86.130 port 49994 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.238.191.229
country_id: 6252001
description:
Jan 10 11:12:43 host2 dovecot[1180436]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.238.191.229, lip=66.85.158.91, session=<UNZmHAJIHoED7r/l>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.10.86.130
country_id: 3895114
description:
Jan 10 11:13:13 host2 sshd[2663070]: Disconnected from invalid user ubuntu 186.10.86.130 port 56398 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.164.134.19
country_id: 1835841
description:
Jan 10 11:13:50 host2 sshd[2663455]: Disconnected from invalid user test 43.164.134.19 port 42670 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan 10 11:14:44 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@lankaherbalsolutions.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<hF54IwJIqIQUOAHJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan 10 11:16:51 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<HgwLKwJIGkVniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan 10 11:17:45 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@lankaherbalsolutions.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<e2dILgJI1u0yBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.84.16.145
country_id: 1880251
description:
Jan 10 11:17:25 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ceylondigest.com>, method=PLAIN, rip=47.84.16.145, lip=66.85.158.91, session=<fl0XLQJI2MYvVBCR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 10 11:18:46 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<nH/iMQJIHTB100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan 10 11:18:52 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<yjU7MgJIHpyOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan 10 11:19:58 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@venee.lk>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<OFMnNgJI5JWygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Jan 10 11:19:15 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<dpCfMwJIYNMvT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.68.110.207
country_id: 2921044
description:
Jan 10 11:21:21 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=138.68.110.207, lip=66.85.158.91, session=<d0wlOwJI7NuKRG7P>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Jan 10 11:23:01 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<tDcHQQJIcLOLO0qU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.5.158.211
country_id: 1655842
description:
2026-01-10 11:23:11 dovecot_plain authenticator failed for H=(8N8LN255TCKTWN) [139.5.158.211]:19258: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Jan 10 11:23:57 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<DoFpRAJItrCPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan 10 11:24:04 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<z3HXRAJIJoIz0msW>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 51.210.107.22
country_id: 3017382
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[51.210.107.22] [Remote Port]=[33318] [Authentication Database]=[mail] [Username]=[admin@venee.lk] (10/10 failures) (blocked until [Sun Jan 11 05:54:02 2026 UTC/Sun Jan 11 11:24:02 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan 10 11:25:12 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<p9zUSAJIutRCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan 10 11:26:31 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<1MeVTQJIlOEFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan 10 11:27:27 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<Gn/zUAJIIJGi8KbF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.59.74.148
country_id: 1269750
description:
Jan 10 11:27:46 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<DwAXUgJIOqWLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 141.94.22.51
country_id: 3017382
description:
Jan 10 11:28:24 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=141.94.22.51, lip=66.85.158.91, session=<wiVRVAJI7seNXhYz>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.211
country_id: 2635167
description:
Jan 10 11:28:35 host2 dovecot[1180436]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.211, lip=66.85.158.92, TLS, session=<PxQhVQJIXYpX7LDT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.163.122.133
country_id: 1210997
description:
2026-01-10 11:28:44 dovecot_login authenticator failed for H=([182.163.122.133]) [182.163.122.133]:37801: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.158.14.232
country_id: 1512440
description:
2026-01-10 11:29:05 dovecot_login authenticator failed for H=([195.158.14.232]) [195.158.14.232]:43644: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan 10 11:29:26 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<478PWAJI4tAv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan 10 11:29:58 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<mmfyWQJIIeMz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 141.94.22.51
country_id: 3017382
description:
Jan 10 11:31:04 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@kiriaswanu.com>, method=PLAIN, rip=141.94.22.51, lip=66.85.158.91, session=<ZrznXQJIAOSNXhYz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan 10 11:30:34 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<RPgTXAJINuYvTJuG>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.249.32.140
country_id: 3017382
description:
[2025-12-26 17:26:14 +0530] info [cpaneld] 173.249.32.140 - vdeploy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan 10 11:33:39 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@melanifinefood.com>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<Dr4iZwJICLKOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.177.227
country_id: 6252001
description:
Jan 10 11:34:20 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=47.89.177.227, lip=66.85.158.91, session=<l++KaQJIVj8vWbHj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan 10 11:35:10 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<Z4OHbAJIm5Yz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan 10 11:35:19 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@venee.lk>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<22EKbQJI0wVniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.247.20.83
country_id: 1643084
description:
Jan 10 11:35:57 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@sobaherbal.com>, method=PLAIN, rip=103.247.20.83, lip=66.85.158.91, session=<YOlWbwJI6N5n9xRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan 10 11:36:35 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@venee.lk>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<ugiVcQJIAutIpyJ4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.105.156.165
country_id: 3923057
description:
Jan 10 11:38:21 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=200.105.156.165, lip=66.85.158.91, session=<rZLzdwJIfOLIaZyl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.247.20.83
country_id: 1643084
description:
Jan 10 11:40:11 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 6 secs): user=<office@lankaherbalsolutions.com>, method=PLAIN, rip=103.247.20.83, lip=66.85.158.91, session=<DWpEfgJIMOFn9xRT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan 10 11:40:51 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<4WnRgAJIVBZniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.105.156.165
country_id: 3923057
description:
Jan 10 11:40:51 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@seyawin.com>, method=PLAIN, rip=200.105.156.165, lip=66.85.158.91, session=<xArVgAJIounIaZyl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 97.74.84.186
country_id: 1880251
description:
Jan 10 11:42:05 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@venee.lk>, method=PLAIN, rip=97.74.84.186, lip=66.85.158.91, session=<w+8yhQJImOdhSlS6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan 10 11:42:19 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@lankaherbalsolutions.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<HLMVhgJIftQv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan 10 11:42:35 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<LtIShwJIxOAvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Jan 10 11:45:38 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@dataesite.lk>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<K27rkQJIBCGnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan 10 11:46:18 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@rehanseo.online>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<trxVlAJI1LJnmud6>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 103.154.231.122
country_id: 1643084
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[103.154.231.122] [Remote Port]=[45780] [Authentication Database]=[mail] [Username]=[office@rehanseo.online] (10/10 failures) (blocked until [Sun Jan 11 06:16:16 2026 UTC/Sun Jan 11 11:46:16 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.27.203.227
country_id: 3439705
description:
Jan 10 11:46:56 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=179.27.203.227, lip=66.85.158.91, session=<xhKblgJI5IqzG8vj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.135.19.135
country_id: 1819730
description:
Jan 10 11:47:13 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=43.135.19.135, lip=66.85.158.91, session=<iFihlwJIdM4rhxOH>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 5.133.121.104
country_id: 1512440
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[5.133.121.104] [Remote Port]=[58940] [Authentication Database]=[mail] [Username]=[hr@venee.lk] (10/10 failures) (blocked until [Sun Jan 11 06:17:29 2026 UTC/Sun Jan 11 11:47:29 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan 10 11:47:31 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@venee.lk>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<n320mAJIPOYFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Jan 10 11:48:49 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@venee.lk>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<AzxcnQJIMLBAF6S9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 202.93.247.247
country_id: 1643084
description:
Jan 10 11:48:31 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=202.93.247.247, lip=66.85.158.91, session=<3NRKnAJIxLzKXff3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 105.174.17.50
country_id: 3351879
description:
Jan 10 11:48:35 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@mathsmotorcysle.xyz>, method=PLAIN, rip=105.174.17.50, lip=66.85.158.91, session=<LfSJnAJIluBprhEy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.27.203.227
country_id: 3439705
description:
Jan 10 11:49:56 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=179.27.203.227, lip=66.85.158.91, session=<OVVSoQJIBp2zG8vj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.158.216
country_id: 2510769
description:
2026-01-10 11:51:05 dovecot_login authenticator failed for H=([207.188.158.216]) [207.188.158.216]:60138: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Jan 10 11:52:17 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ceylondigest.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<XAzCqQJIAlCnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 97.74.84.186
country_id: 1880251
description:
Jan 10 11:52:19 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=97.74.84.186, lip=66.85.158.91, session=<+R3oqQJIgOBhSlS6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan 10 11:53:07 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<mXS7rAJIhIqi8Jp9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.49
country_id: 290557
description:
Jan 10 11:53:11 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=185.93.89.49, lip=66.85.158.91, session=<iA77rAJI+tu5XVkx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 202.93.247.247
country_id: 1643084
description:
Jan 10 11:53:47 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=202.93.247.247, lip=66.85.158.91, session=<YqghrwJIuILKXff3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan 10 11:53:48 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ceylondigest.com>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<Uq4vrwJIlNaeRdvj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan 10 11:54:23 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@rehanseo.online>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<sn9IsQJI8ucvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan 10 11:54:22 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<aVA3sQJI9uyi8KbF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Jan 10 11:55:09 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<noreply@venee.lk>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<SrTlswJIeo6LO0qU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.158
country_id: 1269750
description:
2026-01-10 11:55:57 dovecot_login authenticator failed for H=([182.95.26.52]) [182.95.185.158]:50182: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 139.59.74.148
country_id: 1269750
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[139.59.74.148] [Remote Port]=[36474] [Authentication Database]=[mail] [Username]=[noreply@venee.lk] (10/10 failures) (blocked until [Sun Jan 11 06:25:07 2026 UTC/Sun Jan 11 11:55:07 2026 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.76
country_id: 2186224
description:
2026-01-10 11:56:15 dovecot_login authenticator failed for H=([121.73.168.76]) [121.73.168.76]:45334: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan 10 11:56:35 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<t9shuQJIvLSi8KbF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan 10 11:58:21 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@sobaherbal.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<0PdzvwJIiKIyBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.27.203.227
country_id: 3439705
description:
Jan 10 11:58:24 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=179.27.203.227, lip=66.85.158.91, session=<p9udvwJI+r2zG8vj>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 179.27.203.227
country_id: 3439705
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[179.27.203.227] [Remote Port]=[48634] [Authentication Database]=[mail] [Username]=[info@ceylondigest.com] (10/10 failures) (blocked until [Sun Jan 11 06:28:22 2026 UTC/Sun Jan 11 11:58:22 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.7.212
country_id: 690791
description:
Jan 10 11:59:06 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=176.103.7.212, lip=66.85.158.91, TLS, session=<d3REwQJIVeWwZwfU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Jan 10 11:59:09 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<JNtPwgJI1tmPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 207.248.113.77
country_id: 3996063
description:
Jan 10 11:59:24 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=207.248.113.77, lip=66.85.158.91, TLS, session=<XnNewgJIc9nP+HFN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Jan 10 11:59:30 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<9u5/wwJI6t4vTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.45
country_id: 290557
description:
Jan 10 12:00:02 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=185.93.89.45, lip=66.85.158.91, session=<oJl9xQJI+LS5XVkt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan 10 12:01:31 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<YS3DygJIJoRnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan 10 12:01:50 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<hqDmywJIer0FhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Jan 10 12:04:07 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 7 secs): user=<no-reply@anandaobauae.org>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<nyzC0wJIEsJAF6S9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan 10 12:04:18 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<Z6a31AJIpq6ygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.108.89.210
country_id: 3932488
description:
Jan 10 12:05:02 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=190.108.89.210, lip=66.85.158.91, session=<fj5Z1wJI4p6+bFnS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan 10 12:05:05 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<qPGI1wJI7sRnmud6>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan 10 12:04:15 host2 pure-ftpd[2706374]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 178.128.27.123
country_id: 1880251
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[178.128.27.123] [Remote Port]=[44710] [Authentication Database]=[mail] [Username]=[sales@essenceceylontea.com] (10/10 failures) (blocked until [Sun Jan 11 06:34:16 2026 UTC/Sun Jan 11 12:04:16 2026 LOCAL])


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.14.88.150
country_id: 6252001
description:
Jan 10 12:05:21 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.14.88.150, lip=66.85.158.92, session=<ICue2AJIfsAUDliW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.57.236.167
country_id: 1819730
description:
Jan 10 12:06:24 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@sivagnanamfoundation.com>, method=PLAIN, rip=47.57.236.167, lip=66.85.158.91, session=</T423AJI9pEvOeyn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Jan 10 12:06:41 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sivagnanamfoundation.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<y0ZG3QJImLO8putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.27.203.227
country_id: 3439705
description:
Jan 10 12:07:04 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=179.27.203.227, lip=66.85.158.91, session=<1sGi3gJIlqWzG8vj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.188.10
country_id: 3144096
description:
2026-01-10 12:07:55 dovecot_login authenticator failed for H=([178.232.188.10]) [178.232.188.10]:34286: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan 10 12:10:56 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<8zt27AJIoNyygBt7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.83.134.101
country_id: 3469034
description:
2026-01-10 12:10:11 dovecot_login authenticator failed for H=(179.83.135.1.dynamic.adsl.gvt.net.br) [179.83.134.101]:53067: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.84.34.85
country_id: 1210997
description:
2026-01-10 12:10:23 dovecot_login authenticator failed for H=(ppp075.bol-online.com) [202.84.34.85]:49946: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.242.162
country_id: 1880251
description:
Jan 10 12:12:00 host2 pure-ftpd[2714497]: (?@165.22.242.162) [INFO] New connection from 165.22.242.162


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.44
country_id: 1269750
description:
2026-01-10 12:13:07 dovecot_login authenticator failed for H=([103.147.248.44]) [103.147.248.44]:49228: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.108.89.210
country_id: 3932488
description:
Jan 10 12:14:18 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@venee.lk>, method=PLAIN, rip=190.108.89.210, lip=66.85.158.91, session=<ePZ8+AJIAKi+bFnS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.177.88.3
country_id: 3624060
description:
2026-01-10 12:14:21 dovecot_login authenticator failed for H=([186.177.88.3]) [186.177.88.3]:57616: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.227.252.2
country_id: 1269750
description:
2026-01-10 12:14:10 dovecot_login authenticator failed for H=(abts-tn-dynamic-2.252.227.110.airtelbroadband.in) [110.227.252.2]:59322: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan 10 12:15:21 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<mhJB/AJITKcvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.231.254.192
country_id: 1819730
description:
Jan 10 12:16:06 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@ceylondigest.com>, method=PLAIN, rip=103.231.254.192, lip=66.85.158.91, session=<2jLz/gJIlOZn5/7A>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.21
country_id: 1733045
description:
2026-01-10 12:16:14 dovecot_login authenticator failed for H=([49.124.152.21]) [49.124.152.21]:60162: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.69.31.253
country_id: 3469034
description:
2026-01-10 12:16:27 dovecot_login authenticator failed for H=(177-069-031-253.static.ctbctelecom.com.br) [177.69.31.253]:46612: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan 10 12:16:31 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ceylondigest.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<77RzAANI8uxnpBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.247
country_id: 1269750
description:
2026-01-10 12:17:00 dovecot_login authenticator failed for H=(nsg-corporate-247.228.187.122.airtel.in) [122.187.228.247]:49074: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.208.46.130
country_id: 1522867
description:
2026-01-10 12:17:33 dovecot_login authenticator failed for H=([37.208.46.130]) [37.208.46.130]:53008: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.247.77.115
country_id: 1269750
description:
2026-01-10 12:18:38 dovecot_login authenticator failed for H=([103.220.16.51]) [117.247.77.115]:42456: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.248.243.181
country_id: 2542007
description:
2026-01-10 12:18:49 dovecot_plain authenticator failed for H=(llacums) [41.248.243.181]:47312: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.185.212
country_id: 6252001
description:
Jan 10 12:19:06 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=40.124.185.212, lip=66.85.158.91, session=<JLzECQNIWokofLnU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.44.54
country_id: 1269750
description:
2026-01-10 12:19:14 dovecot_login authenticator failed for H=(static.bb.alp.61.2.44.54.bsnl.in) [61.2.44.54]:56948: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan 10 12:19:39 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<fC+hCwNI/McyBvlc>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 12:21:16 host2 sshd[2724942]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan 10 12:22:12 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<EgHGFANISqMUOAHJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan 10 12:25:20 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@sobaherbal.com>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<rNPoHwNIPLmOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan 10 12:27:33 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@venee.lk>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<t6/nJwNIEKMz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan 10 12:27:36 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<Z0IMKANI/MuygBt7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.213.223
country_id: 99237
description:
Jan 10 12:28:08 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=65.20.213.223, lip=66.85.158.91, TLS, session=<B6MSKQNI86pBFNXf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.60.48
country_id: 2300660
description:
Jan 10 12:28:29 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=41.139.60.48, lip=66.85.158.91, TLS, session=<Z9kxKgNIhbkpizww>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.229.246
country_id: 6252001
description:
Jan 10 12:29:14 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@kiriaswanu.com>, method=PLAIN, rip=162.240.229.246, lip=66.85.158.91, session=<hdTpLQNIXsyi8OX2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Jan 10 12:29:27 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@bostonlanka.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<5XqrLgNIWpGLO0qU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.132.133.54
country_id: 1269750
description:
2026-01-10 12:30:58 dovecot_login authenticator failed for H=(dsl-del-dynamic-073.72.246.61.airtelbroadband.in) [203.132.133.54]:33368: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.126
country_id: 1269750
description:
2026-01-10 12:31:25 dovecot_login authenticator failed for H=([125.17.198.33]) [182.95.178.126]:49392: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Jan 10 12:32:15 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<VsqpOANIeIsvT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.229.246
country_id: 6252001
description:
Jan 10 12:32:21 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@seyawin.com>, method=PLAIN, rip=162.240.229.246, lip=66.85.158.91, session=<Y/X4OANIKtei8OX2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.25.232.7
country_id: 953987
description:
Jan 10 12:32:55 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<amila@euroentertainmentlk.com>, method=PLAIN, rip=41.25.232.7, lip=66.85.158.91, session=<ndsYOwNIuekpGegH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan 10 12:33:30 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@essenceceylontea.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<7g4lPQNI4Okz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Jan 10 12:34:14 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<noreply@essenceceylontea.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<IDXJPwNIMq6LO0qU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.178
country_id: 1269750
description:
2026-01-10 12:34:24 dovecot_login authenticator failed for H=([182.95.222.178]) [182.95.222.178]:35982: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.182.65.40
country_id: 3017382
description:
2026-01-10 12:34:33 dovecot_login authenticator failed for H=40.ip-217-182-65.eu [217.182.65.40]:38642: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan 10 12:34:37 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<0YwuQQNIpKdCdMzo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.157.219.158
country_id: 6252001
description:
2026-01-10 12:36:12 dovecot_plain authenticator failed for H=c-76-157-219-158.hsd1.il.comcast.net (profulatic) [76.157.219.158]:35194: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan 10 12:36:46 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<uYvYSANIHsIFhXlo>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 125.20.16.22
country_id: 1269750
description:
Jan 10 12:38:20 host2 sshd[2739297]: Disconnected from invalid user ubuntu 125.20.16.22 port 19100 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan 10 12:38:46 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<zRnTTwNIbJ8z0msW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.4.68.73
country_id: 1210997
description:
2026-01-10 12:39:34 dovecot_login authenticator failed for H=(210.4.68-73.bdcom.com) [210.4.68.73]:51632: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.78
country_id: 1733045
description:
2026-01-10 12:39:58 dovecot_login authenticator failed for H=([49.124.151.78]) [49.124.151.78]:48178: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan 10 12:40:22 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<p/q2VQNIxt2Oq2dI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2026-01-10 12:42:16 dovecot_plain authenticator failed for H=c-174-169-224-27.hsd1.vt.comcast.net (coprify) [174.169.224.27]:54400: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.83.145.39
country_id: 6252001
description:
Jan 10 12:43:50 host2 dovecot[1180436]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.83.145.39, lip=66.85.158.91, session=<JPU+YgNIyNQDU5En>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan 10 12:46:26 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 6 secs): user=<office@kiriaswanu.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<zMotawNITo1100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan 10 12:49:45 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<JGZIdwNIONAvWfaQ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 10 12:51:30 host2 sshd[2750800]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-01-10 12:51:34 dovecot_plain authenticator failed for H=host-196-47-172-253.afnet.net (stionite) [196.47.172.253]:59471: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Jan 10 12:51:30 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 7 secs): user=<support@dataesite.lk>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<jPs8fQNIHtqnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.45
country_id: 290557
description:
Jan 10 12:52:11 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=185.93.89.45, lip=66.85.158.91, session=<ZZnzfwNIuuK5XVkt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.88
country_id: 6252001
description:
Jan 10 12:53:42 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.88, lip=66.85.158.91, session=<MU6MhQNImvqTuYRY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan 10 12:55:11 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<29ysigNIGIpnmud6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 10 12:56:50 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: Connection closed, session=<l0a8kANIiOQDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 105.174.17.50
country_id: 3351879
description:
Jan 10 12:57:50 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=105.174.17.50, lip=66.85.158.91, session=<DDMrlANIPzVprhEy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 10 12:57:10 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: Connection closed, session=<pxvzkQNImMIDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 10 12:58:08 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<2gNhlQNI8pIDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan 10 12:58:38 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<d3UMlwNIbIAFhXlo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.35.53
country_id: 3144096
description:
2026-01-10 12:58:42 dovecot_login authenticator failed for H=([46.212.35.53]) [46.212.35.53]:58329: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.170.59
country_id: 99237
description:
2026-01-10 12:58:54 dovecot_login authenticator failed for H=([65.20.170.59]) [65.20.170.59]:57248: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 10 12:59:59 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<VUAAnANISM4DhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.27.203.227
country_id: 3439705
description:
Jan 10 13:00:25 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=179.27.203.227, lip=66.85.158.91, session=<n5xonQNIIouzG8vj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 10 13:00:09 host2 dovecot[1180436]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<2FaSnANI5O0DhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Jan 10 13:01:46 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@venee.lk>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<2gs/ogNInMuLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan 10 13:01:52 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@rehanseo.online>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<85mbogNIeIovWfaQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 10 13:02:05 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<XXt+owNI9pUDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 10 13:02:15 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<j5YXpANIsqkDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan 10 13:02:26 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@kiriaswanu.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<YmyepANInuGi8KbF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Jan 10 13:03:51 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<1cnPqQNIRogDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan 10 13:04:40 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@dataesite.lk>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<OqmjrANISk6i8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.97.23
country_id: 1861060
description:
2026-01-10 13:05:37 dovecot_login authenticator failed for H=www.shirakami.or.jp [203.192.97.23]:39078: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.251.249.72
country_id: 2300660
description:
2026-01-10 13:08:28 dovecot_login authenticator failed for H=([197.251.249.72]) [197.251.249.72]:47403: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.27.203.227
country_id: 3439705
description:
Jan 10 13:09:00 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=179.27.203.227, lip=66.85.158.91, session=<J6cXvANIDrqzG8vj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.255.26
country_id: 2661886
description:
2026-01-10 13:08:13 dovecot_login authenticator failed for H=94-255-255-26.cust.bredband2.com [94.255.255.26]:47672: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 128.203.200.175
country_id: 6251999
description:
Jan 10 13:10:27 host2 pure-ftpd[2767302]: (?@128.203.200.175) [INFO] New connection from 128.203.200.175


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan 10 13:10:37 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<T3jnwQNIROZnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2026-01-10 13:11:28 dovecot_login authenticator failed for H=([128.185.39.145]) [128.185.214.78]:54152: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan 10 13:11:39 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<xY+SxQNIsLSygBt7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.106
country_id: 1269750
description:
2026-01-10 13:11:56 dovecot_login authenticator failed for H=([152.52.244.106]) [152.52.244.106]:51472: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-01-10 13:12:20 dovecot_plain authenticator failed for H=(vicalis) [24.187.213.29]:59278: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Jan 10 13:12:26 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shuf@sobaherbal.com>, method=PLAIN, rip=157.230.24.207, lip=66.85.158.91, session=<enhoyANI6oed5hjP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan 10 13:12:59 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<RW5cygNIEOgFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.49
country_id: 290557
description:
Jan 10 13:14:27 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=185.93.89.49, lip=66.85.158.91, session=<b3ebzwNIIJ+5XVkx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 202.93.247.247
country_id: 1643084
description:
Jan 10 13:14:38 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=202.93.247.247, lip=66.85.158.91, session=<UXU80ANIDoTKXff3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan 10 13:14:34 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<DC8N0ANIisMv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan 10 13:14:11 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<m+ejzgNIyqpnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2026-01-10 13:16:07 dovecot_login authenticator failed for H=([38.226.118.9]) [38.226.118.0]:59522: 535 Incorrect authentication data (set_id=abuse)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Jan 10 13:15:35 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<fsmk0wNIFqS8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.246.166
country_id: 798544
description:
2026-01-10 13:15:54 dovecot_login authenticator failed for H=89-67-246-166.dynamic.play.pl [89.67.246.166]:38103: 535 Incorrect authentication data (set_id=abuse@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.57.236.167
country_id: 1819730
description:
Jan 10 13:16:38 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=47.57.236.167, lip=66.85.158.91, session=<F+Nn1wNIIq0vOeyn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 141.94.22.51
country_id: 3017382
description:
Jan 10 13:18:24 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=141.94.22.51, lip=66.85.158.91, session=<bfmt3QNI/LONXhYz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan 10 13:18:24 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<hr@venee.lk>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<5yKa3QNITptIpyJ4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan 10 13:18:30 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<m/YP3gNIwoeygBt7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.60.143.30
country_id: 3175395
description:
2026-01-10 13:19:07 dovecot_login authenticator failed for H=([151.60.143.30]) [151.60.143.30]:45809: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.20.42
country_id: 1643084
description:
Jan 10 13:19:29 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=103.164.20.42, lip=66.85.158.91, session=<eM2T4QNIGulnpBQq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.174.182.38
country_id: 2077456
description:
2026-01-10 13:19:56 dovecot_login authenticator failed for H=203-174-182-38.ade.static-ipl.aapt.com.au [203.174.182.38]:35226: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.31
country_id: 1733045
description:
2026-01-10 13:23:36 dovecot_login authenticator failed for H=([49.124.153.31]) [49.124.153.31]:59684: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan 10 13:23:07 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@seyawin.com>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<C56Z7gNIqJgvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.108.89.210
country_id: 3932488
description:
Jan 10 13:24:11 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@venee.lk>, method=PLAIN, rip=190.108.89.210, lip=66.85.158.91, session=<o8Nv8gNIlI2+bFnS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.105.156.165
country_id: 3923057
description:
Jan 10 13:25:08 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<office@seyawin.com>, method=PLAIN, rip=200.105.156.165, lip=66.85.158.91, session=<xDS69QNIGJjIaZyl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.93.50.90
country_id: 1821275
description:
Jan 10 13:25:57 host2 sshd[2780488]: Disconnected from invalid user ranju 182.93.50.90 port 41920 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.157.219.158
country_id: 6252001
description:
2026-01-10 13:27:32 dovecot_plain authenticator failed for H=c-76-157-219-158.hsd1.il.comcast.net (ophie) [76.157.219.158]:43560: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.82
country_id: 1269750
description:
2026-01-10 13:28:50 dovecot_login authenticator failed for H=([59.145.212.121]) [182.95.184.82]:40940: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.93.89.28
country_id: 290557
description:
Jan 10 13:28:11 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=185.93.89.28, lip=66.85.158.91, session=<W82yAARIoKu5XVkc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan 10 13:30:18 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@mathsmotorcysle.xyz>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<DD5HCARIyocyBvlc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.56.1.201
country_id: 2750405
description:
Jan 10 13:30:30 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=20.56.1.201, lip=66.85.158.91, session=<paEGCQRIwNsUOAHJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2026-01-10 13:31:03 dovecot_plain authenticator failed for H=(extes) [23.30.11.253]:34876: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2026-01-10 13:31:07 dovecot_plain authenticator failed for H=(upeway) [75.97.190.237]:53581: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan 10 13:31:43 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<lCJVDQRIWISOq2dI>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 142.171.103.72
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[142.171.103.72] [Remote Port]=[33880] [Authentication Database]=[mail] [Username]=[info@sobaherbal.com] (10/10 failures) (blocked until [Sun Jan 11 08:01:41 2026 UTC/Sun Jan 11 13:31:41 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan 10 13:31:22 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@venee.lk>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<CbkfDARIf9Iz0msW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.93.50.90
country_id: 1821275
description:
Jan 10 13:32:38 host2 sshd[2785528]: Disconnected from invalid user lalit 182.93.50.90 port 43562 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.27.203.227
country_id: 3439705
description:
Jan 10 13:33:43 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=179.27.203.227, lip=66.85.158.91, session=<026JFARIDpezG8vj>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.247.137.203
country_id: 2635167
description:
Jan 10 13:34:10 host2 pure-ftpd[2786722]: (?@185.247.137.203) [INFO] New connection from 185.247.137.203


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.93.50.90
country_id: 1821275
description:
Jan 10 13:34:57 host2 sshd[2787382]: Disconnected from invalid user sudhir 182.93.50.90 port 49248 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.224.242.137
country_id: 2635167
description:
2026-01-10 13:35:33 dovecot_login authenticator failed for H=([109.224.242.136]) [109.224.242.137]:34682: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.128.27.123
country_id: 1880251
description:
Jan 10 13:35:37 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=178.128.27.123, lip=66.85.158.91, session=<TtRUGwRI0sCygBt7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.8.218.251
country_id: 2661886
description:
2026-01-10 13:36:03 dovecot_login authenticator failed for H=(251.218.8.81.sta.ac-net.se) [81.8.218.251]:50156: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.69.161.214
country_id: 6252001
description:
2026-01-10 13:36:19 dovecot_login authenticator failed for H=([208.69.161.214]) [208.69.161.214]:57556: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.18.99.10
country_id: 1269750
description:
2026-01-10 13:36:37 dovecot_login authenticator failed for H=([125.18.99.10]) [125.18.99.10]:46484: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Jan 10 13:36:53 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<cr/bHwRI1MKLO0qU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan 10 13:37:26 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<CuTRIQRIeMcz0msW>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 50.6.249.92
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[50.6.249.92] [Remote Port]=[35142] [Authentication Database]=[mail] [Username]=[admin@lankaherbalsolutions.com] (10/10 failures) (blocked until [Sun Jan 11 08:07:57 2026 UTC/Sun Jan 11 13:37:57 2026 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.249.92
country_id: 6252001
description:
Jan 10 13:37:59 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=50.6.249.92, lip=66.85.158.91, session=<UPPHIwRIRokyBvlc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-10 13:38:37 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (furets) [87.103.126.54]:16813: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.219.227
country_id: 6251999
description:
Jan 10 13:39:26 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=158.69.219.227, lip=66.85.158.91, session=<bMD4KARInumeRdvj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2026-01-10 13:39:39 dovecot_plain authenticator failed for H=c-68-60-77-128.hsd1.mi.comcast.net (abler) [68.60.77.128]:39094: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.231.254.192
country_id: 1819730
description:
Jan 10 13:40:02 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ceylondigest.com>, method=PLAIN, rip=103.231.254.192, lip=66.85.158.91, session=<fG0bKwRIsJln5/7A>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.166.197
country_id: 6252001
description:
Jan 10 13:40:27 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=162.240.166.197, lip=66.85.158.91, session=<RNORLARIks+i8KbF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Jan 10 13:41:01 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@venee.lk>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<FRaiLgRI6L9AF6S9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Jan 10 13:41:30 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=47.251.0.216, lip=66.85.158.91, session=<INNdMARIQJEv+wDY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.80.9
country_id: 3144096
description:
2026-01-10 13:41:32 dovecot_login authenticator failed for H=([178.232.80.9]) [178.232.80.9]:36103: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.59.74.148
country_id: 1269750
description:
Jan 10 13:41:49 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=139.59.74.148, lip=66.85.158.91, session=<Nmh0MQRI5LKLO0qU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.18.99.38
country_id: 1269750
description:
2026-01-10 13:41:08 dovecot_login authenticator failed for H=([182.95.20.225]) [125.18.99.38]:52150: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.210.107.22
country_id: 3017382
description:
Jan 10 13:42:49 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=51.210.107.22, lip=66.85.158.91, session=<5vsSNQRIxYEz0msW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan 10 13:44:59 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<z/bOPARIsK1CdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 142.171.103.72
country_id: 6252001
description:
Jan 10 13:46:34 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=142.171.103.72, lip=66.85.158.91, session=<s1RzQgRIHNWOq2dI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan 10 13:48:01 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<K2amRwRIcJgFhXlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.164.189
country_id: 6252001
description:
Jan 10 13:52:30 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 7 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=64.23.164.189, lip=66.85.158.91, session=<ZQ1hVwRInopAF6S9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Jan 10 13:52:37 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=47.79.88.199, lip=66.85.158.91, session=<4escWARIVOYvT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 168.205.223.170
country_id: 3469034
description:
Jan 10 13:56:07 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=168.205.223.170, lip=66.85.158.91, TLS, session=<WqWyYwRIMouozd+q>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Jan 10 13:55:29 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<lPhbYgRIdMOnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.27.203.227
country_id: 3439705
description:
Jan 10 13:56:22 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=179.27.203.227, lip=66.85.158.91, session=<dq6IZQRIPpizG8vj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.193.129.122
country_id: 6290252
description:
Jan 10 13:56:25 host2 dovecot[1180436]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=62.193.129.122, lip=66.85.158.91, TLS, session=<6SXPZARIVJo+wYF6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.167.34.120
country_id: 6252001
description:
Jan 10 13:56:45 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=72.167.34.120, lip=66.85.158.91, session=<o0/iZgRIHqlIpyJ4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.89.246.144
country_id: 6252001
description:
Jan 10 13:57:43 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.89.246.144, lip=66.85.158.91, session=<dg9ZagRICLQvWfaQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Jan 10 13:58:30 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=167.99.8.95, lip=66.85.158.91, session=<PD4qbQRIouynYwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2026-01-10 13:58:55 dovecot_plain authenticator failed for H=c-73-13-220-220.hsd1.de.comcast.net (embos) [73.13.220.220]:58242: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 141.94.22.51
country_id: 3017382
description:
Jan 10 14:00:49 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=141.94.22.51, lip=66.85.158.91, session=<jpdndQRIBr+NXhYz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.68.110.207
country_id: 2921044
description:
Jan 10 14:01:00 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@ceylondigest.com>, method=PLAIN, rip=138.68.110.207, lip=66.85.158.91, session=<9/ATdgRIXq2KRG7P>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.156.238.162
country_id: 3686110
description:
Jan 10 14:02:48 host2 sshd[2809543]: Disconnected from invalid user user 190.156.238.162 port 57580 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.40.122.250
country_id: 2629691
description:
2026-01-10 14:03:40 dovecot_login authenticator failed for H=nova-185-040-122-250.cpe.novanet.is [185.40.122.250]:45716: 535 Incorrect authentication data (set_id=signinhr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.108.89.210
country_id: 3932488
description:
Jan 10 14:03:56 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=190.108.89.210, lip=66.85.158.91, session=<pj2XgARInJu+bFnS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.124.75
country_id: 1269750
description:
2026-01-10 14:03:23 dovecot_login authenticator failed for H=(aes-static-075.124.17.125.airtel.in) [125.17.124.75]:51868: 535 Incorrect authentication data (set_id=signinhr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 202.93.247.247
country_id: 1643084
description:
Jan 10 14:03:52 host2 dovecot[1180436]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@venee.lk>, method=PLAIN, rip=202.93.247.247, lip=66.85.158.91, session=<pANXgARI2IzKXff3>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 92.27.101.99
country_id: 2635167
description:
Jan 10 14:03:59 host2 sshd[2810383]: Disconnected from invalid user debian 92.27.101.99 port 34960 [preauth]


