# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.111.144
country_id: 3144096
description:
2025-12-08 23:36:59 dovecot_login authenticator failed for ([84.215.111.144]) [84.215.111.144]:37238: 535 Incorrect authentication data (set_id=contact@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.123.53.88
country_id: 1269750
description:
Dec  8 23:38:10 host2 sshd[4177178]: Disconnected from invalid user mailuser 103.123.53.88 port 52634 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  8 23:39:27 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<YRIBsnRFVIeqQMFo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec  8 23:43:03 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<DunovnRF/JE+PIcq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  8 23:43:23 host2 sshd[4179582]: Disconnected from invalid user admin 2.57.121.112 port 22831 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.164.137
country_id: 99237
description:
2025-12-08 23:43:24 dovecot_plain authenticator failed for (cynous) [65.20.164.137]:59523: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  8 23:43:37 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<MuvlwHRFaKw+PIds>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  8 23:45:01 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<mNTnxXRF9LEv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  8 23:45:45 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@lankaherbalsolutions.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<U9OMyHRFEJWPbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.123.53.88
country_id: 1269750
description:
Dec  8 23:46:20 host2 sshd[4182394]: Disconnected from invalid user cent 103.123.53.88 port 45162 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.85.114.218
country_id: 1218197
description:
Dec  8 23:46:23 host2 sshd[4182447]: Disconnected from invalid user admin 95.85.114.218 port 59340 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.98
country_id: 6252001
description:
2025-12-08 23:47:20 dovecot_login authenticator failed for syn-035-130-111-098.biz.spectrum.com [35.130.111.98]:57102: 535 Incorrect authentication data (set_id=office@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.129.182
country_id: 3144096
description:
2025-12-08 23:47:14 dovecot_login authenticator failed for ([188.124.129.182]) [188.124.129.182]:55707: 535 Incorrect authentication data (set_id=office@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.230.150.7
country_id: 3469034
description:
Dec  8 23:48:55 host2 sshd[4184648]: Disconnected from invalid user huawei 45.230.150.7 port 59038 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.193.188
country_id: 130758
description:
Dec  8 23:49:15 host2 sshd[4185137]: Disconnected from invalid user ubuntu 62.60.193.188 port 44242 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 95.85.114.218
country_id: 1218197
description:
Dec  8 23:50:24 host2 sshd[4186591]: Disconnected from invalid user huawei 95.85.114.218 port 33534 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.85.114.218
country_id: 1218197
description:
Dec  8 23:51:13 host2 sshd[4187081]: Disconnected from invalid user ubuntu 95.85.114.218 port 39400 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.89.12.73
country_id: 3469034
description:
2025-12-08 23:51:33 dovecot_plain authenticator failed for 189-89-12-73.jupiterprovedor.com.br ([89.116.164.85]) [189.89.12.73]:11018: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.89.12.73
country_id: 3469034
description:
2025-12-08 23:51:40 dovecot_login authenticator failed for 189-89-12-73.jupiterprovedor.com.br ([89.116.164.85]) [189.89.12.73]:11018: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 164.92.215.178
country_id: 2750405
description:
Dec  8 23:51:41 host2 pure-ftpd[4187321]: (?@164.92.215.178) [INFO] New connection from 164.92.215.178


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.100.101.161
country_id: 3865483
description:
2025-12-08 23:51:47 dovecot_plain authenticator failed for ([89.116.164.85]) [131.100.101.161]:56242: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.70.198.191
country_id: 1643084
description:
2025-12-08 23:52:02 dovecot_plain authenticator failed for ([89.116.164.85]) [36.70.198.191]:43024: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.219.161.97
country_id: 1880251
description:
Dec  8 23:52:06 host2 sshd[4187531]: Disconnected from invalid user aaa 8.219.161.97 port 36778 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.230.150.7
country_id: 3469034
description:
Dec  8 23:52:42 host2 sshd[4187903]: Disconnected from invalid user user 45.230.150.7 port 38096 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-08 23:54:07 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (zoraticang) [87.103.126.54]:18513: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  8 23:54:14 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<isHo5nRFnNKPbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.219.161.97
country_id: 1880251
description:
Dec  8 23:54:25 host2 sshd[4189295]: Disconnected from invalid user ubuntu 8.219.161.97 port 58538 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.230.150.7
country_id: 3469034
description:
Dec  8 23:55:28 host2 sshd[4189872]: Disconnected from invalid user spark 45.230.150.7 port 35914 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec  8 23:55:37 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@dataesite.lk>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<av7P63RF6KdnJFMP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.114.143.79
country_id: 3865483
description:
2025-12-08 23:56:21 dovecot_login authenticator failed for host-cotesma-114-143-79.smandes.com.ar [181.114.143.79]:50763: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.193.188
country_id: 130758
description:
Dec  8 23:56:23 host2 sshd[4190342]: Disconnected from invalid user httpd 62.60.193.188 port 41862 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-12-08 23:55:59 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:35201: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.134.27.194
country_id: 1210997
description:
2025-12-08 23:56:07 dovecot_login authenticator failed for ([103.134.27.194]) [103.134.27.194]:56022: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.118.49.18
country_id: 1269750
description:
2025-12-08 23:56:18 dovecot_login authenticator failed for ([45.118.49.18]) [45.118.49.18]:56321: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.12.159
country_id: 3144096
description:
2025-12-08 23:56:19 dovecot_login authenticator failed for ([84.211.12.159]) [84.211.12.159]:34733: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.222.54
country_id: 1269750
description:
2025-12-08 23:56:01 dovecot_login authenticator failed for (aes-static-089.140.22.125.airtel.in) [122.187.222.54]:51850: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.85.114.218
country_id: 1218197
description:
Dec  8 23:56:08 host2 sshd[4190192]: Disconnected from invalid user ubuntu 95.85.114.218 port 46876 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.219.8.54
country_id: 1880251
description:
Dec  8 23:57:20 host2 sshd[4190810]: Disconnected from invalid user wx 8.219.8.54 port 38818 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.10
country_id: 1269750
description:
2025-12-08 23:58:15 dovecot_login authenticator failed for ([128.185.241.106]) [182.95.54.10]:40314: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.74.211.27
country_id: 6252001
description:
2025-12-08 23:58:30 dovecot_plain authenticator failed for c-75-74-211-27.hsd1.fl.comcast.net (torme) [75.74.211.27]:35703: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.136.37
country_id: 3996063
description:
2025-12-08 23:57:49 dovecot_login authenticator failed for (187.161.136.37-clientes-izzi.mx) [187.161.136.37]:53952: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 8.219.161.97
country_id: 1880251
description:
Dec  8 23:58:48 host2 sshd[4191617]: Disconnected from invalid user rtc 8.219.161.97 port 40376 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.210.246.54
country_id: 289688
description:
2025-12-08 23:59:10 dovecot_login authenticator failed for ([37.210.246.54]) [37.210.246.54]:43636: 535 Incorrect authentication data (set_id=contacto@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2025-12-08 23:59:22 dovecot_login authenticator failed for (119.92.76.210.static.pldt.net) [119.92.76.210]:56746: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Dec  8 23:59:27 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=167.71.230.230, lip=66.85.158.91, session=<PRSK+XRFtKenR+bm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.193.188
country_id: 130758
description:
Dec  8 23:58:46 host2 sshd[4191593]: Disconnected from invalid user debian 62.60.193.188 port 46532 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.104
country_id: 1880251
description:
Dec  9 00:00:24 host2 sshd[4192971]: Disconnected from invalid user walter 45.78.230.104 port 44046 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.230.150.7
country_id: 3469034
description:
Dec  9 00:00:49 host2 sshd[4193225]: Disconnected from invalid user monitor 45.230.150.7 port 59792 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.193.188
country_id: 130758
description:
Dec  9 00:01:11 host2 sshd[4193467]: Disconnected from invalid user deployer 62.60.193.188 port 59474 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec  9 00:01:51 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<+pYbAnVF9sM+PIcr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.230.150.7
country_id: 3469034
description:
Dec  9 00:02:11 host2 sshd[4193978]: Disconnected from invalid user admin 45.230.150.7 port 58700 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  9 00:02:38 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<BnLtBHVFhoAXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.236.2.130
country_id: 1880251
description:
Dec  9 00:03:47 host2 sshd[1036]: Disconnected from invalid user monitor 47.236.2.130 port 50316 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.184.80
country_id: 99237
description:
2025-12-09 00:04:05 dovecot_plain authenticator failed for (whalacin) [65.20.184.80]:45288: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 69.164.217.245
country_id: 6252001
description:
Dec  9 00:04:33 host2 dovecot[2208013]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=69.164.217.245, lip=66.85.158.92, session=<ImTgC3VF+tBFpNn1>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.230.150.7
country_id: 3469034
description:
Dec  9 00:04:54 host2 sshd[1669]: Disconnected from invalid user rtc 45.230.150.7 port 56530 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.219.161.97
country_id: 1880251
description:
Dec  9 00:05:22 host2 sshd[2082]: Disconnected from invalid user ubuntu 8.219.161.97 port 54612 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.219.8.54
country_id: 1880251
description:
Dec  9 00:07:52 host2 sshd[3374]: Disconnected from invalid user ankit 8.219.8.54 port 55912 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-09 00:09:06 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (relibetion) [87.103.126.54]:9829: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  9 00:09:06 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<oSMIHHVFkqC8putr>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 8.219.8.54
country_id: 1880251
description:
Dec  9 00:09:33 host2 sshd[4432]: Disconnected from invalid user uzivatel 8.219.8.54 port 39374 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec  9 00:10:38 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<8QyJIXVFGISPbvgo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.193.188
country_id: 130758
description:
Dec  9 00:10:55 host2 sshd[5565]: Disconnected from invalid user kuba 62.60.193.188 port 47432 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.46
country_id: 1269750
description:
2025-12-09 00:11:04 dovecot_login authenticator failed for ([125.19.156.46]) [125.19.156.46]:56876: 535 Incorrect authentication data (set_id=office@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 00:11:20 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<viMJJHVFSo+KxX03>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  9 00:12:07 host2 sshd[6490]: Disconnected from invalid user user 2.57.121.25 port 44479 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.118
country_id: 1269750
description:
2025-12-09 00:12:53 dovecot_login authenticator failed for ([125.18.210.161]) [182.95.119.118]:41728: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.218.101
country_id: 1269750
description:
2025-12-09 00:13:18 dovecot_login authenticator failed for ([182.79.218.101]) [182.79.218.101]:55751: 535 Incorrect authentication data (set_id=postmaster@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.134.27.194
country_id: 1210997
description:
2025-12-09 00:12:41 dovecot_login authenticator failed for ([103.134.27.194]) [103.134.27.194]:43402: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.248.156.49
country_id: 1522867
description:
2025-12-09 00:12:51 dovecot_login authenticator failed for ([109.248.156.49]) [109.248.156.49]:41888: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.48.79
country_id: 3144096
description:
2025-12-09 00:12:51 dovecot_login authenticator failed for (cm-84.214.48.79.get.no) [84.214.48.79]:45579: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Dec  9 00:13:31 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<51/dK3VFKtM+PIcp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2025-12-09 00:13:09 dovecot_login authenticator failed for ([103.55.89.5]) [103.55.89.5]:36576: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2025-12-09 00:13:43 dovecot_login authenticator failed for (c-50-188-204-213.unallocated.comcastbusiness.net) [50.188.204.213]:45705: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 00:14:09 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<Va0cLnVFioqKxX03>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.60.193.188
country_id: 130758
description:
Dec  9 00:14:31 host2 sshd[8368]: Disconnected from invalid user star 62.60.193.188 port 52736 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.230.150.7
country_id: 3469034
description:
Dec  9 00:14:37 host2 sshd[8475]: Disconnected from invalid user aaa 45.230.150.7 port 48944 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.219.161.97
country_id: 1880251
description:
Dec  9 00:16:25 host2 sshd[9815]: Disconnected from invalid user admin 8.219.161.97 port 39408 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec  9 00:16:36 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@seyawin.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<s5zZNnVFMrc+PIdc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec  9 00:16:56 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<xaAUOHVFNtI+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-09 00:17:15 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (celly) [87.103.126.54]:59290: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.214.169.10
country_id: 2510769
description:
2025-12-09 00:17:28 dovecot_plain authenticator failed for (ticary) [185.214.169.10]:54062: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec  9 00:17:50 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<z5lNO3VFCOI+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  9 00:18:13 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<jTypPHVFGJQv/lVz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.219.161.97
country_id: 1880251
description:
Dec  9 00:18:29 host2 sshd[11444]: Disconnected from invalid user spark 8.219.161.97 port 57952 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.236.2.130
country_id: 1880251
description:
Dec  9 00:17:48 host2 sshd[10914]: Disconnected from invalid user dspace 47.236.2.130 port 51872 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.104
country_id: 1880251
description:
Dec  9 00:20:23 host2 sshd[13041]: Disconnected from invalid user odoo 45.78.230.104 port 35768 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.219.8.54
country_id: 1880251
description:
Dec  9 00:21:12 host2 sshd[13436]: Disconnected from invalid user sysadmin 8.219.8.54 port 39480 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.12.107
country_id: 3144096
description:
2025-12-09 00:21:22 dovecot_login authenticator failed for ([84.211.12.107]) [84.211.12.107]:59559: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.147.45
country_id: 99237
description:
2025-12-09 00:21:48 dovecot_login authenticator failed for ([65.20.147.45]) [65.20.147.45]:49512: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  9 00:22:04 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<m1hySnVFSOw+PIds>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 00:22:07 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<feyaSnVF3LyqQMFo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.104
country_id: 1880251
description:
Dec  9 00:22:52 host2 sshd[14528]: Disconnected from invalid user steam 45.78.230.104 port 52950 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.29.179.36
country_id: 2510769
description:
2025-12-09 00:24:24 dovecot_login authenticator failed for 36.red-80-29-179.dynamicip.rima-tde.net [80.29.179.36]:41697: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.130
country_id: 6252001
description:
Dec  9 00:24:25 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 14 secs): user=<>, rip=66.132.153.130, lip=66.85.158.92, TLS handshaking: Connection closed, session=<RbL3UnVFlLdChJmC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec  9 00:24:32 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<8UxCU3VFhFF100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.231.202.201
country_id: 51537
description:
2025-12-09 00:25:10 dovecot_login authenticator failed for ([197.231.202.201]) [197.231.202.201]:44098: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.191.55
country_id: 3144096
description:
2025-12-09 00:24:47 dovecot_login authenticator failed for (cm-84.213.191.55.get.no) [84.213.191.55]:59646: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.19
country_id: 3144096
description:
2025-12-09 00:24:53 dovecot_login authenticator failed for (cm-178.232.153.19.get.no) [178.232.153.19]:45811: 535 Incorrect authentication data (set_id=sales@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 47.236.2.130
country_id: 1880251
description:
Dec  9 00:24:54 host2 sshd[16125]: Disconnected from invalid user ubuntu 47.236.2.130 port 36048 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec  9 00:25:42 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<uj1yV3VFSOY+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec  9 00:27:46 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<GTfKXnVFRKpnJFMP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec  9 00:30:11 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<IoRzZ3VFH95100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.145.118.40
country_id: 3175395
description:
2025-12-09 00:31:37 dovecot_plain authenticator failed for net-93-145-118-40.cust.vodafonedsl.it (differm) [93.145.118.40]:60774: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.219.161.97
country_id: 1880251
description:
Dec  9 00:31:33 host2 sshd[21553]: Disconnected from invalid user artur 8.219.161.97 port 33366 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.44.30
country_id: 1522867
description:
2025-12-09 00:33:05 dovecot_login authenticator failed for ([5.76.44.30]) [5.76.44.30]:38905: 535 Incorrect authentication data (set_id=test@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.79.120.248
country_id: 6251999
description:
2025-12-09 00:33:13 dovecot_login authenticator failed for s01060030f43b0098.vn.shawcable.net [70.79.120.248]:37390: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 00:35:15 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<cSqZeXVF+O2qQMFo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.202.209.172
country_id: 3437598
description:
Dec  9 00:35:44 host2 sshd[24672]: Disconnected from invalid user ubuntu 143.202.209.172 port 42794 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.190.12
country_id: 3144096
description:
2025-12-09 00:36:27 dovecot_login authenticator failed for (cm-84.213.190.12.get.no) [84.213.190.12]:37348: 535 Incorrect authentication data (set_id=admin@dragon.lk)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.122
country_id: 2635167
description:
Dec  9 00:37:29 host2 dovecot[2208013]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 7 secs): user=<>, rip=185.247.137.122, lip=66.85.158.92, TLS, session=<ZJOpgXVFF56594l6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  9 00:36:45 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<rEf1fnVF4JY+PIdr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  9 00:36:53 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@lankaherbalsolutions.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<2chsf3VFDsKPbtX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2025-12-09 00:38:08 dovecot_login authenticator failed for h-155-4-31-215.a2204.priv.bahnhof.se [155.4.31.215]:45756: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-12-09 00:37:49 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:43672: 535 Incorrect authentication data (set_id=contact@dragon.lk)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.85
country_id: 2635167
description:
Dec  9 00:39:40 host2 dovecot[2208013]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 7 secs): user=<>, rip=87.236.176.85, lip=66.85.158.92, TLS, session=<pId2iXVFVe1X7LBV>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 00:40:39 +0530] info [cpaneld] 213.209.143.251 - agrona "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agrona (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  9 00:42:49 host2 sshd[29606]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  9 00:43:47 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<80QdmHVFWN0v/lVz>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 143.202.209.172
country_id: 3437598
description:
Dec  9 00:43:56 host2 sshd[30311]: Disconnected from invalid user httpd 143.202.209.172 port 57676 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 00:44:26 +0530] info [cpaneld] 213.209.143.251 - ajssta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajssta (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  9 00:45:18 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@seyawin.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<TCiJnXVFkJWPbtX3>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 143.110.213.247
country_id: 6251999
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[143.110.213.247] [Remote Port]=[38288] [Authentication Database]=[mail] [Username]=[notify@seyawin.com] (10/10 failures) (blocked until [Tue Dec  9 19:15:16 2025 UTC/Wed Dec 10 00:45:16 2025 LOCAL])


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.104
country_id: 1880251
description:
Dec  9 00:45:22 host2 sshd[31749]: Disconnected from invalid user guest2 45.78.230.104 port 53638 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.255.189.39
country_id: 298795
description:
2025-12-09 00:47:14 dovecot_login authenticator failed for (88.255.189.39.static.ttnet.com.tr) [88.255.189.39]:37132: 535 Incorrect authentication data (set_id=contacto@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec  9 00:47:58 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<5JgSp3VFTMA+PIcr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.202.209.172
country_id: 3437598
description:
Dec  9 00:50:40 host2 sshd[35721]: Disconnected from invalid user felix 143.202.209.172 port 59292 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.84.36.99
country_id: 1880251
description:
Dec  9 00:52:44 host2 sshd[37131]: Disconnected from invalid user openstack 47.84.36.99 port 41082 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  9 00:53:52 host2 sshd[37785]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Dec  9 00:54:05 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=167.71.230.230, lip=66.85.158.91, session=<8qvrvHVFqsWnR+bm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec  9 00:56:32 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<2vWuxXVFvpk+PIdq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.49
country_id: 3469034
description:
Dec  9 00:56:51 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=190.89.137.49, lip=66.85.158.91, TLS, session=<UsfpxXVFDey+WYkx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.191.223.236
country_id: 3865483
description:
Dec  9 00:57:13 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<accounts>, method=PLAIN, rip=181.191.223.236, lip=66.85.158.91, TLS, session=<MRAQx3VFi+a1v9/s>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.144.34
country_id: 1269750
description:
2025-12-09 00:58:10 dovecot_login authenticator failed for ([182.78.144.34]) [182.78.144.34]:59740: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.144
country_id: 6252001
description:
2025-12-09 00:58:16 dovecot_login authenticator failed for ([209.23.72.144]) [209.23.72.144]:39184: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.42
country_id: 1149361
description:
2025-12-09 00:58:25 dovecot_login authenticator failed for ([149.54.15.42]) [149.54.15.42]:46490: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.127.101.225
country_id: 1880251
description:
2025-12-09 00:58:54 dovecot_login authenticator failed for ([101.127.101.225]) [101.127.101.225]:52360: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.223.114
country_id: 1269750
description:
2025-12-09 00:58:41 dovecot_login authenticator failed for ([182.95.193.177]) [182.95.223.114]:46562: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.59.26
country_id: 1269750
description:
2025-12-09 00:58:47 dovecot_login authenticator failed for ([125.23.125.209]) [122.187.59.26]:36462: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.243.189.141
country_id: 1819730
description:
Dec  9 00:58:52 host2 sshd[42522]: Disconnected from invalid user misp 47.243.189.141 port 45968 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec  9 00:59:49 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<1DFw0XVFDtpnJFMP>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 47.243.189.141
country_id: 1819730
description:
Dec  9 01:00:27 host2 sshd[43969]: Disconnected from invalid user saeid 47.243.189.141 port 52832 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.53.234
country_id: 3932488
description:
2025-12-09 01:01:28 dovecot_login authenticator failed for ([190.223.53.234]) [190.223.53.234]:33682: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.211.234.150
country_id: 1733045
description:
Dec  9 01:02:07 host2 sshd[44991]: Disconnected from invalid user olivier 102.211.234.150 port 45198 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.243.122.248
country_id: 1819730
description:
Dec  9 01:02:11 host2 sshd[45023]: Disconnected from invalid user artur 47.243.122.248 port 44122 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.210.103.161
country_id: 1819730
description:
Dec  9 01:02:27 host2 sshd[45205]: Disconnected from invalid user student2 8.210.103.161 port 49356 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-12-09 01:01:45 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:50674: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec  9 01:03:34 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<1DzZ3nVFloqPbvgo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.162.24
country_id: 1880251
description:
Dec  9 01:02:48 host2 sshd[45379]: Disconnected from invalid user test1 101.47.162.24 port 58070 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.102.234.58
country_id: 1269750
description:
Dec  9 01:02:56 host2 sshd[45467]: Disconnected from invalid user hz 103.102.234.58 port 33728 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.235.21.125
country_id: 390903
description:
Dec  9 01:03:26 host2 sshd[46477]: Disconnected from invalid user web 83.235.21.125 port 44794 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.66.1.180
country_id: 953987
description:
Dec  9 01:03:33 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@v-deploy.com>, method=PLAIN, rip=102.66.1.180, lip=66.85.158.91, TLS, session=<+6+q3XVFe4lmQgG0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.243.122.248
country_id: 1819730
description:
Dec  9 01:03:39 host2 sshd[46612]: Disconnected from invalid user httpd 47.243.122.248 port 33292 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 01:03:46 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<HymN33VFjraKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.205.247
country_id: 3469034
description:
Dec  9 01:03:54 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=179.189.205.247, lip=66.85.158.91, TLS, session=<UGsH33VFTYKzvc33>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.165
country_id: 6252001
description:
Dec  9 01:04:12 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.165, lip=66.85.158.91, TLS handshaking: Connection closed, session=<vPw/4XVFz5NBMQGl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  9 01:04:12 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<0Wod4XVF3p+8putr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.162
country_id: 6252001
description:
Dec  9 01:04:30 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.162, lip=66.85.158.91, TLS handshaking: Connection closed, session=<sb1P4nVFgmtBMQGi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.235.21.125
country_id: 390903
description:
Dec  9 01:04:37 host2 sshd[47296]: Disconnected from invalid user asd 83.235.21.125 port 53854 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.162
country_id: 6252001
description:
Dec  9 01:04:40 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=65.49.1.162, lip=66.85.158.91, TLS: Connection closed, session=<S0vf4nVF4LlBMQGi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 01:06:33 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@rehanseo.online>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<qx6B6XVF1K+KxX03>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.84.36.99
country_id: 1880251
description:
Dec  9 01:05:44 host2 sshd[48484]: Disconnected from invalid user user2 47.84.36.99 port 39718 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 83.235.21.125
country_id: 390903
description:
Dec  9 01:05:44 host2 sshd[48491]: Disconnected from invalid user pzuser 83.235.21.125 port 56748 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.243.189.141
country_id: 1819730
description:
Dec  9 01:06:27 host2 sshd[49113]: Disconnected from invalid user user2 47.243.189.141 port 52010 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.215.45.49
country_id: 3469034
description:
Dec  9 01:06:38 host2 sshd[49244]: Disconnected from invalid user shopify 181.215.45.49 port 39850 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.239.218.173
country_id: 1819730
description:
Dec  9 01:05:49 host2 sshd[48576]: Disconnected from invalid user ubuntu 47.239.218.173 port 47570 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.249.87.201
country_id: 3625428
description:
Dec  9 01:07:09 host2 sshd[49640]: Disconnected from invalid user aaa 201.249.87.201 port 54336 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.235.21.125
country_id: 390903
description:
Dec  9 01:06:51 host2 sshd[49450]: Disconnected from invalid user dns 83.235.21.125 port 57866 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.235.21.125
country_id: 390903
description:
Dec  9 01:07:53 host2 sshd[50078]: Disconnected from invalid user httpd 83.235.21.125 port 46282 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.29.61
country_id: 6251999
description:
Dec  9 01:08:21 host2 sshd[50397]: Disconnected from invalid user hz 51.222.29.61 port 36154 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.230.228.16
country_id: 6252001
description:
2025-12-09 01:08:43 dovecot_plain authenticator failed for c-71-230-228-16.hsd1.de.comcast.net (rechitic) [71.230.228.16]:51486: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.243.122.248
country_id: 1819730
description:
Dec  9 01:09:05 host2 sshd[50879]: Disconnected from invalid user olivier 47.243.122.248 port 36768 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.46.131.55
country_id: 3865483
description:
Dec  9 01:10:26 host2 sshd[52206]: Disconnected from invalid user olivier 181.46.131.55 port 58154 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 47.243.122.248
country_id: 1819730
description:
Dec  9 01:10:27 host2 sshd[52216]: Disconnected from invalid user guest 47.243.122.248 port 47844 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.243.189.141
country_id: 1819730
description:
Dec  9 01:09:44 host2 sshd[51319]: Disconnected from invalid user vikas 47.243.189.141 port 37484 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-12-09 01:11:30 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:34282: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-12-09 01:11:37 dovecot_login authenticator failed for ([102.53.15.18]) [102.53.15.18]:32975: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.249.87.201
country_id: 3625428
description:
Dec  9 01:10:41 host2 sshd[52363]: Disconnected from invalid user tang 201.249.87.201 port 50224 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.198
country_id: 6252001
description:
Dec  9 01:10:45 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.198, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Dwem+HVFKNnG6xjG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.66
country_id: 6252001
description:
Dec  9 01:12:01 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=147.185.132.66, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<wMI2/XVFb8OTuYRC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.249.87.201
country_id: 3625428
description:
Dec  9 01:12:19 host2 sshd[53641]: Disconnected from invalid user httpd 201.249.87.201 port 48166 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  9 01:17:03 host2 sshd[57474]: Disconnected from invalid user user 2.57.121.25 port 35166 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.239.218.173
country_id: 1819730
description:
Dec  9 01:17:15 host2 sshd[57621]: Disconnected from invalid user testa 47.239.218.173 port 37056 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 01:17:34 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<djzvEHZFSOmqQMFo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.83.18.158
country_id: 1819730
description:
Dec  9 01:17:40 host2 sshd[57890]: Disconnected from invalid user admin 47.83.18.158 port 49742 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec  9 01:18:29 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<jbEsFHZF6sl100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.191.195.188
country_id: 3865483
description:
2025-12-09 01:19:07 dovecot_plain authenticator failed for ([89.116.164.85]) [190.191.195.188]:35186: 535 Incorrect authentication data (set_id=info@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.208.222.245
country_id: 3469034
description:
2025-12-09 01:19:20 dovecot_plain authenticator failed for 245.222.208.186.yukanet.com.br ([89.116.164.85]) [186.208.222.245]:59369: 535 Incorrect authentication data (set_id=info@host2.phenomhost.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.56.197
country_id: 6252001
description:
Dec  9 01:18:35 host2 sshd[58450]: Disconnected from invalid user gmodserver 167.99.56.197 port 43356 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.207.28.62
country_id: 3469034
description:
2025-12-09 01:18:53 dovecot_plain authenticator failed for ([89.116.164.85]) [186.207.28.62]:52288: 535 Incorrect authentication data (set_id=info@host2.phenomhost.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.144
country_id: 6252001
description:
Dec  9 01:20:07 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=195.184.76.144, lip=66.85.158.92, TLS handshaking: Connection closed, session=<TOQnGnZFf4DDuEyQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.83
country_id: 6252001
description:
Dec  9 01:20:18 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=195.184.76.83, lip=66.85.158.92, TLS: Connection closed, session=<FczUGnZFZZjDuExT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.239.218.173
country_id: 1819730
description:
Dec  9 01:21:02 host2 sshd[59925]: Disconnected from invalid user aa 47.239.218.173 port 50152 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.83.18.158
country_id: 1819730
description:
Dec  9 01:21:31 host2 sshd[60275]: Disconnected from invalid user kevin 47.83.18.158 port 57214 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.146
country_id: 6252001
description:
Dec  9 01:20:32 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=195.184.76.146, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<KJ6iG3ZF56nDuEyS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.86
country_id: 6252001
description:
Dec  9 01:20:35 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.86, lip=66.85.158.92, TLS: Connection closed, session=<BH3RG3ZF177DuExW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 47.83.18.158
country_id: 1819730
description:
Dec  9 01:22:45 host2 sshd[61457]: Disconnected from invalid user user2 47.83.18.158 port 46184 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.124.114.7
country_id: 3865483
description:
Dec  9 01:23:07 host2 sshd[61836]: Disconnected from invalid user userroot 186.124.114.7 port 35966 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 118.193.39.45
country_id: 1819730
description:
Dec  9 01:23:26 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=118.193.39.45, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<qxgLJnZFHih2wSct>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec  9 01:24:08 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<oSZnKHZFtTh100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Dec  9 01:25:10 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<93oZLHZFosE+PIcp>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 167.99.56.197
country_id: 6252001
description:
Dec  9 01:25:51 host2 sshd[64423]: Disconnected from invalid user admin 167.99.56.197 port 42072 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.40.2.36
country_id: 6252001
description:
2025-12-09 01:26:47 dovecot_plain authenticator failed for ([89.116.164.85]) [64.40.2.36]:46288: 535 Incorrect authentication data (set_id=admin@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.136.227.124
country_id: 3996063
description:
2025-12-09 01:27:00 dovecot_plain authenticator failed for ([89.116.164.85]) [187.136.227.124]:24262: 535 Incorrect authentication data (set_id=admin@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.49.208.130
country_id: 3469034
description:
2025-12-09 01:26:35 dovecot_plain authenticator failed for ([89.116.164.85]) [187.49.208.130]:53600: 535 Incorrect authentication data (set_id=admin@host2.phenomhost.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  9 01:27:53 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@lankaherbalsolutions.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<MIzQNXZFCL6PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec  9 01:28:13 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<WWb7NnZFwJg+PIdc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec  9 01:28:49 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<ZfEeOXZFtto+PIcl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.161
country_id: 2993457
description:
Dec  9 01:29:01 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.161, lip=66.85.158.91, session=<PSz9OXZFAf/CpRCh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec  9 01:29:47 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<U+qbPHZFDqw+PIcd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.124.114.7
country_id: 3865483
description:
Dec  9 01:30:34 host2 sshd[68603]: Disconnected from invalid user nishant 186.124.114.7 port 41208 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 01:30:48 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@sobaherbal.com>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<7elAQHZF9LGqQMFo>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 170.64.193.104
country_id: 2077456
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[170.64.193.104] [Remote Port]=[45556] [Authentication Database]=[mail] [Username]=[notify@sobaherbal.com] (10/10 failures) (blocked until [Tue Dec  9 20:00:46 2025 UTC/Wed Dec 10 01:30:46 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.212.19.14
country_id: 2510769
description:
Dec  9 01:31:23 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=188.212.19.14, lip=66.85.158.91, TLS, session=<MO1lQXZFsZ+81BMO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.68
country_id: 6252001
description:
Dec  9 01:31:42 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.68, lip=66.85.158.91, TLS, session=<ajWWQ3ZFTu3N0h9E>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 154.13.86.215
country_id: 3996063
description:
Dec  9 01:31:41 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<designdpt>, method=PLAIN, rip=154.13.86.215, lip=66.85.158.91, TLS, session=<+HKFQnZFVNGaDVbX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec  9 01:32:25 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@dataesite.lk>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<dyoKRnZFkONnJFMP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-09 01:34:24 dovecot_plain authenticator failed for (marity) [154.144.243.93]:51904: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  9 01:34:25 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@venee.lk>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<fwIvTXZFQo8+PIds>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.137.154.160
country_id: 3469034
description:
2025-12-09 01:34:10 dovecot_plain authenticator failed for ([89.116.164.85]) [143.137.154.160]:37538: 535 Incorrect authentication data (set_id=support@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.199.177.253
country_id: 3469034
description:
2025-12-09 01:34:22 dovecot_plain authenticator failed for 179-199-177-253.user3p.vtal.net.br ([89.116.164.85]) [179.199.177.253]:27442: 535 Incorrect authentication data (set_id=support@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.156.212.11
country_id: 2542007
description:
2025-12-09 01:34:35 dovecot_plain authenticator failed for ([89.116.164.85]) [105.156.212.11]:42366: 535 Incorrect authentication data (set_id=support@host2.phenomhost.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  9 01:36:18 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@seyawin.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<+tLhU3ZF8JqPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.251.55
country_id: 3469034
description:
Dec  9 01:38:28 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=186.209.251.55, lip=66.85.158.91, TLS, session=<csW9WnZFhcG60fs3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec  9 01:37:38 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<AsmlWHZFaLA+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.47.158.7
country_id: 2510769
description:
Dec  9 01:38:45 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=139.47.158.7, lip=66.85.158.91, TLS, session=<EDvWW3ZF9LCLL54H>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.162.24
country_id: 1880251
description:
Dec  9 01:40:27 host2 sshd[76376]: Disconnected from invalid user web 101.47.162.24 port 37906 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.75
country_id: 6252001
description:
Dec  9 01:41:12 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.75, lip=66.85.158.92, TLS, session=<FAmQZXZFsPjN0h9L>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.51.166
country_id: 1269750
description:
2025-12-09 01:41:54 dovecot_login authenticator failed for ([125.23.112.209]) [182.95.51.166]:33288: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.222.111.92
country_id: 3625428
description:
2025-12-09 01:41:59 dovecot_plain authenticator failed for ([89.116.164.85]) [38.222.111.92]:43296: 535 Incorrect authentication data (set_id=sales@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.116.165
country_id: 3144096
description:
2025-12-09 01:41:43 dovecot_login authenticator failed for (cm-178.232.116.165.get.no) [178.232.116.165]:48793: 535 Incorrect authentication data (set_id=support@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.36.239.240
country_id: 6252001
description:
2025-12-09 01:41:47 dovecot_plain authenticator failed for c-73-36-239-240.hsd1.il.comcast.net ([89.116.164.85]) [73.36.239.240]:35560: 535 Incorrect authentication data (set_id=sales@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.6
country_id: 1269750
description:
2025-12-09 01:44:45 dovecot_login authenticator failed for ([182.95.181.6]) [182.95.181.6]:35058: 535 Incorrect authentication data (set_id=postmaster@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  9 01:44:46 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@nsteeleng.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<QEM1cnZFTqI+PIdr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.105.141.172
country_id: 3923057
description:
2025-12-09 01:44:59 dovecot_login authenticator failed for static-200-105-141-172.acelerate.net (static-200-105-141-161.acelerate.net) [200.105.141.172]:36212: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.119
country_id: 3175395
description:
Dec  9 01:46:06 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.15.171.119, lip=66.85.158.91, TLS, session=<fS4ZdnZFzNq5D6t3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.186.197.104
country_id: 3469034
description:
Dec  9 01:45:48 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@v-deploy.com>, method=PLAIN, rip=138.186.197.104, lip=66.85.158.91, TLS, session=<KSXUdHZF/JKKusVo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  9 01:46:38 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<3sfZeHZFeo8v/lVz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.185.227
country_id: 6252001
description:
Dec  9 01:46:55 host2 dovecot[2208013]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=44.220.185.227, lip=66.85.158.92, session=<OaMEenZF6N8s3Lnj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Dec  9 01:48:56 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@essenceceylontea.com>, method=PLAIN, rip=167.71.230.230, lip=66.85.158.91, session=<h9gRgXZFyL+nR+bm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.35.168.17
country_id: 935317
description:
2025-12-09 01:49:32 dovecot_plain authenticator failed for ([89.116.164.85]) [102.35.168.17]:53576: 535 Incorrect authentication data (set_id=marketing@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.49
country_id: 6252001
description:
2025-12-09 01:50:29 dovecot_login authenticator failed for ([98.181.46.49]) [98.181.46.49]:35197: 535 Incorrect authentication data (set_id=sales@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.35.168.17
country_id: 935317
description:
2025-12-09 01:49:39 dovecot_login authenticator failed for ([89.116.164.85]) [102.35.168.17]:53576: 535 Incorrect authentication data (set_id=marketing@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.213.132.10
country_id: 953987
description:
2025-12-09 01:49:47 dovecot_plain authenticator failed for ([89.116.164.85]) [102.213.132.10]:18815: 535 Incorrect authentication data (set_id=marketing@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.125.130.153
country_id: 3469034
description:
2025-12-09 01:50:03 dovecot_plain authenticator failed for ([89.116.164.85]) [177.125.130.153]:1304: 535 Incorrect authentication data (set_id=marketing@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.223.46
country_id: 1269750
description:
2025-12-09 01:50:45 dovecot_login authenticator failed for ([182.95.223.46]) [182.95.223.46]:60550: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2025-12-09 01:51:34 dovecot_plain authenticator failed for c-24-127-53-61.hsd1.mi.comcast.net (bodurses) [24.127.53.61]:46138: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.242.19.149
country_id: 1819730
description:
Dec  9 01:51:57 host2 sshd[85623]: Disconnected from invalid user admin 47.242.19.149 port 49694 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2025-12-09 01:55:23 dovecot_plain authenticator failed for (weatophted) [91.73.188.251]:33572: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 01:57:07 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@melanifinefood.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<IudfnnZFCqaKxX03>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 138.197.125.55
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[138.197.125.55] [Remote Port]=[42506] [Authentication Database]=[mail] [Username]=[notify@melanifinefood.com] (10/10 failures) (blocked until [Tue Dec  9 20:27:05 2025 UTC/Wed Dec 10 01:57:05 2025 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.241.28.207
country_id: 6252001
description:
2025-12-09 01:57:24 dovecot_plain authenticator failed for ([89.116.164.85]) [67.241.28.207]:58646: 535 Incorrect authentication data (set_id=contact@host2.phenomhost.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec  9 01:56:56 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<zButnXZF1tmPbvgo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.158.252.145
country_id: 3865483
description:
2025-12-09 01:57:07 dovecot_plain authenticator failed for ([89.116.164.85]) [186.158.252.145]:11153: 535 Incorrect authentication data (set_id=contact@host2.phenomhost.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  9 01:57:35 host2 sshd[89885]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.76.119.222
country_id: 1819730
description:
Dec  9 01:58:06 host2 sshd[90256]: Disconnected from invalid user wangziyun 47.76.119.222 port 42312 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.250.78
country_id: 290557
description:
2025-12-09 01:58:16 dovecot_login authenticator failed for ([94.205.250.78]) [94.205.250.78]:63316: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  9 01:58:30 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@kiriaswanu.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<a3VQo3ZFDu68putr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.242.19.149
country_id: 1819730
description:
Dec  9 01:57:33 host2 sshd[89891]: Disconnected from invalid user yuan 47.242.19.149 port 38696 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.181.133.153
country_id: 3469034
description:
2025-12-09 01:58:00 dovecot_login authenticator failed for ([179.181.135.1]) [179.181.133.153]:34465: 535 Incorrect authentication data (set_id=contacto@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-12-09 01:59:17 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:54008: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.55.164.246
country_id: 3469034
description:
2025-12-09 01:58:37 dovecot_login authenticator failed for ([177.55.164.246]) [177.55.164.246]:55428: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  9 01:58:46 host2 sshd[90727]: Disconnected from invalid user admin 2.57.121.112 port 50015 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 02:00:00 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@rehanseo.online>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<VzCvqHZFNqWKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec  9 02:00:05 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<A5j6qHZF9Ms+PIcr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.242.19.149
country_id: 1819730
description:
Dec  9 02:00:23 host2 sshd[92079]: Disconnected from invalid user sean 47.242.19.149 port 37308 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.62.239.4
country_id: 732800
description:
2025-12-09 02:00:24 dovecot_plain authenticator failed for (uprip) [149.62.239.4]:59404: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.76.119.222
country_id: 1819730
description:
Dec  9 02:00:48 host2 sshd[92453]: Disconnected from invalid user nmrsu 47.76.119.222 port 60158 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 47.76.119.222
country_id: 1819730
description:
Dec  9 02:02:06 host2 sshd[93343]: Disconnected from invalid user nick 47.76.119.222 port 52688 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.127
country_id: 6252001
description:
Dec  9 02:02:27 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.127, lip=66.85.158.91, TLS: Connection closed, session=<AMeJsXZF+HZChJl/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.127
country_id: 6252001
description:
Dec  9 02:02:33 host2 dovecot[2208013]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 1 secs): user=<>, rip=66.132.153.127, lip=66.85.158.91, session=<uujhsXZFwJ5ChJl/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.217.102.175
country_id: 3469034
description:
2025-12-09 02:04:47 dovecot_plain authenticator failed for ([89.116.164.85]) [179.217.102.175]:8649: 535 Incorrect authentication data (set_id=contato@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.129.249.189
country_id: 6252001
description:
2025-12-09 02:04:59 dovecot_plain authenticator failed for ([89.116.164.85]) [24.129.249.189]:36384: 535 Incorrect authentication data (set_id=contato@host2.phenomhost.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec  9 02:05:07 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@dataesite.lk>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<XETyunZFwLhnJFMP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.171.39.124
country_id: 3865483
description:
2025-12-09 02:05:11 dovecot_plain authenticator failed for 124.39-171-45.netlink.com.ar ([89.116.164.85]) [45.171.39.124]:51559: 535 Incorrect authentication data (set_id=contato@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.83.181.181
country_id: 6252001
description:
2025-12-09 02:05:32 dovecot_plain authenticator failed for c-68-83-181-181.hsd1.pa.comcast.net (healy) [68.83.181.181]:56424: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.220.56.98
country_id: 6252001
description:
Dec  9 02:05:36 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@nsteeleng.com>, method=PLAIN, rip=31.220.56.98, lip=66.85.158.91, session=<dmi1vHZFtNsf3Dhi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  9 02:05:54 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<1RXCvXZFuo0XXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  9 02:06:55 host2 sshd[97354]: Disconnected from invalid user admin 2.57.121.112 port 6421 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.76.119.222
country_id: 1819730
description:
Dec  9 02:08:28 host2 sshd[98461]: Disconnected from invalid user shopify 47.76.119.222 port 52108 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec  9 02:08:19 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<S8FhxnZFxKE+PIdq>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 02:08:54 +0530] info [cpaneld] 213.209.143.251 - agro "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agro (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.242.19.149
country_id: 1819730
description:
Dec  9 02:08:41 host2 sshd[98625]: Disconnected from invalid user ubuntu 47.242.19.149 port 49176 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.251.240
country_id: 290557
description:
2025-12-09 02:10:05 dovecot_login authenticator failed for ([94.207.251.240]) [94.207.251.240]:55436: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.250
country_id: 1036973
description:
2025-12-09 02:09:45 dovecot_login authenticator failed for ([197.219.228.250]) [197.219.228.250]:45700: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec  9 02:12:25 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@bostonlanka.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<8J8S1XZFbc9100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.46.119.210
country_id: 3895114
description:
2025-12-09 02:12:28 dovecot_plain authenticator failed for pc-210-119-46-190.cm.vtr.net ([89.116.164.85]) [190.46.119.210]:38254: 535 Incorrect authentication data (set_id=contacto@host2.phenomhost.com)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 117.211.64.219
country_id: 1269750
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[117.211.64.219] [Remote Port]=[53101] [Authentication Database]=[mail] [Username]=[admin@bostonlanka.com] (10/10 failures) (blocked until [Tue Dec  9 20:42:23 2025 UTC/Wed Dec 10 02:12:23 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec  9 02:11:47 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<UMDP0nZF3K4+PIdp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.46.119.210
country_id: 3895114
description:
2025-12-09 02:12:35 dovecot_login authenticator failed for pc-210-119-46-190.cm.vtr.net ([89.116.164.85]) [190.46.119.210]:38254: 535 Incorrect authentication data (set_id=contacto@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.150.103.132
country_id: 6252001
description:
2025-12-09 02:12:40 dovecot_plain authenticator failed for ([89.116.164.85]) [35.150.103.132]:26792: 535 Incorrect authentication data (set_id=contacto@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.56.156.224
country_id: 953987
description:
2025-12-09 02:12:55 dovecot_plain authenticator failed for ([89.116.164.85]) [41.56.156.224]:3968: 535 Incorrect authentication data (set_id=contacto@host2.phenomhost.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  9 02:12:58 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<2ZoK13ZF6uQv/lVz>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 02:13:08 +0530] info [cpaneld] 213.209.143.251 - ajss "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajss (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 02:14:02 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@anandaobauae.org>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<xIjf2nZFjImqQMFo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2025-12-09 02:18:06 dovecot_plain authenticator failed for c-24-1-200-187.hsd1.il.comcast.net (kindy) [24.1.200.187]:37126: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec  9 02:18:06 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<oBdk6XZFpTl100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  9 02:19:03 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@lankaherbalsolutions.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<CnTL7HZFqpGPbtX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.190.87.241
country_id: 1269750
description:
2025-12-09 02:20:16 dovecot_plain authenticator failed for ([89.116.164.85]) [223.190.87.241]:14365: 535 Incorrect authentication data (set_id=financeiro@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.161.230.60
country_id: 3996063
description:
2025-12-09 02:20:33 dovecot_plain authenticator failed for ([89.116.164.85]) [189.161.230.60]:39112: 535 Incorrect authentication data (set_id=financeiro@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2025-12-09 02:21:58 dovecot_plain authenticator failed for c-73-197-194-98.hsd1.nj.comcast.net (calie) [73.197.194.98]:43314: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.234.217.192
country_id: 6252001
description:
Dec  9 02:22:21 host2 dovecot[2208013]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=172.234.217.192, lip=66.85.158.92, session=<p26++HZF9N+s6tnA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.161.230.60
country_id: 3996063
description:
2025-12-09 02:23:22 dovecot_login authenticator failed for ([89.116.164.85]) [189.161.230.60]:39112: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-12-09 02:25:10 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (dishia) [81.225.30.107]:51300: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2025-12-09 02:25:35 dovecot_plain authenticator failed for c-24-1-200-187.hsd1.il.comcast.net (syncer) [24.1.200.187]:43810: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.38
country_id: 6252001
description:
Dec  9 02:25:47 host2 dovecot[2208013]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.38, lip=66.85.158.92, session=<wGP9BHdFPDms7OQm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 02:27:21 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@sobaherbal.com>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<JxR+CndFapSqQMFo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  9 02:27:24 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<uYWmCndFdtKPbtX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.7.107.13
country_id: 2963597
description:
2025-12-09 02:28:06 dovecot_plain authenticator failed for ([89.116.164.85]) [46.7.107.13]:53228: 535 Incorrect authentication data (set_id=comercial@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.109.156.251
country_id: 102358
description:
2025-12-09 02:28:19 dovecot_plain authenticator failed for ([89.116.164.85]) [149.109.156.251]:44964: 535 Incorrect authentication data (set_id=comercial@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.114.21.51
country_id: 2328926
description:
2025-12-09 02:27:39 dovecot_plain authenticator failed for (delete) [105.114.21.51]:41615: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.117.105.8
country_id: 6252001
description:
2025-12-09 02:27:53 dovecot_plain authenticator failed for ([89.116.164.85]) [152.117.105.8]:9142: 535 Incorrect authentication data (set_id=comercial@host2.phenomhost.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  9 02:29:48 host2 sshd[115332]: Disconnected from invalid user user 2.57.121.25 port 43932 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.69
country_id: 6252001
description:
Dec  9 02:30:12 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=205.210.31.69, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=</P/MFHdFTdrN0h9F>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  9 02:30:42 host2 sshd[116203]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2025-12-09 02:34:01 dovecot_plain authenticator failed for (bortria) [23.30.11.253]:47088: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.119
country_id: 6252001
description:
Dec  9 02:35:02 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.119, lip=66.85.158.91, TLS handshaking: Connection closed, session=<FNoWJndFMMNChJl3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.54
country_id: 6252001
description:
2025-12-09 02:35:51 dovecot_login authenticator failed for ([98.185.120.54]) [98.185.120.54]:54584: 535 Incorrect authentication data (set_id=contacto@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.90.94
country_id: 1269750
description:
2025-12-09 02:36:18 dovecot_login authenticator failed for ([125.20.183.201]) [27.123.90.94]:55890: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Dec  9 02:36:40 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<5PfMK3dFLI0+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec  9 02:37:47 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<qDnOL3dF8sxnJFMP>


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 103.36.83.15
country_id: 1269750
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[103.36.83.15] [Remote Port]=[52466] [Authentication Database]=[mail] [Username]=[contact@dataesite.lk] (10/10 failures) (blocked until [Tue Dec  9 21:07:45 2025 UTC/Wed Dec 10 02:37:45 2025 LOCAL])


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  9 02:38:06 host2 sshd[121693]: Disconnected from invalid user user 2.57.121.25 port 14230 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec  9 02:40:15 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=</veeOHdFQNU+PIdc>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  9 02:42:13 host2 sshd[124809]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec  9 02:41:42 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<oDrDPXdFQJA+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  9 02:41:55 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<qvWOPndF0IMv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec  9 02:42:24 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<F5JQQHdFjog+PIcd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.176.157.57
country_id: 6252001
description:
2025-12-09 02:47:11 dovecot_plain authenticator failed for c-73-176-157-57.hsd1.il.comcast.net (friant) [73.176.157.57]:42582: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  9 02:47:28 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<GqpuUndF/uM+PIds>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 202.155.148.25
country_id: 1643084
description:
Dec  9 02:48:20 host2 dovecot[2208013]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=202.155.148.25, lip=66.85.158.92, session=<ax2iVXdFFrjKm5QZ>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.216.133.14
country_id: 6252001
description:
[2025-12-09 02:48:53 +0530] info [whostmgrd] 47.216.133.14 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec  9 02:50:12 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<otYrXHdFvpY+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 02:50:47 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<hEhPXndF7JuKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec  9 02:50:54 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@kiriaswanu.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<2EmvXndFep+Pbvgo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  9 02:51:44 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<1nuxYXdFaK4XXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  9 02:52:38 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<KO7gZHdFAry8putr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.67
country_id: 3017382
description:
Dec  9 02:53:22 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.196.152.67, lip=66.85.158.92, TLS handshaking: Connection closed, session=<NMupZ3dF3bJbxJhD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  9 02:53:27 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<d/vVZ3dFbJw+PIdr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.67
country_id: 3017382
description:
Dec  9 02:53:37 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 14 secs): user=<>, rip=91.196.152.67, lip=66.85.158.92, TLS: Connection closed, session=<d56BaHdFOc9bxJhD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 02:53:36 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<kapbaHdFipeKxX03>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.45
country_id: 3017382
description:
Dec  9 02:53:47 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.196.152.45, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<RfQhaXdFe5lbxJgt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.44
country_id: 3017382
description:
Dec  9 02:53:50 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.44, lip=66.85.158.92, TLS: Connection closed, session=<c+dRaXdFm+dbxJgs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 202.155.148.25
country_id: 1643084
description:
Dec  9 02:53:59 host2 dovecot[2208013]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=202.155.148.25, lip=66.85.158.92, TLS, session=<AOXWaXdF8KLKm5QZ>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 202.155.148.25
country_id: 1643084
description:
Dec  9 02:54:58 host2 pure-ftpd[133751]: (?@202.155.148.25) [INFO] New connection from 202.155.148.25


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.255.189.21
country_id: 298795
description:
2025-12-09 02:55:36 dovecot_login authenticator failed for (88.255.189.21.static.ttnet.com.tr) [88.255.189.21]:59600: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.75
country_id: 3017382
description:
Dec  9 02:55:45 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=91.196.152.75, lip=66.85.158.92, TLS handshaking: Connection closed, session=<4cowcHdFra5bxJhL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.52
country_id: 3017382
description:
Dec  9 02:56:04 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 18 secs): user=<>, rip=91.196.152.52, lip=66.85.158.92, TLS: Connection closed, session=<1iRTcXdFz8tbxJg0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.183.221.168
country_id: 6252001
description:
2025-12-09 02:56:11 dovecot_login authenticator failed for wsip-70-183-221-168.br.br.cox.net [70.183.221.168]:62923: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.74
country_id: 3017382
description:
Dec  9 02:56:20 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.196.152.74, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<xKpFcndF3bNbxJhK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.72
country_id: 3017382
description:
Dec  9 02:56:24 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=91.196.152.72, lip=66.85.158.92, TLS: Connection closed, session=<YzV2cndF0ahbxJhI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.204.160.202
country_id: 6252001
description:
2025-12-09 02:58:24 dovecot_login authenticator failed for ([68.204.160.202]) [68.204.160.202]:43358: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.80
country_id: 1733045
description:
2025-12-09 02:59:11 dovecot_login authenticator failed for ([49.125.201.80]) [49.125.201.80]:36134: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2025-12-09 03:00:20 dovecot_login authenticator failed for ([103.168.241.32]) [103.168.241.32]:56578: 535 Incorrect authentication data (set_id=test@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.109.136
country_id: 660013
description:
2025-12-09 03:00:35 dovecot_login authenticator failed for ([45.82.109.136]) [45.82.109.136]:51800: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.0.192.28
country_id: 3865483
description:
Dec  9 03:04:08 host2 sshd[141277]: Disconnected from invalid user giulia 181.0.192.28 port 1220 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-12-09 03:05:44 dovecot_plain authenticator failed for (bletism) [102.53.15.17]:47526: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.22
country_id: 1269750
description:
2025-12-09 03:07:10 dovecot_login authenticator failed for ([182.95.20.31]) [182.95.228.22]:41340: 535 Incorrect authentication data (set_id=sales@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec  9 03:07:24 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<nqq1mXdFYdx100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.146.144
country_id: 1819730
description:
2025-12-09 03:07:36 dovecot_login authenticator failed for (m121-202-146-144.smartone.com) [121.202.146.144]:47639: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.165.182.203
country_id: 6252001
description:
2025-12-09 03:07:57 dovecot_plain authenticator failed for (trass) [173.165.182.203]:59940: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.140.219
country_id: 298795
description:
2025-12-09 03:08:51 dovecot_plain authenticator failed for (obarynci) [5.11.140.219]:59762: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec  9 03:10:27 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<cjKipHdF2qFnJFMP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2025-12-09 03:09:38 dovecot_plain authenticator failed for (brica) [65.20.129.28]:35753: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.73.18.40
country_id: 3895114
description:
[2025-12-09 03:09:53 +0530] info [webmaild] 200.73.18.40 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  9 03:09:59 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@lankaherbalsolutions.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<q+HsondFnsyPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 03:10:31 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@anandaobauae.org>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<7Z3XpHdFyOWqQMFo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.56.223
country_id: 3996063
description:
2025-12-09 03:11:16 dovecot_login authenticator failed for (201.173.56.223-clientes-izzi.mx) [201.173.56.223]:50432: 535 Incorrect authentication data (set_id=contacto@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.0.192.28
country_id: 3865483
description:
Dec  9 03:11:36 host2 sshd[147330]: Disconnected from invalid user build 181.0.192.28 port 1168 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.247.248.154
country_id: 3469034
description:
2025-12-09 03:11:38 dovecot_login authenticator failed for ([170.247.248.154]) [170.247.248.154]:56776: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  9 03:18:22 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@seyawin.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<lGjmwHdFLKCPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec  9 03:20:54 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@ceylondigest.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<7Lf+yXdF1M0+PIdq>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 03:21:03 +0530] info [cpaneld] 213.209.143.251 - 2stravel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.68.115.51
country_id: 2635167
description:
[2025-12-09 03:21:16 +0530] info [webmaild] 77.68.115.51 - senthil@yashiholdings.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.194.94
country_id: 1733045
description:
2025-12-09 03:22:47 dovecot_login authenticator failed for ([51.162.194.94]) [51.162.194.94]:34151: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.172
country_id: 3144096
description:
2025-12-09 03:23:13 dovecot_login authenticator failed for (172-161-97-62.cust.smartcall.no) [62.97.161.172]:45155: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 03:23:55 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<fcnA1HdFOLuqQMFo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.106.163.189
country_id: 6252001
description:
2025-12-09 03:24:15 dovecot_plain authenticator failed for c-76-106-163-189.hsd1.fl.comcast.net (hally) [76.106.163.189]:49742: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.0.192.28
country_id: 3865483
description:
Dec  9 03:27:46 host2 sshd[162553]: Disconnected from invalid user httpd 181.0.192.28 port 1226 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.248.112.37
country_id: 2635167
description:
[2025-12-09 03:30:10 +0530] info [webmaild] 213.248.112.37 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.164.76
country_id: 2661886
description:
2025-12-09 03:30:54 dovecot_login authenticator failed for ip076.net-81-16-164.koping.net [81.16.164.76]:55128: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2025-12-09 03:31:03 dovecot_plain authenticator failed for (tarie) [80.227.102.242]:52725: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.171.241.234
country_id: 6252001
description:
2025-12-09 03:31:26 dovecot_login authenticator failed for (c-50-171-64-170.unallocated.comcastbusiness.net) [50.171.241.234]:36958: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.102.30.18
country_id: 6252001
description:
[2025-12-09 03:34:16 +0530] info [webmaild] 82.102.30.18 - env_eng@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.209.110
country_id: 1269750
description:
2025-12-09 03:35:12 dovecot_login authenticator failed for ([182.95.12.209]) [152.52.209.110]:49424: 535 Incorrect authentication data (set_id=test@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.0.192.28
country_id: 3865483
description:
Dec  9 03:37:19 host2 sshd[170479]: Disconnected from invalid user postgres 181.0.192.28 port 16721 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.0.88
country_id: 3144096
description:
2025-12-09 03:39:12 dovecot_login authenticator failed for ([78.156.0.88]) [78.156.0.88]:55057: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.163.122.133
country_id: 1210997
description:
2025-12-09 03:39:13 dovecot_login authenticator failed for (IP-122-133.bol-online.com) [182.163.122.133]:57579: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.235.30
country_id: 6252001
description:
2025-12-09 03:39:19 dovecot_plain authenticator failed for c-73-0-235-30.hsd1.fl.comcast.net (yemism) [73.0.235.30]:42392: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.153
country_id: 6252001
description:
2025-12-09 03:39:24 dovecot_login authenticator failed for ([98.185.120.153]) [98.185.120.153]:58719: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.175.201.167
country_id: 3469034
description:
2025-12-09 03:39:32 dovecot_login authenticator failed for 200.175.201.167.dynamic.dialup.gvt.net.br (corporate.static.gvt.net.br) [200.175.201.167]:59380: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-12-09 03:39:34 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:46570: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.124.111.122
country_id: 2077456
description:
2025-12-09 03:39:33 dovecot_login authenticator failed for 27-124-111-122.static.as58511.net [27.124.111.122]:38152: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.167.210
country_id: 3144096
description:
2025-12-09 03:39:18 dovecot_login authenticator failed for (210-167-97-62.cust.smartcall.no) [62.97.167.210]:36090: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-12-09 03:39:25 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:59138: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  9 03:40:23 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<ZDCxD3hFNrIv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Dec  9 03:40:28 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@essenceceylontea.com>, method=PLAIN, rip=167.71.230.230, lip=66.85.158.91, session=<CSDzD3hFEN+nR+bm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.105.194
country_id: 6252001
description:
Dec  9 03:42:23 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.64.105.194, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<8V7rFnhFgOIUQGnC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.90.165.198
country_id: 2921044
description:
Dec  9 03:43:00 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=164.90.165.198, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<tsodGXhF94ikWqXG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 03:43:45 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<UFu0G3hF4uWKxX03>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.90.165.198
country_id: 2921044
description:
Dec  9 03:43:12 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=164.90.165.198, lip=66.85.158.91, TLS handshaking: Connection closed, session=<sDPhGXhFDR+kWqXG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 209.38.201.147
country_id: 2921044
description:
Dec  9 03:43:36 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=209.38.201.147, lip=66.85.158.91, TLS handshaking: Connection closed, session=<FlNEG3hFdjfRJsmT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec  9 03:45:18 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@dataesite.lk>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<NFA8IXhFOLdnJFMP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec  9 03:45:23 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<wAiHIXhFcKKPbvgo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 03:46:38 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@rehanseo.online>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<gbkDJnhFWuWKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  9 03:47:24 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<1sq7KHhFIKu8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.26.3
country_id: 3996063
description:
2025-12-09 03:47:13 dovecot_login authenticator failed for (201.172.26.3-clientes-izzi.mx) [201.172.26.3]:59587: 535 Incorrect authentication data (set_id=support@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.222.54
country_id: 1269750
description:
2025-12-09 03:47:22 dovecot_login authenticator failed for ([122.185.152.72]) [122.187.222.54]:41738: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Dec  9 03:48:47 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<LWWuLXhFSpA+PIcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  9 03:49:26 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<HmwHMHhF8LQXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  9 03:50:32 host2 sshd[184133]: Disconnected from invalid user user 2.57.121.25 port 15774 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 03:50:58 +0530] info [cpaneld] 213.209.143.251 - agronatu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronatu (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.202.230.214
country_id: 798544
description:
2025-12-09 03:52:43 dovecot_plain authenticator failed for host-91-202-230-214.static.oc3.zagan.visnet.pl (paphally) [91.202.230.214]:34464: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.230.65.90
country_id: 6252001
description:
2025-12-09 03:53:33 dovecot_plain authenticator failed for static-96-230-65-90.bstnma.fios.verizon.net (thesled) [96.230.65.90]:35298: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.182.125.210
country_id: 6252001
description:
2025-12-09 03:53:37 dovecot_plain authenticator failed for (calltabal) [12.182.125.210]:45918: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec  9 03:53:47 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<JfCXP3hFrOg+PIdc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.220.56.98
country_id: 6252001
description:
Dec  9 03:53:50 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@nsteeleng.com>, method=PLAIN, rip=31.220.56.98, lip=66.85.158.91, session=<dVzFP3hF4q0f3Dhi>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 157.230.30.171
country_id: 2921044
description:
Dec  9 03:54:54 host2 pure-ftpd[188111]: (?@157.230.30.171) [INFO] New connection from 157.230.30.171


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec  9 03:54:26 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@melanifinefood.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<TUvrQXhF2rY+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec  9 03:55:33 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<9LbgRXhF8JQ+PIcd>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 03:55:56 +0530] info [cpaneld] 213.209.143.251 - ajsstarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstarl (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.14.169.244
country_id: 3017382
description:
2025-12-09 03:56:36 dovecot_plain authenticator failed for lstlambert-656-1-118-244.w80-14.abo.wanadoo.fr (culing) [80.14.169.244]:34778: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.253.238.39
country_id: 6252001
description:
Dec  9 03:57:23 host2 sshd[190312]: Disconnected from invalid user hong 47.253.238.39 port 43518 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.253.238.39
country_id: 6252001
description:
Dec  9 03:59:08 host2 sshd[192075]: Disconnected from invalid user elemental 47.253.238.39 port 42618 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.18.139.237
country_id: 1269750
description:
Dec  9 03:59:37 host2 sshd[192442]: Disconnected from invalid user dev 182.18.139.237 port 34136 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.234.145.12
country_id: 3469034
description:
Dec  9 03:59:46 host2 sshd[192542]: Disconnected from invalid user jack 177.234.145.12 port 49788 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.142.194
country_id: 1269750
description:
2025-12-09 04:00:17 dovecot_login authenticator failed for (abts-north-static-194.142.160.122.airtelbroadband.in) [122.160.142.194]:57898: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  9 04:00:31 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@venee.lk>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<t12oV3hFfuU+PIds>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.78
country_id: 1269750
description:
2025-12-09 04:00:33 dovecot_login authenticator failed for ([152.52.234.170]) [182.95.177.78]:51956: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  9 04:01:04 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@lankaherbalsolutions.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<G12gWXhFjpWPbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec  9 04:01:26 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<yWvxWnhFFVh100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.245.55.32
country_id: 6251999
description:
Dec  9 04:01:53 host2 sshd[194667]: Disconnected from invalid user odoo 198.245.55.32 port 57226 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.82.92.118
country_id: 1643084
description:
Dec  9 04:02:06 host2 sshd[194960]: Disconnected from invalid user centos 103.82.92.118 port 47582 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  9 04:02:21 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<cjoyXnhF8ok+PIdr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 128.127.94.64
country_id: 798544
description:
Dec  9 04:02:28 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=128.127.94.64, lip=66.85.158.91, TLS, session=<0/W1XXhFgLKAf15A>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.101.148
country_id: 3865483
description:
Dec  9 04:02:52 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=190.181.101.148, lip=66.85.158.91, TLS, session=<QPP5XnhFBei+tWWU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.82.92.118
country_id: 1643084
description:
Dec  9 04:03:25 host2 sshd[196516]: Disconnected from invalid user factorio 103.82.92.118 port 39956 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec  9 04:03:28 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<5Sc9YnhFitc+PIcq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.139
country_id: 6252001
description:
Dec  9 04:03:37 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.139, lip=66.85.158.92, TLS handshaking: Connection closed, session=<b37aYnhFwm5ChJmL>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 47.253.238.39
country_id: 6252001
description:
Dec  9 04:03:49 host2 sshd[196907]: Disconnected from invalid user usuario2 47.253.238.39 port 46658 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.18.139.237
country_id: 1269750
description:
Dec  9 04:05:00 host2 sshd[198046]: Disconnected from invalid user hong 182.18.139.237 port 38324 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.18.139.237
country_id: 1269750
description:
Dec  9 04:05:59 host2 sshd[198995]: Disconnected from invalid user support 182.18.139.237 port 33506 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec  9 04:07:10 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<irNyb3hFkVd100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 04:07:10 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<9Olsb3hFwNOqQMFo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.245.55.32
country_id: 6251999
description:
Dec  9 04:06:15 host2 sshd[199351]: Disconnected from invalid user usuario2 198.245.55.32 port 37462 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.59.253.88
country_id: 6252001
description:
2025-12-09 04:06:19 dovecot_plain authenticator failed for c-174-59-253-88.hsd1.pa.comcast.net (scoed) [174.59.253.88]:58602: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.72.128.177
country_id: 3469034
description:
Dec  9 04:06:55 host2 sshd[199775]: Disconnected from invalid user botuser 187.72.128.177 port 60898 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.18.139.237
country_id: 1269750
description:
Dec  9 04:06:59 host2 sshd[199810]: Disconnected from invalid user newuser 182.18.139.237 port 56920 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.60.146
country_id: 1269750
description:
2025-12-09 04:07:28 dovecot_login authenticator failed for ([182.95.25.99]) [182.95.60.146]:43816: 535 Incorrect authentication data (set_id=contact@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.57.123.166
country_id: 2510769
description:
2025-12-09 04:07:36 dovecot_login authenticator failed for 166.red-195-57-123.staticip.rima-tde.net [195.57.123.166]:18531: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.253.238.39
country_id: 6252001
description:
Dec  9 04:07:10 host2 sshd[199988]: Disconnected from invalid user support 47.253.238.39 port 40616 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.46
country_id: 1269750
description:
2025-12-09 04:08:53 dovecot_login authenticator failed for ([182.95.123.46]) [182.95.123.46]:57644: 535 Incorrect authentication data (set_id=contact@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.220.16.51
country_id: 1269750
description:
2025-12-09 04:09:01 dovecot_login authenticator failed for ([103.220.16.51]) [103.220.16.51]:60906: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  9 04:09:10 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<QJugdnhFltMv/lVz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.72.128.177
country_id: 3469034
description:
Dec  9 04:08:18 host2 sshd[201028]: Disconnected from invalid user newuser 187.72.128.177 port 33958 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2025-12-09 04:08:44 dovecot_plain authenticator failed for (ineurete) [65.20.160.107]:37092: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.12
country_id: 3996063
description:
2025-12-09 04:09:26 dovecot_login authenticator failed for ([177.236.146.12]) [177.236.146.12]:36854: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  9 04:09:30 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@seyawin.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<lOHMd3hFkp2PbtX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.16.7.82
country_id: 6252001
description:
2025-12-09 04:09:53 dovecot_plain authenticator failed for c-76-16-7-82.hsd1.il.comcast.net (triostinta) [76.16.7.82]:37481: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-12-09 04:09:56 dovecot_plain authenticator failed for (hally) [24.187.213.29]:34766: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.234.145.12
country_id: 3469034
description:
Dec  9 04:11:27 host2 sshd[204280]: Disconnected from invalid user newuser 177.234.145.12 port 35862 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.82.92.118
country_id: 1643084
description:
Dec  9 04:12:17 host2 sshd[205085]: Disconnected from invalid user httpd 103.82.92.118 port 46366 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.245.55.32
country_id: 6251999
description:
Dec  9 04:12:29 host2 sshd[205262]: Disconnected from invalid user service 198.245.55.32 port 33772 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.10
country_id: 1269750
description:
2025-12-09 04:12:54 dovecot_login authenticator failed for ([182.95.54.10]) [182.95.54.10]:41416: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.92.234
country_id: 3996063
description:
2025-12-09 04:13:03 dovecot_login authenticator failed for (201.173.92.234-clientes-izzi.mx) [201.173.92.234]:51859: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.33.218.186
country_id: 298795
description:
2025-12-09 04:13:08 dovecot_login authenticator failed for (bey-a5-12-asy29.bey-ro-03.superonline.com) [195.33.218.186]:59708: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.89.143.123
country_id: 2635167
description:
2025-12-09 04:13:15 dovecot_login authenticator failed for (77-89-143-123.fluidata.co.uk) [77.89.143.123]:55422: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.245.55.32
country_id: 6251999
description:
Dec  9 04:14:38 host2 sshd[208014]: Disconnected from invalid user fauzi 198.245.55.32 port 48254 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.177.155.63
country_id: 2510769
description:
Dec  9 04:15:30 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=94.177.155.63, lip=66.85.158.91, TLS, session=<g7hcjHhFGsxesZs/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.171
country_id: 3175395
description:
Dec  9 04:15:49 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<designdpt>, method=PLAIN, rip=185.15.171.171, lip=66.85.158.91, TLS, session=<VgV3jXhFhuG5D6ur>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.186.40.250
country_id: 3895114
description:
Dec  9 04:16:34 host2 sshd[210734]: Disconnected from invalid user centos 201.186.40.250 port 44024 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.101.134
country_id: 3865483
description:
Dec  9 04:16:36 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=190.181.101.134, lip=66.85.158.91, TLS, session=<mqoLkHhFqrO+tWWG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.249.136
country_id: 3865483
description:
Dec  9 04:16:57 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<accounts>, method=PLAIN, rip=179.0.249.136, lip=66.85.158.91, TLS, session=<cZtvkXhFotOzAPmI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec  9 04:18:22 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<Z2V9l3hFWKhnJFMP>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  9 04:19:40 host2 sshd[213565]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.192.74.183
country_id: 6252001
description:
2025-12-09 04:19:17 dovecot_plain authenticator failed for c-98-192-74-183.hsd1.ga.comcast.net (feratiess) [98.192.74.183]:44774: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.184.27
country_id: 6252001
description:
Dec  9 04:19:56 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=40.124.184.27, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<Oas4nXhF0K4ofLgb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.82.92.118
country_id: 1643084
description:
Dec  9 04:20:04 host2 sshd[214082]: Disconnected from invalid user ahmed 103.82.92.118 port 49912 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.26
country_id: 99237
description:
2025-12-09 04:20:22 dovecot_login authenticator failed for ([65.20.149.26]) [65.20.149.26]:47555: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.125.13.12
country_id: 6252001
description:
2025-12-09 04:20:44 dovecot_login authenticator failed for (172-125-13-12.lightspeed.rcsntx.sbcglobal.net) [172.125.13.12]:52504: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 04:20:45 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<SxAOoHhFLuCqQMFo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  9 04:21:24 host2 sshd[215561]: Disconnected from invalid user admin 2.57.121.112 port 40854 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.82.92.118
country_id: 1643084
description:
Dec  9 04:23:55 host2 sshd[218174]: Disconnected from invalid user steamcmd 103.82.92.118 port 60670 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec  9 04:25:45 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<3yvdsXhFgMY+PIcr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.187.47
country_id: 99237
description:
2025-12-09 04:27:06 dovecot_login authenticator failed for ([65.20.187.47]) [65.20.187.47]:46366: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.62
country_id: 3996063
description:
2025-12-09 04:26:49 dovecot_login authenticator failed for (201.173.216.62-clientes-izzi.mx) [201.173.216.62]:44221: 535 Incorrect authentication data (set_id=office@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.58
country_id: 1149361
description:
2025-12-09 04:28:23 dovecot_login authenticator failed for ([149.54.62.58]) [149.54.62.58]:43529: 535 Incorrect authentication data (set_id=test@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.46.214.110
country_id: 3703430
description:
2025-12-09 04:28:38 dovecot_login authenticator failed for (104.214.46.200.psinetpa.net) [200.46.214.110]:33248: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.193.149.88
country_id: 6252001
description:
2025-12-09 04:30:07 dovecot_login authenticator failed for ool-44c19558.dyn.optonline.net [68.193.149.88]:39783: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.158.14.232
country_id: 1512440
description:
2025-12-09 04:29:46 dovecot_login authenticator failed for ([195.158.14.232]) [195.158.14.232]:36198: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  9 04:30:54 host2 sshd[228329]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.162.73
country_id: 1880251
description:
Dec  9 04:30:30 host2 sshd[227559]: Disconnected from invalid user ubuntu 101.47.162.73 port 45506 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.114.32.169
country_id: 3895114
description:
2025-12-09 04:31:00 dovecot_plain authenticator failed for ([89.116.164.85]) [190.114.32.169]:6660: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.38.127.198
country_id: 953987
description:
2025-12-09 04:31:15 dovecot_plain authenticator failed for ([89.116.164.85]) [102.38.127.198]:59542: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.29.216.120
country_id: 3439705
description:
2025-12-09 04:31:30 dovecot_plain authenticator failed for r179-29-216-120.dialup.mobile.ancel.net.uy ([89.116.164.85]) [179.29.216.120]:10843: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.175
country_id: 732800
description:
2025-12-09 04:32:12 dovecot_plain authenticator failed for (conia) [92.62.243.175]:42965: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-12-09 04:33:07 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:49044: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.163.44.118
country_id: 1269750
description:
2025-12-09 04:33:29 dovecot_login authenticator failed for ([103.163.44.118]) [103.163.44.118]:48766: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.12.107
country_id: 3144096
description:
2025-12-09 04:33:50 dovecot_login authenticator failed for ([84.211.12.107]) [84.211.12.107]:40242: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec  9 04:34:12 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<Kr8Z0HhFxpo+PIdq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Dec  9 04:35:45 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=167.71.230.230, lip=66.85.158.91, session=<ZeKu1XhF8NinR+bm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-09 04:35:20 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (oprines) [87.103.126.54]:2130: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.200.42.112
country_id: 1880251
description:
2025-12-09 04:36:36 dovecot_login authenticator failed for (bb118-200-42-112.singnet.com.sg) [118.200.42.112]:37308: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2025-12-09 04:36:48 dovecot_login authenticator failed for ([125.20.245.182]) [125.20.245.182]:35566: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.205
country_id: 337996
description:
2025-12-09 04:36:13 dovecot_login authenticator failed for ([196.188.187.205]) [196.188.187.205]:34918: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.2
country_id: 1269750
description:
2025-12-09 04:36:17 dovecot_login authenticator failed for ([125.20.223.161]) [152.52.236.2]:40026: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.178
country_id: 1269750
description:
2025-12-09 04:36:31 dovecot_login authenticator failed for ([122.187.181.57]) [182.95.174.178]:51366: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 04:38:07 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<9Fgf3nhFXMKKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.37
country_id: 6252001
description:
2025-12-09 04:37:22 dovecot_login authenticator failed for ([98.181.46.37]) [98.181.46.37]:45528: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec  9 04:38:12 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<cm1n3nhF/tk+PIdp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec  9 04:39:46 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<zkQN5HhFYMmPbvgo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.201.94
country_id: 1269750
description:
2025-12-09 04:40:05 dovecot_login authenticator failed for ([117.248.201.94]) [117.248.201.94]:44785: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.78
country_id: 1269750
description:
2025-12-09 04:39:30 dovecot_login authenticator failed for ([152.52.234.170]) [182.95.177.78]:40644: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.192.240
country_id: 3144096
description:
2025-12-09 04:39:48 dovecot_login authenticator failed for (cm-84.210.192.240.get.no) [84.210.192.240]:41998: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 04:41:03 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<wqKf6HhFxsWKxX03>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.162.73
country_id: 1880251
description:
Dec  9 04:40:27 host2 sshd[242553]: Disconnected from invalid user admin 101.47.162.73 port 58500 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-09 04:41:35 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (copion) [87.103.126.54]:21425: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  9 04:42:04 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<5H897HhFdtAv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-12-09 04:42:28 dovecot_plain authenticator failed for c-174-166-153-20.hsd1.nj.comcast.net (guill) [174.166.153.20]:39570: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  9 04:42:39 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<Nxhf7nhFWKi8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.231.6
country_id: 1269750
description:
2025-12-09 04:43:00 dovecot_login authenticator failed for ([128.185.231.6]) [128.185.231.6]:45212: 535 Incorrect authentication data (set_id=admin@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.168.140.35
country_id: 3469034
description:
2025-12-09 04:43:13 dovecot_login authenticator failed for ([45.168.140.35]) [45.168.140.35]:34318: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2025-12-09 04:46:05 dovecot_login authenticator failed for ([103.55.89.5]) [103.55.89.5]:42604: 535 Incorrect authentication data (set_id=support@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.5.63.166
country_id: 1694008
description:
2025-12-09 04:46:15 dovecot_login authenticator failed for ([103.5.63.166]) [103.5.63.166]:42652: 535 Incorrect authentication data (set_id=contact@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.136.37
country_id: 3996063
description:
2025-12-09 04:46:24 dovecot_login authenticator failed for (187.161.136.37-clientes-izzi.mx) [187.161.136.37]:54654: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.247.230.132
country_id: 2264397
description:
2025-12-09 04:46:31 dovecot_login authenticator failed for bl14-230-132.dsl.telepac.pt [85.247.230.132]:57962: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.31.164.124
country_id: 6252001
description:
2025-12-09 04:48:58 dovecot_plain authenticator failed for c-76-31-164-124.hsd1.tx.comcast.net (ovidaest) [76.31.164.124]:59200: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec  9 04:49:25 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<W/SEBnlFrpk+PIdp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.45
country_id: 6252001
description:
Dec  9 04:49:51 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.45, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<5CwzCHlFtcnN0h8t>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec  9 04:51:03 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<JK5gDHlFDJFnJFMP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  9 04:52:08 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@lankaherbalsolutions.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<18pHEHlFms+PbtX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.15.149.254
country_id: 3469034
description:
2025-12-09 04:51:47 dovecot_login authenticator failed for ([187.7.85.97]) [201.15.149.254]:40462: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.208.47.13
country_id: 1168579
description:
2025-12-09 04:52:09 dovecot_login authenticator failed for ([154.208.47.13]) [154.208.47.13]:53408: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.60.194
country_id: 953987
description:
Dec  9 04:53:59 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@v-deploy.com>, method=PLAIN, rip=102.129.60.194, lip=66.85.158.91, TLS, session=<quTcFXlFbZpmgTzC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2025-12-09 04:54:09 dovecot_plain authenticator failed for c-73-197-194-98.hsd1.nj.comcast.net (worthess) [73.197.194.98]:51130: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec  9 04:55:01 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<206RGnlFvpF100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.8.48.178
country_id: 1605651
description:
2025-12-09 04:54:20 dovecot_login authenticator failed for ppp-58-8-48-178.revip2.asianet.co.th [58.8.48.178]:37312: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.76.241.31
country_id: 933860
description:
Dec  9 04:54:21 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=41.76.241.31, lip=66.85.158.91, TLS, session=<fOQnF3lFWtcpTPEf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.51.166
country_id: 1269750
description:
2025-12-09 04:54:30 dovecot_login authenticator failed for ([125.23.112.209]) [182.95.51.166]:43276: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2025-12-09 04:54:31 dovecot_plain authenticator failed for c-73-168-136-150.hsd1.il.comcast.net (myophoty) [73.168.136.150]:59074: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2025-12-09 04:56:01 dovecot_login authenticator failed for ([128.185.160.185]) [128.185.235.110]:38144: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.20.228.20
country_id: 1269750
description:
2025-12-09 04:56:27 dovecot_login authenticator failed for ([157.20.228.20]) [157.20.228.20]:34984: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.80.73
country_id: 2077456
description:
2025-12-09 04:56:51 dovecot_login authenticator failed for ([120.157.80.73]) [120.157.80.73]:34290: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 51.159.234.118
country_id: 2750405
description:
Dec  9 04:56:55 host2 pure-ftpd[268204]: (?@51.159.234.118) [INFO] New connection from 51.159.234.118


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 51.159.234.118
country_id: 2750405
description:
Dec  9 04:56:55 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=51.159.234.118, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<qDt8IXlFtK0zn+p2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.82
country_id: 1733045
description:
2025-12-09 04:57:21 dovecot_login authenticator failed for ([49.124.151.82]) [49.124.151.82]:55840: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2025-12-09 04:58:34 dovecot_login authenticator failed for ([103.168.241.32]) [103.168.241.32]:58775: 535 Incorrect authentication data (set_id=postmaster@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.110.237
country_id: 3144096
description:
2025-12-09 04:58:42 dovecot_login authenticator failed for (cm-46.212.110.237.get.no) [46.212.110.237]:50333: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  9 05:00:26 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<txrtLXlFvM+PbtX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec  9 05:00:38 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@dataesite.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<PUqpLnlFCax100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2025-12-09 05:01:12 dovecot_plain authenticator failed for (readriter) [103.51.26.198]:38117: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.202.230.214
country_id: 798544
description:
2025-12-09 05:01:14 dovecot_plain authenticator failed for host-91-202-230-214.static.oc3.zagan.visnet.pl (myrextrit) [91.202.230.214]:56841: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.41
country_id: 130758
description:
Dec  9 05:01:48 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.41, lip=66.85.158.91, session=<ssnQMnlF9NQ+PIcp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  9 05:02:31 host2 sshd[275540]: Disconnected from invalid user user 2.57.121.25 port 39045 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 05:03:48 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<IA3/OXlFXOGqQMFo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.125
country_id: 6252001
description:
Dec  9 05:05:28 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.125, lip=66.85.158.92, TLS: Connection closed, session=<vdkPQHlFYEhChJl9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec  9 05:07:44 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<8noSSHlFZLo+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  9 05:08:06 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<vIlXSXlFctsv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec  9 05:08:16 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@seyawin.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<G5r7SXlFPrw+PIdc>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 05:08:39 +0530] info [cpaneld] 213.209.143.251 - 2strav "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec  9 05:08:46 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<2enES3lFIsc+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  9 05:10:59 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<jC+yU3lFsKQ+PIdr>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 117.103.80.92
country_id: 1210997
description:
[2025-12-09 05:14:09 +0530] info [cpaneld] 117.103.80.92 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 117.103.80.92
country_id: 1210997
description:
[2025-12-09 05:14:11 +0530] info [cpaneld] 117.103.80.92 - lezzarotechcom "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotechcom (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  9 05:14:22 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<pOjIX3lF6pw+PIds>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.41
country_id: 6252001
description:
Dec  9 05:15:08 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.41, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<XHWjYnlFesPG6xgp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec  9 05:16:26 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<exwwZ3lFlog+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 05:17:13 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<0Sv/aXlF3NCqQMFo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.226.163
country_id: 3144096
description:
2025-12-09 05:20:10 dovecot_login authenticator failed for ([178.232.226.163]) [178.232.226.163]:53232: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.51.221.132
country_id: 3175395
description:
2025-12-09 05:20:19 dovecot_login authenticator failed for 93-51-221-132.ip268.fastwebnet.it [93.51.221.132]:40445: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec  9 05:23:44 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<C/hBgXlFLoxnJFMP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Dec  9 05:30:48 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=167.71.230.230, lip=66.85.158.91, session=<72+FmnlFosynR+bm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 05:32:18 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<2W3tn3lFyJmKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec  9 05:33:43 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<H/7ypHlFtOyPbvgo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2025-12-09 05:34:16 dovecot_plain authenticator failed for (parping) [91.73.188.251]:52584: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.247.137.37
country_id: 2635167
description:
Dec  9 05:34:37 host2 pure-ftpd[315129]: (?@185.247.137.37) [INFO] New connection from 185.247.137.37


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.13
country_id: 1269750
description:
2025-12-09 05:35:50 dovecot_login authenticator failed for ([122.187.230.13]) [122.187.230.13]:47183: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.202.15.69
country_id: 6252001
description:
2025-12-09 05:35:58 dovecot_login authenticator failed for ([12.202.15.69]) [12.202.15.69]:14918: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 05:35:21 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<D1XWqnlFNqKKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-12-09 05:36:28 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:41821: 535 Incorrect authentication data (set_id=admin@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  9 05:37:16 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<dsWxsXlFftkv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec  9 05:37:18 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<o17EsXlF/sw+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  9 05:37:28 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@kiriaswanu.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<F0FksnlFBoe8putr>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 05:38:15 +0530] info [cpaneld] 213.209.143.251 - agrona "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agrona (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  9 05:43:05 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<D9B8xnlFAOCPbtX3>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 05:42:57 +0530] info [cpaneld] 213.209.143.251 - ajssta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajssta (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.60.111.178
country_id: 1733045
description:
Dec  9 05:45:13 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sobaherbal.com>, method=PLAIN, rip=72.60.111.178, lip=66.85.158.91, session=<IRkfznlF3tNIPG+y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.42.143.107
country_id: 6252001
description:
2025-12-09 05:47:06 dovecot_plain authenticator failed for c-98-42-143-107.hsd1.ca.comcast.net ([89.116.164.85]) [98.42.143.107]:45758: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.42.143.107
country_id: 6252001
description:
2025-12-09 05:47:12 dovecot_login authenticator failed for c-98-42-143-107.hsd1.ca.comcast.net ([89.116.164.85]) [98.42.143.107]:45758: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec  9 05:47:15 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<BuJl1XlFKKA+PIdq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.117.168.171
country_id: 2542007
description:
2025-12-09 05:47:17 dovecot_plain authenticator failed for ([89.116.164.85]) [196.117.168.171]:38115: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.190.126.129
country_id: 3469034
description:
2025-12-09 05:47:31 dovecot_plain authenticator failed for ([89.116.164.85]) [179.190.126.129]:25947: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec  9 05:48:46 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<NtfH2nlF8UF100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.190.12
country_id: 3144096
description:
2025-12-09 05:51:05 dovecot_login authenticator failed for (cm-84.213.190.12.get.no) [84.213.190.12]:47176: 535 Incorrect authentication data (set_id=postmaster@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.114.143.79
country_id: 3865483
description:
2025-12-09 05:51:17 dovecot_login authenticator failed for host-cotesma-114-143-79.smandes.com.ar [181.114.143.79]:32994: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.213.247
country_id: 6251999
description:
Dec  9 05:51:36 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=143.110.213.247, lip=66.85.158.91, session=<LrLw5HlF/pyPbtX3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.206.241.199
country_id: 453733
description:
Dec  9 05:58:07 host2 sshd[342899]: Disconnected from invalid user pula 109.206.241.199 port 52738 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.117.97.0
country_id: 6252001
description:
Dec  9 05:58:09 host2 sshd[342949]: Disconnected from invalid user kamran 40.117.97.0 port 47976 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 142.93.27.16
country_id: 6252001
description:
Dec  9 05:57:48 host2 sshd[342467]: Disconnected from invalid user alice 142.93.27.16 port 49660 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 142.93.27.16
country_id: 6252001
description:
Dec  9 05:58:54 host2 sshd[343722]: Disconnected from invalid user prowlarr 142.93.27.16 port 45966 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.206.241.199
country_id: 453733
description:
Dec  9 05:59:19 host2 sshd[344194]: Disconnected from invalid user webuser 109.206.241.199 port 41256 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.196.148.169
country_id: 6252001
description:
2025-12-09 05:59:22 dovecot_login authenticator failed for (syn-024-196-148-169.res.spectrum.com) [24.196.148.169]:56676: 535 Incorrect authentication data (set_id=office@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.176.4.105
country_id: 1168579
description:
2025-12-09 05:59:36 dovecot_login authenticator failed for ([182.176.4.105]) [182.176.4.105]:52724: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.197
country_id: 6252001
description:
Dec  9 06:00:50 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.197, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<tFEUBnpFt8/G6xjF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  9 06:01:42 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<zo3xCHpFHNwXXz9j>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 40.117.97.0
country_id: 6252001
description:
Dec  9 06:01:48 host2 sshd[347482]: Disconnected from invalid user profe 40.117.97.0 port 48870 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 06:02:09 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<YZmiCnpFvMGqQMFo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.206.241.199
country_id: 453733
description:
Dec  9 06:02:39 host2 sshd[348494]: Disconnected from invalid user devuser 109.206.241.199 port 55496 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.46.148.180
country_id: 6252001
description:
2025-12-09 06:03:50 dovecot_plain authenticator failed for c-68-46-148-180.hsd1.mi.comcast.net (substion) [68.46.148.180]:47492: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.247.75.98
country_id: 6252001
description:
Dec  9 06:04:06 host2 sshd[350484]: Disconnected from invalid user kafka 35.247.75.98 port 50680 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.255
country_id: 6252001
description:
Dec  9 06:03:22 host2 pure-ftpd[349663]: (?@205.210.31.255) [INFO] New connection from 205.210.31.255


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.117.97.0
country_id: 6252001
description:
Dec  9 06:04:21 host2 sshd[350686]: Disconnected from invalid user zhaoxj 40.117.97.0 port 55482 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.247.75.98
country_id: 6252001
description:
Dec  9 06:05:26 host2 sshd[351953]: Disconnected from invalid user erpuser 35.247.75.98 port 50844 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.117.97.0
country_id: 6252001
description:
Dec  9 06:05:36 host2 sshd[352160]: Disconnected from invalid user devuser 40.117.97.0 port 36086 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  9 06:06:39 host2 sshd[353299]: Disconnected from invalid user user 2.57.121.25 port 43413 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.49.11
country_id: 3144096
description:
2025-12-09 06:06:31 dovecot_login authenticator failed for (cm-84.214.49.11.get.no) [84.214.49.11]:38269: 535 Incorrect authentication data (set_id=admin@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.167.160
country_id: 99237
description:
2025-12-09 06:07:35 dovecot_login authenticator failed for ([65.20.167.160]) [65.20.167.160]:38336: 535 Incorrect authentication data (set_id=support@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.10.140
country_id: 3144096
description:
2025-12-09 06:07:44 dovecot_login authenticator failed for ([84.211.10.140]) [84.211.10.140]:54336: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.247.75.98
country_id: 6252001
description:
Dec  9 06:08:02 host2 sshd[354795]: Disconnected from invalid user httpd 35.247.75.98 port 40792 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  9 06:09:25 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<ZUCgJHpFitYv/lVz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.247.75.98
country_id: 6252001
description:
Dec  9 06:10:45 host2 sshd[357663]: Disconnected from invalid user erpnext 35.247.75.98 port 46862 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.206.241.199
country_id: 453733
description:
Dec  9 06:10:36 host2 sshd[357511]: Disconnected from invalid user admin 109.206.241.199 port 42290 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.213
country_id: 6252001
description:
Dec  9 06:13:02 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.213, lip=66.85.158.91, session=<RwCxMXpFsOuTuYTV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.152.110.30
country_id: 2635167
description:
Dec  9 06:13:14 host2 sshd[360190]: Invalid user cloudtourssrilan_travel from 82.152.110.30 port 63170


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 06:15:53 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@sobaherbal.com>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<OZPLO3pF8rSqQMFo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 183.88.232.183
country_id: 1605651
description:
Dec  9 06:18:29 host2 sshd[365597]: Disconnected from invalid user victor 183.88.232.183 port 47550 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 183.88.232.183
country_id: 1605651
description:
Dec  9 06:19:45 host2 sshd[366590]: Disconnected from invalid user pacs 183.88.232.183 port 45326 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2025-12-09 06:21:38 dovecot_plain authenticator failed for c-24-1-200-187.hsd1.il.comcast.net (honip) [24.1.200.187]:53430: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 183.88.232.183
country_id: 1605651
description:
Dec  9 06:23:08 host2 sshd[369889]: Disconnected from invalid user oe 183.88.232.183 port 53916 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.163
country_id: 99237
description:
2025-12-09 06:24:11 dovecot_plain authenticator failed for (rheweative) [65.20.250.163]:46785: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 183.88.232.183
country_id: 1605651
description:
Dec  9 06:24:31 host2 sshd[371561]: Disconnected from invalid user ubuntu 183.88.232.183 port 51702 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2025-12-09 06:24:50 dovecot_plain authenticator failed for c-73-197-236-163.hsd1.nj.comcast.net (wherph) [73.197.236.163]:52026: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Dec  9 06:26:26 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=167.71.230.230, lip=66.85.158.91, session=<yRqBYXpFBt2nR+bm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec  9 06:27:53 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<notify@kiriaswanu.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<rkqpZnpFcOmPbvgo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2025-12-09 06:28:21 dovecot_plain authenticator failed for (roazoon) [102.53.15.180]:51135: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 06:28:45 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<b2nPaXpFZt+KxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec  9 06:29:20 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<tV3ka3pFcJtnJFMP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec  9 06:30:20 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: Connection closed, session=<bl6Tb3pFJtQDlTsa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 06:31:41 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<IexJdHpFppuKxX03>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec  9 06:32:05 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<s5HYdXpFLqIDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec  9 06:32:23 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<yEThdnpFkrIDlTsa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  9 06:32:35 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<4oh4d3pFOLC8putr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec  9 06:33:30 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<Ni/senpFWIQDlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2025-12-09 06:34:08 dovecot_login authenticator failed for ([103.50.5.94]) [103.50.5.94]:52601: 535 Incorrect authentication data (set_id=office@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.2
country_id: 798544
description:
2025-12-09 06:34:16 dovecot_login authenticator failed for 89-67-37-2.dynamic.play.pl [89.67.37.2]:37959: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-12-09 06:34:30 dovecot_plain authenticator failed for (sucke) [24.187.213.29]:38106: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  9 06:35:39 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<ltFygnpFRqgv/lVz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec  9 06:35:49 host2 dovecot[2208013]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 1 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS, session=<XAIog3pF5N8DlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec  9 06:36:36 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: Connection closed, session=<+Af7hXpF3tQDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec  9 06:37:23 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<1XPKiHpFtJMDlTsa>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  9 06:39:59 host2 sshd[386758]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec  9 06:39:48 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS, session=<auZykXpF9uEDlTsa>


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 173.70.144.46
country_id: 6252001
description:
Dec  9 06:40:54 host2 sshd[387895]: User essenceceylontea from 173.70.144.46 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.220.199.98
country_id: 2077456
description:
2025-12-09 06:43:45 dovecot_login authenticator failed for 111-220-199-98.dyn.ip.vocus.au [111.220.199.98]:58896: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.219
country_id: 1733045
description:
2025-12-09 06:44:05 dovecot_login authenticator failed for ([49.124.149.219]) [49.124.149.219]:47396: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.173.58.47
country_id: 6252001
description:
2025-12-09 06:45:34 dovecot_plain authenticator failed for c-67-173-58-47.hsd1.il.comcast.net (poktached) [67.173.58.47]:50280: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec  9 06:47:09 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<4lWRq3pFEf9100Db>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.59.26.44
country_id: 1269750
description:
Dec  9 06:47:26 host2 dovecot[2208013]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 1 secs): user=<>, rip=139.59.26.44, lip=66.85.158.92, TLS, session=<H6G2rHpFgoCLOxos>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.157.144
country_id: 2921044
description:
[2025-12-09 06:50:10 +0530] info [cpaneld] 213.209.157.144 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.74.211.27
country_id: 6252001
description:
2025-12-09 06:52:20 dovecot_plain authenticator failed for c-75-74-211-27.hsd1.fl.comcast.net (monticae) [75.74.211.27]:58453: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.157.219.158
country_id: 6252001
description:
2025-12-09 06:52:23 dovecot_plain authenticator failed for c-76-157-219-158.hsd1.il.comcast.net (batenth) [76.157.219.158]:45332: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 06:53:02 +0530] info [cpaneld] 213.209.143.251 - 2str "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec  9 06:53:54 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<ek/Bw3pFhFd100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  9 06:57:00 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<9ZnYznpFZIoXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-09 06:59:14 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:62693: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 07:00:24 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@anandaobauae.org>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<SDj62npFzpeqQMFo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec  9 07:02:14 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<hpqG4XpFOo1nJFMP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.141.86.14
country_id: 3469034
description:
2025-12-09 07:04:16 dovecot_plain authenticator failed for ([89.116.164.85]) [192.141.86.14]:45717: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.158.220.203
country_id: 3865483
description:
2025-12-09 07:04:31 dovecot_plain authenticator failed for ([89.116.164.85]) [186.158.220.203]:21339: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.4.33.247
country_id: 3865483
description:
2025-12-09 07:04:45 dovecot_plain authenticator failed for host247.181-4-33.telecom.net.ar ([89.116.164.85]) [181.4.33.247]:38712: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  9 07:05:36 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<nUWU7XpFOL4v/lVz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.134.231
country_id: 6252001
description:
Dec  9 07:06:39 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=71.6.134.231, lip=66.85.158.92, TLS: Connection closed, session=<4dFy8XpFaupHBobn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.80
country_id: 2328926
description:
Dec  9 07:09:06 host2 sshd[415492]: Disconnected from invalid user hadi 102.88.137.80 port 1295 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.145.57
country_id: 1733045
description:
2025-12-09 07:08:55 dovecot_login authenticator failed for ([49.124.145.57]) [49.124.145.57]:44514: 535 Incorrect authentication data (set_id=contact@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.184.162
country_id: 3144096
description:
2025-12-09 07:10:05 dovecot_login authenticator failed for (cm-178.232.184.162.get.no) [178.232.184.162]:59335: 535 Incorrect authentication data (set_id=office@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.210.49.167
country_id: 1819730
description:
Dec  9 07:09:13 host2 sshd[415633]: Disconnected from invalid user copia 8.210.49.167 port 41738 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.208.122.185
country_id: 6252001
description:
2025-12-09 07:09:17 dovecot_login authenticator failed for 71-208-122-185.ftmy.qwest.net [71.208.122.185]:59580: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.174.72.225
country_id: 6252001
description:
Dec  9 07:09:21 host2 sshd[415784]: Disconnected from invalid user frontend 172.174.72.225 port 57438 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.101.146
country_id: 1269750
description:
2025-12-09 07:09:52 dovecot_login authenticator failed for (aes-static-217.70.22.125.airtel.in) [27.123.101.146]:53466: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.201.31
country_id: 3144096
description:
2025-12-09 07:10:14 dovecot_login authenticator failed for (cm-178.232.201.31.get.no) [178.232.201.31]:37174: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2025-12-09 07:10:26 dovecot_login authenticator failed for (173-25-186-130.client.mchsi.com) [173.25.186.130]:55562: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 8.210.49.167
country_id: 1819730
description:
Dec  9 07:12:05 host2 sshd[418739]: Disconnected from invalid user ftpuser 8.210.49.167 port 35258 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.249.247.165
country_id: 1819730
description:
Dec  9 07:11:44 host2 sshd[418328]: Disconnected from invalid user info 45.249.247.165 port 36220 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.211
country_id: 2635167
description:
Dec  9 07:11:56 host2 dovecot[2208013]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.211, lip=66.85.158.91, TLS, session=<FeZRBHtFl8O594nT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.65
country_id: 2635167
description:
Dec  9 07:11:57 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.65, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<LRtlBHtFKeq594lB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.50
country_id: 2635167
description:
Dec  9 07:12:30 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.50, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=</+xgBntF34G594ky>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.61
country_id: 2635167
description:
Dec  9 07:13:03 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.61, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<tNNcCHtF/etX7LA9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.174.72.225
country_id: 6252001
description:
Dec  9 07:12:18 host2 sshd[418963]: Disconnected from invalid user test 172.174.72.225 port 36202 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.70
country_id: 6252001
description:
Dec  9 07:13:37 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.70, lip=66.85.158.92, TLS, session=<vXtgCntFFvCTuYRG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.72
country_id: 2635167
description:
Dec  9 07:13:37 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.72, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<FIlYCntF8dFX7LBI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.241.202.216
country_id: 6252001
description:
2025-12-09 07:13:41 dovecot_plain authenticator failed for cm-72-241-202-216.buckeyecom.net (deninge) [72.241.202.216]:42795: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.219.165.224
country_id: 1880251
description:
Dec  9 07:14:03 host2 sshd[420425]: Disconnected from invalid user test 8.219.165.224 port 51244 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 07:14:08 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sobaherbal.com>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<3k8eDHtFgsqqQMFo>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.174.72.225
country_id: 6252001
description:
Dec  9 07:13:32 host2 sshd[420040]: Disconnected from invalid user wxg 172.174.72.225 port 36484 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.65
country_id: 2635167
description:
Dec  9 07:14:43 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.65, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<OVtODntFn95X7LBB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.49
country_id: 2635167
description:
Dec  9 07:14:10 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.49, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<RrRUDHtFs9hX7LAx>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.210.49.167
country_id: 1819730
description:
Dec  9 07:14:48 host2 sshd[421040]: Disconnected from invalid user steam 8.210.49.167 port 34616 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.46
country_id: 2635167
description:
Dec  9 07:15:50 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.46, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<x35IEntFe5lX7LAu>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.210.49.167
country_id: 1819730
description:
Dec  9 07:16:06 host2 sshd[422759]: Disconnected from invalid user ubuntu 8.210.49.167 port 34282 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.236.24.117
country_id: 1880251
description:
Dec  9 07:15:15 host2 sshd[421641]: Disconnected from invalid user wxg 47.236.24.117 port 38968 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.45
country_id: 2635167
description:
Dec  9 07:15:17 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=185.247.137.45, lip=66.85.158.91, TLS handshaking: Connection closed, session=<JbRMEHtFXc+594kt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.106.163.189
country_id: 6252001
description:
2025-12-09 07:16:23 dovecot_plain authenticator failed for c-76-106-163-189.hsd1.fl.comcast.net (lustor) [76.106.163.189]:35318: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.219.165.224
country_id: 1880251
description:
Dec  9 07:17:06 host2 sshd[424027]: Disconnected from invalid user hadi 8.219.165.224 port 33458 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.43
country_id: 2635167
description:
Dec  9 07:16:23 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.43, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<YH9CFHtFR7a594kr>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 47.236.24.117
country_id: 1880251
description:
Dec  9 07:16:37 host2 sshd[423429]: Disconnected from invalid user frontend 47.236.24.117 port 55550 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.69
country_id: 2635167
description:
Dec  9 07:16:56 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.69, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<YOg+FntFoYS594lF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.71.136.125
country_id: 1168579
description:
Dec  9 07:17:20 host2 sshd[424222]: Disconnected from invalid user pedrito 116.71.136.125 port 53474 [preauth]


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 213.209.143.251
country_id: 2921044
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[cpaneld] [Local IP Address]=[66.85.158.91] [Local Port]=[2083] [Remote IP Address]=[213.209.143.251] [Remote Port]=[53028] [Authentication Database]=[system] [Username]=[agro] (10/10 failures) (blocked until [Fri Nov 14 05:10:03 2025 UTC/Fri Nov 14 10:40:03 2025 LOCAL])


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.249.247.165
country_id: 1819730
description:
Dec  9 07:17:36 host2 sshd[424505]: Disconnected from invalid user httpd 45.249.247.165 port 60456 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.219.165.224
country_id: 1880251
description:
Dec  9 07:17:45 host2 sshd[424652]: Disconnected from invalid user maman 8.219.165.224 port 51820 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.249.247.165
country_id: 1819730
description:
Dec  9 07:18:13 host2 sshd[425180]: Disconnected from invalid user ubuntu 45.249.247.165 port 47270 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.208.156.50
country_id: 241170
description:
Dec  9 07:18:23 host2 sshd[425410]: Disconnected from invalid user sol 185.208.156.50 port 45392 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 8.219.165.224
country_id: 1880251
description:
Dec  9 07:18:25 host2 sshd[425457]: Disconnected from invalid user frontend 8.219.165.224 port 39958 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2025-12-09 07:18:46 dovecot_plain authenticator failed for c-71-235-225-181.hsd1.ct.comcast.net (unicas) [71.235.225.181]:46804: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 185.208.156.50
country_id: 241170
description:
Dec  9 07:18:53 host2 sshd[426113]: Received disconnect from 185.208.156.50 port 55276:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.161.96.107
country_id: 6252001
description:
2025-12-09 07:19:34 dovecot_plain authenticator failed for c-73-161-96-107.hsd1.mi.comcast.net (sampist) [73.161.96.107]:47984: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.236.24.117
country_id: 1880251
description:
Dec  9 07:19:21 host2 sshd[426736]: Disconnected from invalid user barcelona 47.236.24.117 port 49748 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.208.156.50
country_id: 241170
description:
Dec  9 07:19:24 host2 sshd[426808]: Disconnected from invalid user frontend 185.208.156.50 port 35084 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 07:21:09 +0530] info [cpaneld] 213.209.143.251 - ajss "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajss (has_cpuser_file failed)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 213.209.143.251
country_id: 2921044
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[cpaneld] [Local IP Address]=[66.85.158.91] [Local Port]=[2083] [Remote IP Address]=[213.209.143.251] [Remote Port]=[53608] [Authentication Database]=[system] [Username]=[ajss] (10/10 failures) (blocked until [Fri Nov 14 05:10:03 2025 UTC/Fri Nov 14 10:40:03 2025 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.144.72
country_id: 3996063
description:
2025-12-09 07:21:43 dovecot_login authenticator failed for ([177.236.144.72]) [177.236.144.72]:52167: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.142.67
country_id: 337996
description:
2025-12-09 07:22:39 dovecot_login authenticator failed for ([196.191.142.67]) [196.191.142.67]:54458: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.221.133.6
country_id: 3469034
description:
2025-12-09 07:23:08 dovecot_login authenticator failed for 6-133-221-131.dynamic.v1telecom.com.br [131.221.133.6]:48443: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.86.179.147
country_id: 1821275
description:
2025-12-09 07:23:26 dovecot_login authenticator failed for (n20286z179l147.static.ctmip.net) [202.86.179.147]:48782: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.71.230.230
country_id: 1269750
description:
Dec  9 07:23:41 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=167.71.230.230, lip=66.85.158.91, session=<9b1CLntF0tCnR+bm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.47.10.39
country_id: 3469034
description:
Dec  9 07:23:44 host2 sshd[432542]: Disconnected from invalid user test 189.47.10.39 port 41728 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.110.11
country_id: 2661886
description:
2025-12-09 07:23:48 dovecot_login authenticator failed for h77-53-110-11.cust.bredband2.com [77.53.110.11]:45694: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.214.133.25
country_id: 6252001
description:
2025-12-09 07:24:07 dovecot_login authenticator failed for ([72.214.133.25]) [72.214.133.25]:59472: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.242.250
country_id: 6252001
description:
2025-12-09 07:23:14 dovecot_login authenticator failed for wsip-184-191-242-250.fv.ks.cox.net [184.191.242.250]:38699: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 07:24:36 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<3jiHMXtFuKOKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.128.253
country_id: 3469034
description:
Dec  9 07:25:00 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@v-deploy.com>, method=PLAIN, rip=191.53.128.253, lip=66.85.158.91, TLS, session=<nVT8MXtFxdW/NYD9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.247.41
country_id: 798544
description:
Dec  9 07:25:19 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=109.125.247.41, lip=66.85.158.91, TLS, session=<histM3tFkd5tffcp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 07:27:34 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@rehanseo.online>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<fLIkPHtF9KmKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  9 07:27:49 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@kiriaswanu.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<qNMBPXtFQr68putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-12-09 07:30:12 dovecot_login authenticator failed for ([178.250.191.189]) [178.250.191.189]:48356: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.0.88
country_id: 3144096
description:
2025-12-09 07:31:21 dovecot_login authenticator failed for (cm-78.156.0.88.get.no) [78.156.0.88]:42580: 535 Incorrect authentication data (set_id=test@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.107.158
country_id: 226074
description:
2025-12-09 07:31:42 dovecot_login authenticator failed for ([196.0.107.158]) [196.0.107.158]:47597: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.47.10.39
country_id: 3469034
description:
Dec  9 07:32:08 host2 sshd[442447]: Disconnected from invalid user mobile 189.47.10.39 port 37422 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.219.235.108
country_id: 6252001
description:
Dec  9 07:32:31 host2 sshd[442736]: Invalid user cloudtourssrilan_travel from 104.219.235.108 port 54080


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.47.10.39
country_id: 3469034
description:
Dec  9 07:34:04 host2 sshd[443927]: Disconnected from invalid user ubuntu 189.47.10.39 port 36020 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec  9 07:35:15 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<2feVV3tFwKRnJFMP>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 80.248.243.202
country_id: 660013
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 80.248.243.202 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.47.10.39
country_id: 3469034
description:
Dec  9 07:36:50 host2 sshd[447090]: Disconnected from invalid user frontend 189.47.10.39 port 38278 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.207.35.160
country_id: 6290252
description:
Dec  9 07:40:59 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=109.207.35.160, lip=66.85.158.91, TLS, session=<ASVCa3tFzNZtzyOg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.142.185.16
country_id: 3469034
description:
Dec  9 07:41:20 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<accounts>, method=PLAIN, rip=200.142.185.16, lip=66.85.158.91, TLS, session=<z7BhbHtFjuPIjrkQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.72.176.66
country_id: 2542007
description:
2025-12-09 07:46:37 dovecot_plain authenticator failed for (sperst) [105.72.176.66]:57832: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.62.239.4
country_id: 732800
description:
2025-12-09 07:46:40 dovecot_plain authenticator failed for (incess) [149.62.239.4]:45700: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-09 07:49:28 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (gelosia) [87.103.126.54]:5560: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec  9 07:49:48 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<fViqi3tFfql100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.10.7
country_id: 2300660
description:
Dec  9 07:51:46 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=41.139.10.7, lip=66.85.158.91, TLS, session=<Ch23kXtFPIEpiwoH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.86.166.102
country_id: 3469034
description:
Dec  9 07:51:26 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=177.86.166.102, lip=66.85.158.91, TLS, session=<1SeAkHtFKcKxVqZm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 161.35.205.49
country_id: 2921044
description:
Dec  9 07:51:41 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=161.35.205.49, lip=66.85.158.92, TLS handshaking: Connection closed, session=<czmGkntFhPWhI80x>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.121
country_id: 6252001
description:
Dec  9 07:52:48 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.121, lip=66.85.158.92, TLS handshaking: Connection closed, session=<isaAlntFdPNChJl5>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  9 07:53:12 host2 sshd[467151]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.30.150
country_id: 226074
description:
Dec  9 07:53:43 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=196.0.30.150, lip=66.85.158.91, TLS, session=<M+yAmHtFHZzEAB6W>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.21
country_id: 3175395
description:
Dec  9 07:54:00 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<designdpt>, method=PLAIN, rip=185.15.171.21, lip=66.85.158.91, TLS, session=<htzTmXtFAOC5D6sV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.44.40
country_id: 1522867
description:
2025-12-09 07:53:21 dovecot_plain authenticator failed for (foophawlic) [5.76.44.40]:42732: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.207.210.23
country_id: 2960313
description:
2025-12-09 07:54:45 dovecot_plain authenticator failed for (myines) [88.207.210.23]:61827: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  9 07:55:07 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<news@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<Pf+KnntFqKIXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec  9 07:56:34 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@dataesite.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<kkXSo3tFyYB100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.218.69.102
country_id: 1819730
description:
Dec  9 07:57:53 host2 sshd[473888]: Disconnected from invalid user xq 8.218.69.102 port 47532 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 07:58:27 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<FjCRqntFGOSqQMFo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.218.69.102
country_id: 1819730
description:
Dec  9 07:59:32 host2 sshd[475531]: Disconnected from invalid user user5 8.218.69.102 port 48730 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.219.138.63
country_id: 3996063
description:
2025-12-09 07:59:45 dovecot_login authenticator failed for (189.219.138.63-clientes-izzi.mx) [189.219.138.63]:34344: 535 Incorrect authentication data (set_id=admin@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-09 07:59:27 dovecot_plain authenticator failed for (pirrant) [154.144.243.93]:43084: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.112.102
country_id: 1269750
description:
2025-12-09 08:00:41 dovecot_login authenticator failed for ([182.95.112.102]) [182.95.112.102]:43166: 535 Incorrect authentication data (set_id=support@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.196
country_id: 1733045
description:
2025-12-09 08:00:58 dovecot_login authenticator failed for ([49.124.148.196]) [49.124.148.196]:51882: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.218.69.102
country_id: 1819730
description:
Dec  9 08:01:28 host2 sshd[478341]: Disconnected from invalid user ubuntu 8.218.69.102 port 33364 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  9 08:02:10 host2 sshd[479009]: Disconnected from invalid user admin 2.57.121.112 port 25496 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.160.64.118
country_id: 3996063
description:
2025-12-09 08:02:20 dovecot_login authenticator failed for ([201.160.64.118]) [201.160.64.118]:55790: 535 Incorrect authentication data (set_id=postmaster@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2025-12-09 08:02:37 dovecot_login authenticator failed for ([182.95.176.194]) [182.95.176.194]:60388: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 8.218.69.102
country_id: 1819730
description:
Dec  9 08:02:44 host2 sshd[479753]: Disconnected from invalid user admin 8.218.69.102 port 60766 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  9 08:03:37 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<D5UJvXtFOu4v/lVz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.111.32.174
country_id: 1643084
description:
Dec  9 08:03:54 host2 sshd[481288]: Disconnected from invalid user ftp-user 27.111.32.174 port 36944 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.16
country_id: 6252001
description:
Dec  9 08:04:51 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=195.184.76.16, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<7nmZwXtF0ZDDuEwQ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.238.112.45
country_id: 1819730
description:
Dec  9 08:04:24 host2 sshd[481895]: Disconnected from invalid user ubuntu 47.238.112.45 port 35722 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.86
country_id: 2635167
description:
Dec  9 08:04:36 host2 dovecot[2208013]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.86, lip=66.85.158.91, TLS, session=<4+y4wHtF26e594lW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.23
country_id: 6252001
description:
Dec  9 08:04:35 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.23, lip=66.85.158.92, TLS handshaking: Connection closed, session=<yIGmwHtFl9jDuEwX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.21
country_id: 6252001
description:
Dec  9 08:04:47 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 12 secs): user=<>, rip=195.184.76.21, lip=66.85.158.92, TLS: Connection closed, session=<mgxcwXtFYcDDuEwV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.236.43.54
country_id: 1880251
description:
Dec  9 08:05:14 host2 sshd[483183]: Disconnected from invalid user testuser 47.236.43.54 port 57902 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.111.32.174
country_id: 1643084
description:
Dec  9 08:05:47 host2 sshd[483960]: Disconnected from invalid user castle 27.111.32.174 port 39750 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.122.86.208
country_id: 2921044
description:
Dec  9 08:06:01 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=134.122.86.208, lip=66.85.158.91, TLS handshaking: Connection closed, session=<7O3FxXtF5CeGelbQ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.111.32.174
country_id: 1643084
description:
Dec  9 08:06:22 host2 sshd[484759]: Disconnected from invalid user httpd 27.111.32.174 port 56562 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.140.219
country_id: 298795
description:
2025-12-09 08:08:03 dovecot_plain authenticator failed for (hiessby) [5.11.140.219]:46836: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 223.181.63.198
country_id: 1269750
description:
Dec  9 08:07:34 host2 sshd[486199]: Disconnected from invalid user alex 223.181.63.198 port 12069 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec  9 08:08:39 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<lbAVz3tFOt9nJFMP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.30
country_id: 3144096
description:
2025-12-09 08:08:53 dovecot_login authenticator failed for (30-170-97-62.cust.smartcall.no) [62.97.170.30]:46567: 535 Incorrect authentication data (set_id=sales@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.18
country_id: 1269750
description:
2025-12-09 08:09:07 dovecot_login authenticator failed for ([128.185.101.201]) [122.185.146.18]:40154: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.162
country_id: 6252001
description:
2025-12-09 08:09:07 dovecot_login authenticator failed for ([98.185.120.162]) [98.185.120.162]:36225: 535 Incorrect authentication data (set_id=contacto@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  9 08:08:18 host2 sshd[486978]: Disconnected from invalid user user 2.57.121.25 port 37474 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.74.12.86
country_id: 1269750
description:
2025-12-09 08:09:17 dovecot_login authenticator failed for (nsg-static-193.87.72.182.airtel.in) [182.74.12.86]:37772: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.236.29.127
country_id: 1880251
description:
Dec  9 08:09:57 host2 sshd[489107]: Disconnected from invalid user user 47.236.29.127 port 55092 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.219.49.164
country_id: 1880251
description:
Dec  9 08:17:29 host2 sshd[499391]: Disconnected from invalid user deployer 8.219.49.164 port 47402 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.70.129.101
country_id: 6252001
description:
2025-12-09 08:16:51 dovecot_login authenticator failed for (syn-097-070-129-101.res.spectrum.com) [97.70.129.101]:41397: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.163
country_id: 99237
description:
2025-12-09 08:17:10 dovecot_plain authenticator failed for (amperne) [65.20.250.163]:44485: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.248.47.114
country_id: 6252001
description:
2025-12-09 08:17:14 dovecot_login authenticator failed for (syn-172-248-047-114.res.spectrum.com) [172.248.47.114]:35899: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.219.81.129
country_id: 1880251
description:
Dec  9 08:17:38 host2 sshd[499566]: Disconnected from invalid user vps 8.219.81.129 port 55434 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.236.43.54
country_id: 1880251
description:
Dec  9 08:17:42 host2 sshd[499635]: Disconnected from invalid user oracle 47.236.43.54 port 50896 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 147.182.173.108
country_id: 6252001
description:
Dec  9 08:18:02 host2 sshd[500371]: Disconnected from invalid user user0 147.182.173.108 port 38494 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.35.156
country_id: 6252001
description:
Dec  9 08:18:05 host2 sshd[500438]: Disconnected from invalid user deployer 209.141.35.156 port 16342 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.219.49.164
country_id: 1880251
description:
Dec  9 08:18:11 host2 sshd[500555]: Disconnected from invalid user debian 8.219.49.164 port 37922 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.30.179
country_id: 6252001
description:
Dec  9 08:18:14 host2 sshd[500627]: Disconnected from invalid user deployer 137.184.30.179 port 60864 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 147.182.173.108
country_id: 6252001
description:
Dec  9 08:17:31 host2 sshd[499444]: Disconnected from invalid user test 147.182.173.108 port 42962 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 149.102.135.204
country_id: 2635167
description:
Dec  9 08:17:55 host2 sshd[500157]: Disconnected from invalid user deploy 149.102.135.204 port 48624 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec  9 08:18:59 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<iNfl83tF+OuPbvgo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.179
country_id: 1733045
description:
2025-12-09 08:19:30 dovecot_login authenticator failed for ([49.124.159.179]) [49.124.159.179]:48970: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.213.215.66
country_id: 1605651
description:
Dec  9 08:19:05 host2 sshd[501571]: Disconnected from invalid user andy 8.213.215.66 port 44662 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.219.49.164
country_id: 1880251
description:
Dec  9 08:18:50 host2 sshd[501244]: Disconnected from invalid user test123 8.219.49.164 port 60630 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
country_id: 99237
description:
2025-12-09 08:19:03 dovecot_login authenticator failed for ([65.20.191.12]) [65.20.191.12]:42011: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 137.184.30.179
country_id: 6252001
description:
Dec  9 08:19:16 host2 sshd[501844]: Disconnected from invalid user andy 137.184.30.179 port 49184 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.30.179
country_id: 6252001
description:
Dec  9 08:18:43 host2 sshd[501102]: Disconnected from invalid user test 137.184.30.179 port 36774 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.228.234
country_id: 1269750
description:
2025-12-09 08:19:24 dovecot_login authenticator failed for (nsg-static-234.228.76.182-airtel.com) [182.76.228.234]:53750: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 149.102.135.204
country_id: 2635167
description:
Dec  9 08:19:22 host2 sshd[501957]: Disconnected from invalid user admin 149.102.135.204 port 60688 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.42.225.40
country_id: 2510769
description:
2025-12-09 08:19:22 dovecot_login authenticator failed for 40.red-81-42-225.staticip.rima-tde.net [81.42.225.40]:51142: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 149.102.135.204
country_id: 2635167
description:
Dec  9 08:20:05 host2 sshd[502983]: Disconnected from invalid user deployer 149.102.135.204 port 53144 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.128.151.92
country_id: 6252001
description:
2025-12-09 08:19:35 dovecot_login authenticator failed for c-73-128-151-92.hsd1.de.comcast.net [73.128.151.92]:52322: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.237.115.138
country_id: 1880251
description:
Dec  9 08:19:37 host2 sshd[502286]: Disconnected from invalid user test123 47.237.115.138 port 55558 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.107.238
country_id: 1831722
description:
2025-12-09 08:19:40 dovecot_login authenticator failed for (dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:43680: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.30.179
country_id: 6252001
description:
Dec  9 08:20:13 host2 sshd[503188]: Disconnected from invalid user deploy 137.184.30.179 port 43796 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.200.166
country_id: 149590
description:
2025-12-09 08:19:35 dovecot_login authenticator failed for (166.200-59-41.ttcl.co.tz) [41.59.200.166]:49437: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.191.118
country_id: 3144096
description:
2025-12-09 08:19:49 dovecot_login authenticator failed for (cm-178.232.191.118.get.no) [178.232.191.118]:59313: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.139.77
country_id: 3144096
description:
2025-12-09 08:19:55 dovecot_login authenticator failed for ([188.124.139.77]) [188.124.139.77]:52752: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.83.206.11
country_id: 1819730
description:
Dec  9 08:20:30 host2 sshd[503572]: Disconnected from invalid user user0 47.83.206.11 port 49854 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.198.176.28
country_id: 130758
description:
Dec  9 08:19:44 host2 sshd[502392]: Disconnected from invalid user tableau 5.198.176.28 port 36870 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.213.215.66
country_id: 1605651
description:
Dec  9 08:20:00 host2 sshd[502743]: Disconnected from invalid user deploy 8.213.215.66 port 44762 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Dec  9 08:20:46 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@essenceceylontea.com>, method=PLAIN, rip=167.71.230.230, lip=66.85.158.91, session=<pGVd+ntFKtOnR+bm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.101.85.160
country_id: 6252001
description:
2025-12-09 08:21:07 dovecot_plain authenticator failed for ([89.116.164.85]) [174.101.85.160]:43634: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.92.22.20
country_id: 3625428
description:
2025-12-09 08:21:19 dovecot_plain authenticator failed for ([89.116.164.85]) [38.92.22.20]:48988: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.156.24.229
country_id: 3996063
description:
2025-12-09 08:21:30 dovecot_plain authenticator failed for ([89.116.164.85]) [189.156.24.229]:49325: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.205.208
country_id: 1643084
description:
Dec  9 08:21:31 host2 sshd[504678]: Disconnected from invalid user test 103.172.205.208 port 60434 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.219.49.164
country_id: 1880251
description:
Dec  9 08:20:40 host2 sshd[503734]: Disconnected from invalid user st 8.219.49.164 port 32836 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 87.121.82.86
country_id: 660013
description:
Dec  9 08:20:55 host2 sshd[504076]: Disconnected from invalid user admin 87.121.82.86 port 52554 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 08:20:35 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<W5e++XtFmMaKxX03>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 149.102.135.204
country_id: 2635167
description:
Dec  9 08:21:32 host2 sshd[504693]: Disconnected from invalid user test 149.102.135.204 port 39964 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.156.24.229
country_id: 3996063
description:
2025-12-09 08:21:36 dovecot_login authenticator failed for ([89.116.164.85]) [189.156.24.229]:49325: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.213.215.66
country_id: 1605651
description:
Dec  9 08:22:13 host2 sshd[505358]: Disconnected from invalid user vps 8.213.215.66 port 52384 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  9 08:23:07 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<LCfJAnxFlry8putr>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 5.198.176.28
country_id: 130758
description:
Dec  9 08:23:16 host2 sshd[506692]: Disconnected from invalid user ts3server 5.198.176.28 port 37180 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 08:23:31 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<tGQ8BHxFesuKxX03>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.83.206.11
country_id: 1819730
description:
Dec  9 08:23:02 host2 sshd[506303]: Disconnected from invalid user test 47.83.206.11 port 50168 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.150.8.174
country_id: 1522867
description:
2025-12-09 08:24:15 dovecot_plain authenticator failed for 37.150.8.174.dynamic.telecom.kz (dishia) [37.150.8.174]:46212: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.236.29.127
country_id: 1880251
description:
Dec  9 08:24:16 host2 sshd[507873]: Disconnected from invalid user danya 47.236.29.127 port 54328 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.83.206.11
country_id: 1819730
description:
Dec  9 08:24:20 host2 sshd[507935]: Disconnected from invalid user httpd 47.83.206.11 port 45410 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.145.104
country_id: 1643084
description:
Dec  9 08:24:25 host2 sshd[507986]: Disconnected from invalid user mhd 103.217.145.104 port 55394 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.219.81.129
country_id: 1880251
description:
Dec  9 08:24:28 host2 sshd[508054]: Disconnected from invalid user admin 8.219.81.129 port 36462 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.44.40
country_id: 1522867
description:
2025-12-09 08:24:09 dovecot_plain authenticator failed for (unsit) [5.76.44.40]:45302: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.213.215.66
country_id: 1605651
description:
Dec  9 08:25:13 host2 sshd[509036]: Disconnected from invalid user admin 8.213.215.66 port 44740 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.196.233
country_id: 3996063
description:
2025-12-09 08:25:16 dovecot_login authenticator failed for ([201.173.196.233]) [201.173.196.233]:46447: 535 Incorrect authentication data (set_id=contact@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.219.81.129
country_id: 1880251
description:
Dec  9 08:26:29 host2 sshd[510549]: Disconnected from invalid user suporte 8.219.81.129 port 54166 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-09 08:26:48 dovecot_plain authenticator failed for (probly) [64.72.74.162]:59821: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 8.219.81.129
country_id: 1880251
description:
Dec  9 08:27:27 host2 sshd[511710]: Disconnected from invalid user ubuntu 8.219.81.129 port 50756 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.135.232.92
country_id: 2017370
description:
Dec  9 08:30:26 host2 sshd[515868]: Connection reset by invalid user user 45.135.232.92 port 20502 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.169.82.194
country_id: 935317
description:
2025-12-09 08:31:20 dovecot_login authenticator failed for (165-169-82-194.zeop.re) [165.169.82.194]:40246: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.162.102
country_id: 1269750
description:
2025-12-09 08:30:57 dovecot_login authenticator failed for ([125.19.162.102]) [125.19.162.102]:49326: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.247.230.132
country_id: 2264397
description:
2025-12-09 08:31:46 dovecot_login authenticator failed for bl14-230-132.dsl.telepac.pt [85.247.230.132]:60740: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  9 08:34:02 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<HmHXKXxFqIIv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.25.23
country_id: 798544
description:
Dec  9 08:34:27 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 15 secs): user=<info@v-deploy.com>, method=PLAIN, rip=178.216.25.23, lip=66.85.158.91, TLS, session=<60+IKnxFAYWy2BkX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.92
country_id: 3175395
description:
Dec  9 08:34:45 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.15.171.92, lip=66.85.158.91, TLS, session=<kaOLK3xFpKG5D6tc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-12-09 08:36:11 dovecot_login authenticator failed for ([102.53.15.17]) [102.53.15.17]:45644: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 08:36:09 +0530] info [cpaneld] 213.209.143.251 - agronatu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronatu (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.239
country_id: 6252001
description:
Dec  9 08:36:20 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.239, lip=66.85.158.92, session=<drIyMnxFVOvN0h/v>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.140.250
country_id: 3469034
description:
2025-12-09 08:36:33 dovecot_login authenticator failed for ([181.233.140.250]) [181.233.140.250]:46399: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.165
country_id: 2993457
description:
Dec  9 08:36:52 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.165, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<MFYbNHxFjv/CpRCl>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 08:39:13 +0530] info [cpaneld] 213.209.143.251 - ajsstarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstarl (has_cpuser_file failed)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 213.209.143.251
country_id: 2921044
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[cpaneld] [Local IP Address]=[66.85.158.91] [Local Port]=[2083] [Remote IP Address]=[213.209.143.251] [Remote Port]=[33342] [Authentication Database]=[system] [Username]=[ajsstarl] (10/10 failures) (blocked until [Wed Dec 10 03:09:13 2025 UTC/Wed Dec 10 08:39:13 2025 LOCAL])


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.178.229.193
country_id: 1880251
description:
Dec  9 08:40:11 host2 sshd[527707]: Disconnected from invalid user tableau 158.178.229.193 port 52638 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec  9 08:42:10 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<yOnlRnxFNKxnJFMP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.128.112.204
country_id: 3017382
description:
2025-12-09 08:42:53 dovecot_login authenticator failed for 217-128-112-204.ftth.fr.orangecustomers.net [217.128.112.204]:53012: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.168.140.35
country_id: 3469034
description:
2025-12-09 08:43:11 dovecot_login authenticator failed for ([45.168.140.35]) [45.168.140.35]:45111: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2025-12-09 08:44:13 dovecot_plain authenticator failed for c-73-197-194-98.hsd1.nj.comcast.net (picantra) [73.197.194.98]:59518: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.102
country_id: 1269750
description:
2025-12-09 08:46:08 dovecot_login authenticator failed for ([27.123.119.99]) [182.95.224.102]:41138: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.116.165
country_id: 3144096
description:
2025-12-09 08:46:29 dovecot_login authenticator failed for (cm-178.232.116.165.get.no) [178.232.116.165]:54615: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.178.229.193
country_id: 1880251
description:
Dec  9 08:45:33 host2 sshd[535203]: Disconnected from invalid user st 158.178.229.193 port 38048 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.23.219.225
country_id: 6252001
description:
Dec  9 08:47:20 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=64.23.219.225, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<gp2AWXxFbstAF9vh>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 158.178.229.193
country_id: 1880251
description:
Dec  9 08:46:50 host2 sshd[538439]: Disconnected from invalid user test123 158.178.229.193 port 42064 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.178.229.193
country_id: 1880251
description:
Dec  9 08:48:07 host2 sshd[540765]: Disconnected from invalid user dev 158.178.229.193 port 35152 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.144.208.229
country_id: 2782113
description:
Dec  9 08:49:04 host2 sshd[541942]: Disconnected from invalid user centos 89.144.208.229 port 34657 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.178.229.193
country_id: 1880251
description:
Dec  9 08:49:22 host2 sshd[542333]: Disconnected from invalid user user0 158.178.229.193 port 55826 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.86.175.49
country_id: 1819730
description:
Dec  9 08:49:32 host2 sshd[542573]: Disconnected from invalid user ubuntu 47.86.175.49 port 57546 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.231.101
country_id: 1880251
description:
Dec  9 08:50:30 host2 sshd[544578]: Disconnected from invalid user ftpadmin1 152.42.231.101 port 44370 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.226
country_id: 3017382
description:
Dec  9 08:51:07 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=91.231.89.226, lip=66.85.158.92, TLS handshaking: Connection closed, session=<e3AHZ3xFD5Nb51ni>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.231
country_id: 3017382
description:
Dec  9 08:51:17 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.231.89.231, lip=66.85.158.92, TLS: Connection closed, session=<0DSoZ3xFl6Jb51nn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.236.43.76
country_id: 1880251
description:
Dec  9 08:51:20 host2 sshd[545718]: Disconnected from invalid user debian 47.236.43.76 port 46392 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.86.175.49
country_id: 1819730
description:
Dec  9 08:51:29 host2 sshd[545954]: Disconnected from invalid user ubuntu 47.86.175.49 port 34732 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.224
country_id: 3017382
description:
Dec  9 08:51:33 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.231.89.224, lip=66.85.158.92, TLS: Connection closed, session=<MQmdaHxFjdpb51ng>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.145.34.173
country_id: 1643084
description:
Dec  9 08:52:53 host2 sshd[547370]: Disconnected from invalid user debian 203.145.34.173 port 43240 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 47.86.175.49
country_id: 1819730
description:
Dec  9 08:52:48 host2 sshd[547315]: Disconnected from invalid user httpd 47.86.175.49 port 34046 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.236.43.76
country_id: 1880251
description:
Dec  9 08:54:03 host2 sshd[548624]: Disconnected from invalid user alice 47.236.43.76 port 38322 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.86.175.49
country_id: 1819730
description:
Dec  9 08:54:05 host2 sshd[548704]: Disconnected from invalid user puneet 47.86.175.49 port 33352 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.144.208.229
country_id: 2782113
description:
Dec  9 08:53:44 host2 sshd[548247]: Disconnected from invalid user testuser 89.144.208.229 port 35716 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec  9 08:55:10 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@bostonlanka.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<9P5rdXxFPYd100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.236.43.76
country_id: 1880251
description:
Dec  9 08:55:31 host2 sshd[550820]: Disconnected from invalid user cinema 47.236.43.76 port 40500 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.231.101
country_id: 1880251
description:
Dec  9 08:54:32 host2 sshd[549449]: Disconnected from invalid user admin1234 152.42.231.101 port 55674 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.57.124.197
country_id: 3175395
description:
Dec  9 08:54:36 host2 sshd[549522]: Disconnected from invalid user julian 151.57.124.197 port 18533 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.5.145.102
country_id: 2464461
description:
Dec  9 08:54:39 host2 sshd[549583]: Disconnected from invalid user kyt 197.5.145.102 port 55564 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.145.34.173
country_id: 1643084
description:
Dec  9 08:58:47 host2 sshd[555236]: Disconnected from invalid user kkk 203.145.34.173 port 49200 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.5.145.102
country_id: 2464461
description:
Dec  9 09:00:19 host2 sshd[557745]: Disconnected from invalid user ubuntu 197.5.145.102 port 55577 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.234.135
country_id: 458258
description:
Dec  9 09:00:52 host2 sshd[558248]: Disconnected from invalid user rahul 62.60.234.135 port 45936 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.48.214.242
country_id: 1733045
description:
2025-12-09 09:01:36 dovecot_plain authenticator failed for (56QUULLY) [60.48.214.242]:64815: 535 Incorrect authentication data (set_id=chitral100@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.48.214.242
country_id: 1733045
description:
2025-12-09 09:01:42 dovecot_login authenticator failed for (56QUULLY) [60.48.214.242]:64815: 535 Incorrect authentication data (set_id=chitral100@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.255.171
country_id: 6252001
description:
2025-12-09 09:01:49 dovecot_plain authenticator failed for (inglocises) [50.217.255.171]:60647: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec  9 09:01:49 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<tWk0jXxFvqx100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.231.101
country_id: 1880251
description:
Dec  9 09:03:07 host2 sshd[561136]: Disconnected from invalid user httpd 152.42.231.101 port 47086 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.57.124.197
country_id: 3175395
description:
Dec  9 09:02:54 host2 sshd[560766]: Disconnected from invalid user ubuntu 151.57.124.197 port 18769 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.234.135
country_id: 458258
description:
Dec  9 09:03:42 host2 sshd[562340]: Disconnected from invalid user kafka 62.60.234.135 port 59020 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.42.231.101
country_id: 1880251
description:
Dec  9 09:03:44 host2 sshd[562374]: Disconnected from invalid user jenkins 152.42.231.101 port 44378 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.234.135
country_id: 458258
description:
Dec  9 09:05:34 host2 sshd[564923]: Disconnected from invalid user httpd 62.60.234.135 port 39576 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.197.41
country_id: 1861060
description:
Dec  9 09:06:09 host2 sshd[565588]: Disconnected from invalid user mcserver 160.251.197.41 port 34252 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.57.124.197
country_id: 3175395
description:
Dec  9 09:07:29 host2 sshd[567223]: Disconnected from invalid user ian 151.57.124.197 port 18066 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  9 09:07:55 host2 sshd[567451]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 160.251.197.41
country_id: 1861060
description:
Dec  9 09:08:02 host2 sshd[567890]: Disconnected from invalid user kyt 160.251.197.41 port 41768 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  9 09:07:52 host2 sshd[566088]: Connection reset by invalid user admin 2.57.121.112 port 24323 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.175.251
country_id: 6252001
description:
Dec  9 09:09:31 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=40.124.175.251, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<x6faqHxF+r0ofK/7>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.13
country_id: 2635167
description:
Dec  9 09:08:43 host2 dovecot[2208013]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.13, lip=66.85.158.92, TLS, session=<VJf9pXxFKbxX7LAN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.203
country_id: 2635167
description:
Dec  9 09:08:44 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.203, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<9tEKpnxFdctX7LDL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.184
country_id: 2635167
description:
Dec  9 09:09:17 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.184, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<qhoGqHxF5YZX7LC4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.57.124.197
country_id: 3175395
description:
Dec  9 09:09:28 host2 sshd[569427]: Disconnected from invalid user user 151.57.124.197 port 18036 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.195
country_id: 2635167
description:
Dec  9 09:09:50 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.195, lip=66.85.158.92, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<onwBqnxFs6tX7LDD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.241.30
country_id: 1269750
description:
2025-12-09 09:10:13 dovecot_login authenticator failed for ([182.78.241.30]) [182.78.241.30]:47126: 535 Incorrect authentication data (set_id=contacto@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.51.135
country_id: 3144096
description:
2025-12-09 09:10:12 dovecot_login authenticator failed for (cm-178.232.51.135.get.no) [178.232.51.135]:57349: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.38
country_id: 1269750
description:
2025-12-09 09:10:25 dovecot_login authenticator failed for (nsg-corporate-38.230.187.122.airtel.in) [122.187.230.38]:43191: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.186
country_id: 2635167
description:
Dec  9 09:10:23 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.186, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<TtP8q3xFBcdX7LC6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.97.111
country_id: 3996063
description:
2025-12-09 09:10:25 dovecot_login authenticator failed for (201.173.97.111-clientes-izzi.mx) [201.173.97.111]:33664: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 09:11:01 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@sobaherbal.com>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<PWkcrnxFSqSqQMFo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.196
country_id: 2635167
description:
Dec  9 09:11:30 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.196, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<oZTxr3xFjbJX7LDE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.203
country_id: 2635167
description:
Dec  9 09:10:57 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.203, lip=66.85.158.92, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<hhH4rXxFI7G594nL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.198
country_id: 2635167
description:
Dec  9 09:12:03 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.198, lip=66.85.158.92, TLS handshaking: Connection closed, session=<NvPusXxFQ6hX7LDG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.189
country_id: 2635167
description:
Dec  9 09:12:37 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.189, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<L1Tqs3xF5cu594m9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2025-12-09 09:13:13 dovecot_plain authenticator failed for c-24-1-200-187.hsd1.il.comcast.net (osity) [24.1.200.187]:56208: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.213
country_id: 2635167
description:
Dec  9 09:13:43 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.213, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<Wv7et3xFm9FX7LDV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-12-09 09:15:20 dovecot_login authenticator failed for (made-again.tmesis.com) [24.187.213.29]:41798: 535 Incorrect authentication data (set_id=admin@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.158
country_id: 1269750
description:
2025-12-09 09:15:34 dovecot_login authenticator failed for ([182.95.178.158]) [182.95.178.158]:44222: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.194.43
country_id: 6252001
description:
Dec  9 09:16:18 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.65.194.43, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<YWcdwXxFfsMUQcIr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 09:16:37 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<GUsfwnxFgouKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec  9 09:17:17 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<paCBxHxFCNtnJFMP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2025-12-09 09:17:40 dovecot_plain authenticator failed for c-73-137-7-97.hsd1.ga.comcast.net (hancerchae) [73.137.7.97]:55392: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Dec  9 09:19:00 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@essenceceylontea.com>, method=PLAIN, rip=167.71.230.230, lip=66.85.158.91, session=<X+qmynxFtoynR+bm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  9 09:18:49 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@kiriaswanu.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<rzH7yXxFCqa8putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 09:19:38 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@rehanseo.online>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<a2npzHxFyJKKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.220.56.98
country_id: 6252001
description:
Dec  9 09:21:16 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=31.220.56.98, lip=66.85.158.91, session=<vI+80nxFHIsf3Dhi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec  9 09:24:02 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<iRyi3HxFlsePbvgo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
country_id: 290557
description:
2025-12-09 09:24:37 dovecot_plain authenticator failed for (manninded) [94.206.93.90]:57331: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.1.40.151
country_id: 6251999
description:
2025-12-09 09:25:44 dovecot_login authenticator failed for 96-1-40-151-staticipeast.wireless.telus.com [96.1.40.151]:41669: 535 Incorrect authentication data (set_id=office@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.40
country_id: 1733045
description:
2025-12-09 09:26:05 dovecot_login authenticator failed for ([49.124.153.40]) [49.124.153.40]:39720: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.80.9
country_id: 3144096
description:
2025-12-09 09:26:19 dovecot_login authenticator failed for ([178.232.80.9]) [178.232.80.9]:38272: 535 Incorrect authentication data (set_id=test@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.12.86.90
country_id: 1269750
description:
2025-12-09 09:26:32 dovecot_login authenticator failed for (mail.tataidc.com) [61.12.86.90]:41458: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 09:30:09 +0530] info [cpaneld] 213.209.143.251 - 2strav "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.239.11.219
country_id: 617790
description:
Dec  9 09:30:27 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=91.239.11.219, lip=66.85.158.91, TLS, session=<kSfG8nxF0gtb7wvb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.237.57.100
country_id: 1269750
description:
Dec  9 09:30:48 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts>, method=PLAIN, rip=103.237.57.100, lip=66.85.158.91, TLS, session=<9Orh83xFQdZn7Tlk>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 47.80.7.97
country_id: 1835841
description:
Dec  9 09:31:37 host2 sshd[601973]: Disconnected from invalid user httpd 47.80.7.97 port 34664 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.140.17.124
country_id: 2017370
description:
Dec  9 09:31:51 host2 sshd[602265]: Connection reset by invalid user telecomadmin 45.140.17.124 port 60752 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  9 09:33:02 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<qkXW/HxFqocv/lVz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.180.141.2
country_id: 2264397
description:
Dec  9 09:33:10 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_read failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=185.180.141.2, lip=66.85.158.91, TLS: SSL_read failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<ArZy/XxFoOC5tI0C>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.180.141.3
country_id: 2264397
description:
Dec  9 09:33:10 host2 dovecot[2208013]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=185.180.141.3, lip=66.85.158.91, session=<9/Vv/XxFUem5tI0D>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.180.141.4
country_id: 2264397
description:
Dec  9 09:33:10 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.180.141.4, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<NC13/XxF6dS5tI0E>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.180.141.3
country_id: 2264397
description:
Dec  9 09:33:12 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.180.141.3, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher, session=<4o2I/XxFHea5tI0D>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  9 09:33:59 host2 sshd[606827]: Disconnected from invalid user user 2.57.121.25 port 39357 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.21
country_id: 337996
description:
2025-12-09 09:34:29 dovecot_login authenticator failed for ([196.188.187.21]) [196.188.187.21]:55378: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.253.154
country_id: 1269750
description:
2025-12-09 09:34:42 dovecot_login authenticator failed for ([125.21.56.137]) [125.19.253.154]:50080: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.135.117.245
country_id: 6252001
description:
2025-12-09 09:37:42 dovecot_login authenticator failed for 107-135-117-245.lightspeed.livnmi.sbcglobal.net [107.135.117.245]:7413: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.65.203.86
country_id: 6252001
description:
2025-12-09 09:37:58 dovecot_login authenticator failed for ([63.65.203.86]) [63.65.203.86]:50379: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 99.46.239.237
country_id: 6252001
description:
2025-12-09 09:38:10 dovecot_plain authenticator failed for 99-46-239-237.lightspeed.stlsmo.sbcglobal.net ([89.116.164.85]) [99.46.239.237]:53712: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.220.20.35
country_id: 3865483
description:
2025-12-09 09:38:22 dovecot_plain authenticator failed for ([89.116.164.85]) [201.220.20.35]:33355: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.48.168.78
country_id: 1733045
description:
2025-12-09 09:38:36 dovecot_plain authenticator failed for ([89.116.164.85]) [60.48.168.78]:19541: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.48.168.78
country_id: 1733045
description:
2025-12-09 09:38:43 dovecot_login authenticator failed for ([89.116.164.85]) [60.48.168.78]:19541: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.44.115
country_id: 2300660
description:
Dec  9 09:40:04 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=41.139.44.115, lip=66.85.158.91, TLS, session=<Xq8AFX1Fm5spiyxz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.8.202
country_id: 3175395
description:
Dec  9 09:40:21 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.197.8.202, lip=66.85.158.91, TLS, session=<gbMpFn1FSsS5xQjK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.123
country_id: 6252001
description:
Dec  9 09:41:38 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.123, lip=66.85.158.92, TLS: Connection closed, session=<Y4GzG31F7ApChJl7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.27.33.174
country_id: 6252001
description:
2025-12-09 09:43:59 dovecot_plain authenticator failed for c-73-27-33-174.hsd1.fl.comcast.net (insucked) [73.27.33.174]:59458: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  9 09:49:42 host2 sshd[633530]: Disconnected from invalid user user 2.57.121.25 port 38615 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec  9 09:51:43 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<jz2mP31F2NRnJFMP>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 09:51:54 +0530] info [cpaneld] 213.209.143.251 - agrona "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agrona (has_cpuser_file failed)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.242.226.17
country_id: 6252001
description:
Dec  9 09:53:06 host2 dovecot[2208013]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=185.242.226.17, lip=66.85.158.92, session=<Au+3RH1Fko258uIR>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 09:55:22 +0530] info [cpaneld] 213.209.143.251 - ajssta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajssta (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  9 09:56:13 host2 sshd[641612]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.149
country_id: 3996063
description:
2025-12-09 09:56:19 dovecot_login authenticator failed for ([177.236.146.149]) [177.236.146.149]:37909: 535 Incorrect authentication data (set_id=sales@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.144.34
country_id: 1269750
description:
2025-12-09 09:56:31 dovecot_login authenticator failed for ([182.78.144.34]) [182.78.144.34]:51868: 535 Incorrect authentication data (set_id=postmaster@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.10
country_id: 1269750
description:
2025-12-09 09:56:34 dovecot_login authenticator failed for ([128.185.241.106]) [182.95.54.10]:33538: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  9 09:57:36 host2 sshd[642918]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.46
country_id: 1036973
description:
2025-12-09 09:56:41 dovecot_login authenticator failed for (dynamic-adsl.movitel.co.mz) [197.219.210.46]:59184: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 09:57:19 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<E1GtU31FnpiqQMFo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.100.197
country_id: 1269750
description:
2025-12-09 09:59:04 dovecot_plain authenticator failed for (Z69Q27X) [49.37.100.197]:50154: 535 Incorrect authentication data (set_id=chitral100@bostonlanka.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.242.226.17
country_id: 6252001
description:
Dec  9 10:01:23 host2 dovecot[2208013]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=185.242.226.17, lip=66.85.158.91, session=<eSteYn1FiKG58uIR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2025-12-09 10:02:15 dovecot_plain authenticator failed for c-73-208-81-125.hsd1.in.comcast.net (ortrid) [73.208.81.125]:40842: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  9 10:04:30 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<Ow5gbX1FsKwv/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec  9 10:05:33 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 11 secs): user=<hr@dataesite.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<x1iWcH1FzaN100Db>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.185.18
country_id: 6252001
description:
Dec  9 10:07:07 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=44.220.185.18, lip=66.85.158.91, TLS handshaking: Connection closed, session=<SdnYdn1Fzrgs3LkS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2025-12-09 10:08:57 dovecot_plain authenticator failed for (coffeshnis) [65.20.129.28]:45598: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2025-12-09 10:10:28 dovecot_plain authenticator failed for c-98-227-25-115.hsd1.il.comcast.net (soplite) [98.227.25.115]:46186: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 10:11:43 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<V04oh31FGJCqQMFo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.188.103
country_id: 6252001
description:
Dec  9 10:13:50 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=44.220.188.103, lip=66.85.158.91, TLS handshaking: Connection closed, session=<2N7djn1FcIcs3Lxn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 10:14:26 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<AADmkH1FNLiKxX03>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  9 10:15:11 host2 dovecot[2208013]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<2jGvk31FQLwDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  9 10:15:13 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<alesk31FTru8putr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.119
country_id: 1269750
description:
2025-12-09 10:15:24 dovecot_login authenticator failed for (nsg-corporate-119.229.187.122.airtel.in) [122.187.229.119]:38411: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  9 10:17:01 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<gPQlmn1FbssXXz9j>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  9 10:17:18 host2 dovecot[2208013]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<aXVJm31FbOEDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 10:17:29 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@rehanseo.online>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<CefOm31FUsSKxX03>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  9 10:17:44 host2 dovecot[2208013]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<55vPnH1FyKMDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec  9 10:19:02 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<sydeoX1FJp6Pbvgo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.74
country_id: 1269750
description:
2025-12-09 10:19:09 dovecot_login authenticator failed for ([152.52.206.188]) [152.52.192.74]:48720: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  9 10:19:25 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<7Zveon1FgqkDjyE/>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  9 10:19:27 host2 dovecot[2208013]: imap-login: Disconnected: Input buffer full (no auth attempts in 1 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<BIfuon1FkKkDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.140.18.186
country_id: 1269750
description:
2025-12-09 10:19:40 dovecot_login authenticator failed for ([103.140.18.186]) [103.140.18.186]:59614: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  9 10:19:49 host2 dovecot[2208013]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<AKZMpH1FAJ4DjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  9 10:21:37 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<wQy8qn1FAq0DjyE/>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  9 10:21:39 host2 dovecot[2208013]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<Cn3Nqn1FDq0DjyE/>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.245.60.230
country_id: 1880251
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 157.245.60.230 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2025-12-09 10:23:46 dovecot_plain authenticator failed for (celed) [65.20.160.107]:34024: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.119
country_id: 3175395
description:
Dec  9 10:24:06 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=185.15.171.119, lip=66.85.158.91, TLS, session=<xf2Ksn1FAdC5D6t3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.104.197
country_id: 3469034
description:
Dec  9 10:24:27 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt>, method=PLAIN, rip=187.120.104.197, lip=66.85.158.91, TLS, session=<0sa2s31FS467eGjF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec  9 10:26:03 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@dataesite.lk>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<y+90un1FPsxnJFMP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.193
country_id: 2635167
description:
Dec  9 10:27:31 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 45 secs): user=<>, rip=35.203.211.193, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<QJ3Uv31FI9Yjy9PB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.193
country_id: 2635167
description:
Dec  9 10:28:02 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 12 secs): user=<>, rip=35.203.211.193, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<g2WowX1FfPIjy9PB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.193
country_id: 2635167
description:
Dec  9 10:28:42 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=35.203.211.193, lip=66.85.158.91, TLS: read(size=429) failed: Connection reset by peer, session=</UMHxH1FKvcjy9PB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.201.253
country_id: 1269750
description:
2025-12-09 10:34:15 dovecot_login authenticator failed for (49.206.201.253.actcorp.in) [49.206.201.253]:39056: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.124
country_id: 6252001
description:
Dec  9 10:34:20 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.124, lip=66.85.158.91, TLS handshaking: Connection closed, session=<frAu2H1FVOZChJl8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.21
country_id: 6252001
description:
2025-12-09 10:34:31 dovecot_login authenticator failed for ([98.185.120.21]) [98.185.120.21]:39839: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2025-12-09 10:33:47 dovecot_plain authenticator failed for 217-215-74-195-no2620.tbcn.telia.com (bruggly) [217.215.74.195]:59747: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.193
country_id: 2635167
description:
Dec  9 10:36:32 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.193, lip=66.85.158.91, TLS, session=<uXwV4H1Fpukjy9PB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.193
country_id: 2635167
description:
Dec  9 10:37:17 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.193, lip=66.85.158.91, TLS, session=<NTa74n1FTuAjy9PB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-09 10:38:48 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:62593: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Dec  9 10:39:16 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.92, TLS: Connection closed, session=<a33U6X1FWIOLonQW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.196
country_id: 3996063
description:
2025-12-09 10:39:47 dovecot_login authenticator failed for (201.173.216.196-clientes-izzi.mx) [201.173.216.196]:51896: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.255.189.39
country_id: 298795
description:
2025-12-09 10:40:02 dovecot_login authenticator failed for (88.255.189.39.static.ttnet.com.tr) [88.255.189.39]:34667: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  9 10:40:28 host2 sshd[687329]: Disconnected from invalid user admin 2.57.121.112 port 34258 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.115
country_id: 2635167
description:
Dec  9 10:44:48 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=35.203.211.115, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<2A2h/X1FOs8jy9Nz>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 10:47:19 +0530] info [cpaneld] 213.209.143.251 - 2str "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.83.181.181
country_id: 6252001
description:
2025-12-09 10:48:35 dovecot_plain authenticator failed for c-68-83-181-181.hsd1.pa.comcast.net (rampod) [68.83.181.181]:49998: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.115
country_id: 2635167
description:
Dec  9 10:51:15 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.115, lip=66.85.158.92, TLS, session=<tCqzFH5FPvIjy9Nz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.80.79
country_id: 1512440
description:
2025-12-09 10:55:45 dovecot_plain authenticator failed for ([89.116.164.85]) [84.54.80.79]:36639: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.87.237.1
country_id: 3865483
description:
2025-12-09 10:55:58 dovecot_plain authenticator failed for ([89.116.164.85]) [181.87.237.1]:50666: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.166.50.38
country_id: 3865483
description:
2025-12-09 10:56:11 dovecot_plain authenticator failed for ([89.116.164.85]) [181.166.50.38]:44829: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  9 10:56:13 host2 sshd[702415]: Connection reset by invalid user user 2.57.121.25 port 41180 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 10:56:26 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<alAUJ35FmsSqQMFo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.179
country_id: 6252001
description:
2025-12-09 10:58:39 dovecot_plain authenticator failed for (disese) [192.81.229.179]:42192: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.161.232.9
country_id: 6252001
description:
2025-12-09 10:59:25 dovecot_login authenticator failed for ip98-161-232-9.ph.ph.cox.net [98.161.232.9]:44174: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.43.109
country_id: 1819730
description:
2025-12-09 10:59:28 dovecot_login authenticator failed for 109.43.246.220.static.netvigator.com [220.246.43.109]:55639: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2025-12-09 10:59:44 dovecot_login authenticator failed for (187-51-252-236.customer.tdatabrasil.net.br) [186.201.54.90]:47447: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.42
country_id: 1149361
description:
2025-12-09 10:59:48 dovecot_login authenticator failed for ([149.54.51.42]) [149.54.51.42]:38863: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.36.83.15
country_id: 1269750
description:
Dec  9 11:00:03 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=103.36.83.15, lip=66.85.158.91, session=<vS0FNH5FMKNnJFMP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.169.120.37
country_id: 1668284
description:
2025-12-09 11:00:10 dovecot_login authenticator failed for ([192.169.120.37]) [192.169.120.37]:38448: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.179.100.129
country_id: 3686110
description:
2025-12-09 11:00:18 dovecot_login authenticator failed for (azteca-comunicaciones.com) [186.179.100.129]:1119: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.62.239.4
country_id: 732800
description:
2025-12-09 11:02:52 dovecot_plain authenticator failed for (spiters) [149.62.239.4]:60850: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.53.7.231
country_id: 6252001
description:
2025-12-09 11:02:57 dovecot_plain authenticator failed for (elegiang) [64.53.7.231]:55612: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2025-12-09 11:03:21 dovecot_login authenticator failed for (nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:47642: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec  9 11:03:36 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 22 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<+y2FP35FwWB100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.223.176.171
country_id: 6252001
description:
2025-12-09 11:03:41 dovecot_login authenticator failed for ([50.223.176.171]) [50.223.176.171]:55876: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.174.129.232
country_id: 2542007
description:
Dec  9 11:04:17 host2 sshd[709212]: Disconnected from invalid user es 160.174.129.232 port 45848 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 160.174.129.232
country_id: 2542007
description:
Dec  9 11:04:51 host2 sshd[709484]: Disconnected from invalid user wang 160.174.129.232 port 52939 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  9 11:05:40 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<tXIgSH5FrIgv/lVz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.174.129.232
country_id: 2542007
description:
Dec  9 11:05:55 host2 sshd[710290]: Disconnected from invalid user debian 160.174.129.232 port 36153 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.147
country_id: 6252001
description:
Dec  9 11:07:06 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=199.45.154.147, lip=66.85.158.92, TLS: Connection closed, session=<jENbTX5F9MrHLZqT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.237.139.198
country_id: 1880251
description:
Dec  9 11:07:27 host2 sshd[711354]: Disconnected from invalid user web 47.237.139.198 port 42724 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2025-12-09 11:08:02 dovecot_plain authenticator failed for c-73-13-220-220.hsd1.de.comcast.net (undeusly) [73.13.220.220]:42774: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.205.117
country_id: 1880251
description:
Dec  9 11:08:28 host2 sshd[712075]: Disconnected from invalid user weblogic 45.78.205.117 port 41668 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.237.139.198
country_id: 1880251
description:
Dec  9 11:08:34 host2 sshd[712171]: Disconnected from invalid user wang 47.237.139.198 port 51516 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 11:09:18 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<b1kcVX5F+tKKxX03>


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 82.67.140.251
country_id: 3017382
description:
Dec  9 11:08:36 host2 sshd[712154]: Disconnecting authenticating user root 82.67.140.251 port 57473: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 82.67.140.251
country_id: 3017382
description:
Dec  9 11:08:36 host2 sshd[712154]: error: maximum authentication attempts exceeded for root from 82.67.140.251 port 57473 ssh2 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 82.67.140.251
country_id: 3017382
description:
Dec  9 11:08:45 host2 sshd[712287]: Disconnecting invalid user admin 82.67.140.251 port 58796: Too many authentication failures [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 11:09:02 +0530] info [cpaneld] 213.209.143.251 - agro "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agro (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec  9 11:09:45 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<W6O6Vn5F02x100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 11:10:18 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<4E6tWH5FLMWqQMFo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  9 11:10:36 host2 sshd[714146]: Disconnected from invalid user user 2.57.121.25 port 10989 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  9 11:11:01 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<WTQ+W35F+Ke8putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 11:12:13 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@rehanseo.online>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<yeOJX35FCNWKxX03>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.237.139.198
country_id: 1880251
description:
Dec  9 11:12:17 host2 sshd[715880]: Disconnected from invalid user ubuntu 47.237.139.198 port 44374 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.73.121.209
country_id: 732800
description:
2025-12-09 11:12:33 dovecot_plain authenticator failed for (numbles) [62.73.121.209]:33631: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 11:12:35 +0530] info [cpaneld] 213.209.143.251 - ajss "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajss (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.205.117
country_id: 1880251
description:
Dec  9 11:21:29 host2 sshd[725059]: Disconnected from invalid user debian 45.78.205.117 port 52912 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.127.90.34
country_id: 2440476
description:
2025-12-09 11:21:49 dovecot_login authenticator failed for ([154.127.90.34]) [154.127.90.34]:53305: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.10
country_id: 1269750
description:
2025-12-09 11:22:20 dovecot_login authenticator failed for ([128.185.241.106]) [182.95.54.10]:38874: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.116
country_id: 6252001
description:
Dec  9 11:26:32 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.116, lip=66.85.158.91, TLS: Connection closed, session=<tvvWkn5FkjdChJl0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.167
country_id: 2993457
description:
Dec  9 11:28:45 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.167, lip=66.85.158.92, session=<MAzHmn5Faf/CpRCn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.156
country_id: 3703430
description:
Dec  9 11:29:21 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=45.227.254.156, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<MbbznH5F3v4t4/6c>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.218.142.241
country_id: 1819730
description:
Dec  9 11:28:58 host2 sshd[732146]: Disconnected from invalid user test1 8.218.142.241 port 42342 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.218.142.241
country_id: 1819730
description:
Dec  9 11:30:42 host2 sshd[733687]: Disconnected from invalid user xray 8.218.142.241 port 38030 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 8.218.142.241
country_id: 1819730
description:
Dec  9 11:32:18 host2 sshd[735429]: Disconnected from invalid user peng 8.218.142.241 port 38520 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 148.206.53.155
country_id: 3996063
description:
Dec  9 11:32:33 host2 sshd[735632]: Disconnected from invalid user devops 148.206.53.155 port 60370 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.239.243.11
country_id: 1819730
description:
Dec  9 11:33:54 host2 sshd[736876]: Disconnected from invalid user ftpuser 47.239.243.11 port 44638 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.205.117
country_id: 1880251
description:
Dec  9 11:35:23 host2 sshd[738070]: Disconnected from invalid user docker 45.78.205.117 port 51458 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.122.119.47
country_id: 6252001
description:
Dec  9 11:38:01 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=134.122.119.47, lip=66.85.158.91, session=<Ox31u35FVJSGencv>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 47.239.243.11
country_id: 1819730
description:
Dec  9 11:39:30 host2 sshd[741476]: Disconnected from invalid user httpd 47.239.243.11 port 41454 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  9 11:38:55 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<GsUDv35Frugv/lVz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.239.243.11
country_id: 1819730
description:
Dec  9 11:40:38 host2 sshd[742497]: Disconnected from invalid user ivan 47.239.243.11 port 51484 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 148.206.53.155
country_id: 3996063
description:
Dec  9 11:41:26 host2 sshd[743368]: Disconnected from invalid user bit 148.206.53.155 port 45670 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 148.206.53.155
country_id: 3996063
description:
Dec  9 11:42:34 host2 sshd[744678]: Disconnected from invalid user dev 148.206.53.155 port 50958 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.239.243.11
country_id: 1819730
description:
Dec  9 11:42:52 host2 sshd[744961]: Disconnected from invalid user edu 47.239.243.11 port 35160 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-12-09 11:43:29 dovecot_plain authenticator failed for c-174-166-153-20.hsd1.nj.comcast.net (bitia) [174.166.153.20]:40902: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.171.230.200
country_id: 6252001
description:
2025-12-09 11:44:13 dovecot_plain authenticator failed for c-73-171-230-200.hsd1.fl.comcast.net (rhari) [73.171.230.200]:38982: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  9 11:44:21 host2 sshd[746651]: Disconnected from invalid user admin 2.57.121.112 port 51489 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.237.149.81
country_id: 1880251
description:
Dec  9 11:44:54 host2 sshd[747208]: Disconnected from invalid user gts 47.237.149.81 port 54140 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.54
country_id: 1819730
description:
Dec  9 11:45:31 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=45.142.154.54, lip=66.85.158.91, TLS handshaking: Connection closed, session=<XdC+1n5Frsctjpo2>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.237.149.81
country_id: 1880251
description:
Dec  9 11:47:13 host2 sshd[749918]: Disconnected from invalid user master 47.237.149.81 port 40960 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.122.119.47
country_id: 6252001
description:
Dec  9 11:48:16 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=134.122.119.47, lip=66.85.158.92, session=<oPqW4H5FEuiGencv>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  9 11:49:08 host2 sshd[751978]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 47.237.149.81
country_id: 1880251
description:
Dec  9 11:49:34 host2 sshd[752438]: Disconnected from invalid user kernel 47.237.149.81 port 57508 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  9 11:50:31 host2 sshd[753476]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.81.154.199
country_id: 1269750
description:
Dec  9 11:50:51 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@v-deploy.com>, method=PLAIN, rip=103.81.154.199, lip=66.85.158.91, TLS, session=<Yl2i6H5F+6RnUZrH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.32.47
country_id: 953987
description:
Dec  9 11:51:13 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=102.64.32.47, lip=66.85.158.91, TLS, session=<ji/86X5F/sZmQCAv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.140.219
country_id: 298795
description:
2025-12-09 11:52:08 dovecot_plain authenticator failed for (segralle) [5.11.140.219]:50860: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 11:56:12 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<iVnT/H5FooSqQMFo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.180.57.212
country_id: 1168579
description:
Dec  9 11:57:47 host2 sshd[759799]: Disconnected from invalid user ubuntu 182.180.57.212 port 41348 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2025-12-09 11:57:52 dovecot_plain authenticator failed for (natemphip) [65.20.143.159]:52097: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.73
country_id: 1880251
description:
Dec  9 11:58:05 host2 sshd[759994]: Disconnected from invalid user ubuntu 45.78.223.73 port 42964 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.16.202.187
country_id: 1269750
description:
Dec  9 11:58:46 host2 sshd[760542]: Disconnected from invalid user amir 103.16.202.187 port 23804 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.243.17.85
country_id: 1819730
description:
Dec  9 11:59:49 host2 sshd[761165]: Disconnected from invalid user web1 47.243.17.85 port 47220 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.237.149.81
country_id: 1880251
description:
Dec  9 11:59:14 host2 sshd[760830]: Disconnected from invalid user botuser 47.237.149.81 port 44360 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.37.230
country_id: 1880251
description:
Dec  9 11:59:31 host2 sshd[760973]: Disconnected from invalid user ubuntu 159.223.37.230 port 59958 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.178.214
country_id: 1643084
description:
Dec  9 12:00:28 host2 sshd[762078]: Disconnected from invalid user maha 103.193.178.214 port 56356 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 47.243.17.85
country_id: 1819730
description:
Dec  9 12:00:34 host2 sshd[762168]: Disconnected from invalid user user1 47.243.17.85 port 38294 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.180.57.212
country_id: 1168579
description:
Dec  9 12:00:36 host2 sshd[762158]: Disconnected from invalid user app 182.180.57.212 port 53964 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.37.230
country_id: 1880251
description:
Dec  9 12:01:10 host2 sshd[762628]: Disconnected from invalid user vector 159.223.37.230 port 56250 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.16.202.187
country_id: 1269750
description:
Dec  9 12:01:12 host2 sshd[762646]: Disconnected from invalid user testuser 103.16.202.187 port 16822 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.16.202.187
country_id: 1269750
description:
Dec  9 12:02:39 host2 sshd[763931]: Disconnected from invalid user web1 103.16.202.187 port 50808 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.243.17.85
country_id: 1819730
description:
Dec  9 12:02:40 host2 sshd[763942]: Disconnected from invalid user amir 47.243.17.85 port 42716 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.203.0
country_id: 1880251
description:
Dec  9 12:02:43 host2 sshd[763996]: Disconnected from invalid user iptv 152.42.203.0 port 45582 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.70.26
country_id: 294640
description:
2025-12-09 12:02:12 dovecot_login authenticator failed for ([2.55.70.26]) [2.55.70.26]:37408: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.28.151.87
country_id: 1694008
description:
2025-12-09 12:02:21 dovecot_login authenticator failed for ([120.28.151.87]) [120.28.151.87]:57356: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.72.102.106
country_id: 1269750
description:
2025-12-09 12:02:26 dovecot_login authenticator failed for (nsg-static-106.102.72.182.airtel.in) [182.72.102.106]:40798: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.82
country_id: 2077456
description:
2025-12-09 12:02:01 dovecot_login authenticator failed for 210.0.90.82.static.nexnet.net.au [210.0.90.82]:50210: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.219.254.5
country_id: 3996063
description:
2025-12-09 12:02:08 dovecot_login authenticator failed for ([189.219.254.5]) [189.219.254.5]:45922: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.58.233.123
country_id: 1522867
description:
2025-12-09 12:02:13 dovecot_login authenticator failed for 95.58.233.123.dynamic.telecom.kz [95.58.233.123]:50702: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.180.57.212
country_id: 1168579
description:
Dec  9 12:01:58 host2 sshd[763183]: Disconnected from invalid user systems 182.180.57.212 port 51268 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.158.254.18
country_id: 241170
description:
Dec  9 12:02:54 host2 sshd[764177]: Disconnected from invalid user retag 197.158.254.18 port 57256 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.203.0
country_id: 1880251
description:
Dec  9 12:03:29 host2 sshd[765185]: Disconnected from invalid user nokia 152.42.203.0 port 56080 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.26.136.173
country_id: 1210997
description:
Dec  9 12:03:35 host2 sshd[765273]: Disconnected from invalid user guest123 103.26.136.173 port 56102 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.178.214
country_id: 1643084
description:
Dec  9 12:04:15 host2 sshd[766058]: Disconnected from invalid user ya 103.193.178.214 port 52202 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-09 12:04:21 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (lious) [87.103.126.54]:53049: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.16.202.187
country_id: 1269750
description:
Dec  9 12:04:00 host2 sshd[765745]: Disconnected from invalid user mike 103.16.202.187 port 1110 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.42.203.0
country_id: 1880251
description:
Dec  9 12:04:08 host2 sshd[765932]: Disconnected from invalid user ubuntu 152.42.203.0 port 57662 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 12:04:13 +0530] info [cpaneld] 213.209.143.251 - 2stravel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.26.136.173
country_id: 1210997
description:
Dec  9 12:04:18 host2 sshd[766122]: Disconnected from invalid user debian 103.26.136.173 port 40190 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.37.230
country_id: 1880251
description:
Dec  9 12:04:28 host2 sshd[766294]: Disconnected from invalid user nicole 159.223.37.230 port 45488 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 12:05:02 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<LYlsHH9FGIiKxX03>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.47.217
country_id: 6252001
description:
Dec  9 12:05:10 host2 sshd[767155]: Disconnected from invalid user gitea 209.141.47.217 port 43512 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.73
country_id: 1880251
description:
Dec  9 12:05:25 host2 sshd[767388]: Disconnected from invalid user nokia 45.78.223.73 port 41632 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.26.136.173
country_id: 1210997
description:
Dec  9 12:05:38 host2 sshd[767642]: Disconnected from invalid user esuser 103.26.136.173 port 36600 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec  9 12:06:29 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<SfKeIX9Fw4h100Db>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.47.217
country_id: 6252001
description:
Dec  9 12:06:53 host2 sshd[768904]: Disconnected from invalid user deploy 209.141.47.217 port 38868 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  9 12:07:14 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<t5VGJH9F+M+8putr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.220.146
country_id: 1880251
description:
Dec  9 12:07:29 host2 sshd[769395]: Disconnected from invalid user bot 45.78.220.146 port 33018 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.141.47.217
country_id: 6252001
description:
Dec  9 12:07:59 host2 sshd[769876]: Disconnected from invalid user guest123 209.141.47.217 port 50902 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 12:08:01 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@rehanseo.online>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<ao8bJ39FCo+KxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.20.72.91
country_id: 3175395
description:
2025-12-09 12:08:07 dovecot_login authenticator failed for host-79-20-72-91.retail.telecomitalia.it [79.20.72.91]:56960: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.229.14
country_id: 1269750
description:
2025-12-09 12:08:23 dovecot_login authenticator failed for ([152.52.229.14]) [152.52.229.14]:47362: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.58.124.191
country_id: 6252001
description:
Dec  9 12:08:31 host2 sshd[770700]: Disconnected from invalid user manager 34.58.124.191 port 37248 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec  9 12:07:57 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@kiriaswanu.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<O//aJn9FMt2Pbvgo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.158.254.18
country_id: 241170
description:
Dec  9 12:08:54 host2 sshd[771189]: Disconnected from invalid user lisong 197.158.254.18 port 57350 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.236.137.122
country_id: 1880251
description:
Dec  9 12:10:12 host2 sshd[772746]: Disconnected from invalid user daniel 47.236.137.122 port 58196 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 12:10:26 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<Tvi1L39Feo+qQMFo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.158.254.18
country_id: 241170
description:
Dec  9 12:09:54 host2 sshd[772251]: Disconnected from invalid user sales1 197.158.254.18 port 43246 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 209.141.47.217
country_id: 6252001
description:
Dec  9 12:10:01 host2 sshd[772348]: Received disconnect from 209.141.47.217 port 36424:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.47.217
country_id: 6252001
description:
Dec  9 12:10:01 host2 sshd[772348]: Disconnected from invalid user ahsan 209.141.47.217 port 36424 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 47.236.137.122
country_id: 1880251
description:
Dec  9 12:11:45 host2 sshd[774423]: Disconnected from invalid user kserge 47.236.137.122 port 53682 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.158.254.18
country_id: 241170
description:
Dec  9 12:11:54 host2 sshd[774541]: Disconnected from invalid user httpd 197.158.254.18 port 43276 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.58.124.191
country_id: 6252001
description:
Dec  9 12:12:21 host2 sshd[775014]: Disconnected from invalid user gpadmin 34.58.124.191 port 34462 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.58.124.191
country_id: 6252001
description:
Dec  9 12:13:02 host2 sshd[775705]: Disconnected from invalid user git 34.58.124.191 port 38408 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.168.28.250
country_id: 3351879
description:
2025-12-09 12:13:28 dovecot_plain authenticator failed for ([89.116.164.85]) [105.168.28.250]:40018: 535 Incorrect authentication data (set_id=contato@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.135.174.113
country_id: 192950
description:
2025-12-09 12:13:45 dovecot_plain authenticator failed for ([89.116.164.85]) [102.135.174.113]:54280: 535 Incorrect authentication data (set_id=contato@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec  9 12:12:59 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@dataesite.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<tuPcOH9FIpB100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.135.174.113
country_id: 192950
description:
2025-12-09 12:13:53 dovecot_login authenticator failed for ([89.116.164.85]) [102.135.174.113]:54280: 535 Incorrect authentication data (set_id=contato@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.55.198
country_id: 6252001
description:
2025-12-09 12:13:56 dovecot_plain authenticator failed for ([178.16.55.198]) [178.16.55.198]:64367: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.246.21.188
country_id: 3865483
description:
2025-12-09 12:14:00 dovecot_plain authenticator failed for ([89.116.164.85]) [170.246.21.188]:54116: 535 Incorrect authentication data (set_id=contato@epid.gov.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.58.124.191
country_id: 6252001
description:
Dec  9 12:14:15 host2 sshd[777063]: Disconnected from invalid user test3 34.58.124.191 port 34556 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 72.60.111.178
country_id: 1733045
description:
Dec  9 12:15:25 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sobaherbal.com>, method=PLAIN, rip=72.60.111.178, lip=66.85.158.91, session=<y8eQQX9F+uJIPG+y>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 51.210.179.197
country_id: 3017382
description:
Dec  9 12:15:09 host2 sshd[778204]: Received disconnect from 51.210.179.197 port 57640:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.64.8
country_id: 2264397
description:
2025-12-09 12:16:18 dovecot_login authenticator failed for bl23-64-8.dsl.telepac.pt [144.64.64.8]:2091: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.136.72
country_id: 3996063
description:
2025-12-09 12:16:19 dovecot_login authenticator failed for (187.161.136.72-clientes-izzi.mx) [187.161.136.72]:34299: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  9 12:16:39 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<Ggn9RX9Fqs4XXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2025-12-09 12:16:42 dovecot_login authenticator failed for ([128.185.189.57]) [182.78.79.134]:36490: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.222.54
country_id: 1269750
description:
2025-12-09 12:16:49 dovecot_login authenticator failed for (aes-static-089.140.22.125.airtel.in) [122.187.222.54]:56940: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2025-12-09 12:17:23 dovecot_plain authenticator failed for c-73-195-211-98.hsd1.nj.comcast.net (larle) [73.195.211.98]:60156: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.118
country_id: 6252001
description:
Dec  9 12:17:35 host2 dovecot[2208013]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.118, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<0CBwSX9Fk83G6xh2>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.210.179.197
country_id: 3017382
description:
Dec  9 12:19:04 host2 sshd[781557]: Disconnected from invalid user stud1 51.210.179.197 port 41540 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.73
country_id: 1880251
description:
Dec  9 12:19:38 host2 sshd[781987]: Disconnected from invalid user saeed 45.78.223.73 port 50378 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2025-12-09 12:26:08 dovecot_plain authenticator failed for (oopardical) [94.201.22.158]:40828: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 12:26:40 +0530] info [cpaneld] 213.209.143.251 - agronatu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronatu (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.68.178.151
country_id: 3175395
description:
Dec  9 12:27:17 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=185.68.178.151, lip=66.85.158.91, TLS, session=<JkAUa39FjJe5RLKX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.235
country_id: 3865483
description:
Dec  9 12:27:37 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=179.0.251.235, lip=66.85.158.91, TLS, session=<Mqc8bH9Fap6zAPvr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.123.109.79
country_id: 732800
description:
2025-12-09 12:28:05 dovecot_login authenticator failed for (test) [93.123.109.79]:50528: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.243.255.121
country_id: 1819730
description:
Dec  9 12:28:24 host2 sshd[790712]: Disconnected from invalid user app 47.243.255.121 port 55054 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.80.9
country_id: 3144096
description:
2025-12-09 12:29:40 dovecot_login authenticator failed for ([178.232.80.9]) [178.232.80.9]:47046: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 12:30:18 +0530] info [cpaneld] 213.209.143.251 - ajsstarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstarl (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 47.243.255.121
country_id: 1819730
description:
Dec  9 12:30:43 host2 sshd[793580]: Disconnected from invalid user test 47.243.255.121 port 41286 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2025-12-09 12:29:58 dovecot_login authenticator failed for ([196.189.59.227]) [196.189.59.226]:38589: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.243.255.121
country_id: 1819730
description:
Dec  9 12:32:17 host2 sshd[795121]: Disconnected from invalid user user0 47.243.255.121 port 41530 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec  9 12:34:34 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<IP8xhn9FBJYDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec  9 12:35:38 host2 dovecot[2208013]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<ra/6iX9FjNEDlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.123.109.79
country_id: 732800
description:
2025-12-09 12:37:55 dovecot_login authenticator failed for (test) [93.123.109.79]:63140: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  9 12:39:46 host2 sshd[802874]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2025-12-09 12:40:33 dovecot_plain authenticator failed for (menre) [65.20.133.208]:53316: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  9 12:41:41 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<MNN8n39FhNIv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.59.215.13
country_id: 357994
description:
2025-12-09 12:42:37 dovecot_plain authenticator failed for (LF21D45A3WC8) [197.59.215.13]:53610: 535 Incorrect authentication data (set_id=chitral00@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.140.123.145
country_id: 3469034
description:
Dec  9 12:43:07 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=192.140.123.145, lip=66.85.158.91, TLS, session=<cwyqo39FOcPAjHuR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.168.9.94
country_id: 3996063
description:
Dec  9 12:43:27 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<designdpt>, method=PLAIN, rip=201.168.9.94, lip=66.85.158.91, TLS, session=<IXDZpH9FANjJqAle>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.52.234
country_id: 953987
description:
Dec  9 12:48:47 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 25 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=102.129.52.234, lip=66.85.158.91, TLS, session=<FU6Dt39FV5xmgTTq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.237.132
country_id: 3625428
description:
Dec  9 12:48:22 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=95.181.237.132, lip=66.85.158.91, session=<GRSOt39FBIVfte2E>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.205.50
country_id: 99237
description:
Dec  9 12:49:06 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts>, method=PLAIN, rip=65.20.205.50, lip=66.85.158.91, TLS, session=<UD8UuX9F+MJBFM0y>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.239.201.132
country_id: 1643084
description:
Dec  9 12:53:36 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=173.239.201.132, lip=66.85.158.91, session=<8rY7yn9FIr6t78mE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.126.94.200
country_id: 2623032
description:
Dec  9 12:53:36 host2 dovecot[802051]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=188.126.94.200, lip=66.85.158.91, session=<B1E3yn9FJqe8fl7I>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2025-12-09 12:54:10 dovecot_login authenticator failed for (23-30-11-253-static.hfc.comcastbusiness.net) [23.30.11.253]:37438: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.227.70
country_id: 1269750
description:
2025-12-09 12:54:43 dovecot_login authenticator failed for ([182.95.215.9]) [182.95.227.70]:60286: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 12:56:50 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@anandaobauae.org>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<8mmo1X9FULmqQMFo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.10
country_id: 1269750
description:
2025-12-09 12:57:36 dovecot_login authenticator failed for ([182.95.25.234]) [182.95.63.10]:38928: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.191
country_id: 3996063
description:
2025-12-09 12:58:10 dovecot_login authenticator failed for ([177.236.146.191]) [177.236.146.191]:53831: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.199.165
country_id: 2077456
description:
2025-12-09 13:00:20 dovecot_login authenticator failed for 165.199.148.122.sta.wbroadband.net.au [122.148.199.165]:41702: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-09 13:00:40 dovecot_login authenticator failed for (host-64-72-74-162.lightower.net) [64.72.74.162]:35101: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 13:00:41 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<4ZV3439F7ISKxX03>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.127
country_id: 6252001
description:
Dec  9 13:01:06 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.127, lip=66.85.158.91, TLS, session=<PmIJ5X9F4uvG6xh/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 13:03:34 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@rehanseo.online>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<hKbA7X9FvIaKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec  9 13:02:52 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@kiriaswanu.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<lmA+639F8pGPbvgo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  9 13:04:12 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@kiriaswanu.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<J+gA8H9Feo28putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec  9 13:09:10 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@bostonlanka.com>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<DAnHAYBFh0d100Db>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.70.19.11
country_id: 3469034
description:
2025-12-09 13:09:22 dovecot_login authenticator failed for (45-70-19-11.static.damsolutionsturbo.com.br) [45.70.19.11]:41151: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.182.111.162
country_id: 1880251
description:
2025-12-09 13:09:41 dovecot_login authenticator failed for (162.111.182.58.starhub.net.sg) [58.182.111.162]:55720: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 13:10:52 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<newsletter@sobaherbal.com>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<Dr3hB4BFKNWqQMFo>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.247.137.92
country_id: 2635167
description:
Dec  9 13:12:37 host2 pure-ftpd[835204]: (?@185.247.137.92) [INFO] New connection from 185.247.137.92


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec  9 13:17:24 host2 dovecot[802051]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<XfpWH4BFaLwDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec  9 13:18:38 host2 dovecot[802051]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<rw6+I4BF5p4DgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec  9 13:18:55 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: Connection closed, session=<QFvMJIBFDrYDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec  9 13:20:57 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: Connection closed, session=<wWMGLIBF1r4DgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec  9 13:22:10 host2 dovecot[802051]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<7h5iMIBF9qIDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec  9 13:23:25 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<WIHeNIBFTMgDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec  9 13:24:59 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: Connection closed, session=<royAOoBF9tIDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.162
country_id: 2993457
description:
Dec  9 13:25:04 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.162, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<T6jAOoBF8f7CpRCi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec  9 13:26:24 host2 dovecot[802051]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<CeiGP4BF6L4DgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.15.108
country_id: 290557
description:
2025-12-09 13:26:20 dovecot_plain authenticator failed for (subdois) [5.31.15.108]:57982: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec  9 13:27:05 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ZnQBQoBFVukDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec  9 13:28:36 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<37hrR4BFQpwDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.226.163
country_id: 3144096
description:
2025-12-09 13:29:21 dovecot_login authenticator failed for ([178.232.226.163]) [178.232.226.163]:39698: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.244
country_id: 3996063
description:
2025-12-09 13:29:36 dovecot_login authenticator failed for ([177.236.146.244]) [177.236.146.244]:43452: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.171.230.200
country_id: 6252001
description:
2025-12-09 13:34:21 dovecot_plain authenticator failed for c-73-171-230-200.hsd1.fl.comcast.net (yulingned) [73.171.230.200]:45269: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  9 13:36:45 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<vlpwZIBFhNYXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.242.216
country_id: 6252001
description:
2025-12-09 13:36:57 dovecot_login authenticator failed for wsip-184-191-242-216.fv.ks.cox.net [184.191.242.216]:34746: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.138
country_id: 6252001
description:
Dec  9 13:36:57 host2 pure-ftpd[856493]: (?@205.210.31.138) [INFO] New connection from 205.210.31.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-12-09 13:37:27 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:51968: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  9 13:42:12 host2 sshd[861214]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  9 13:43:35 host2 sshd[862294]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 13:46:31 +0530] info [cpaneld] 213.209.143.251 - agrona "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agrona (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  9 13:48:28 host2 sshd[867296]: Disconnected from invalid user user 2.57.121.25 port 17064 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 13:50:16 +0530] info [cpaneld] 213.209.143.251 - ajssta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajssta (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.69.161.241
country_id: 6252001
description:
2025-12-09 13:51:31 dovecot_login authenticator failed for ([208.69.161.241]) [208.69.161.241]:35253: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.31.75.17
country_id: 660013
description:
2025-12-09 13:51:47 dovecot_login authenticator failed for (vm496206.hosted-by.u1host.com) [144.31.75.17]:46614: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.220.56.98
country_id: 6252001
description:
Dec  9 13:54:48 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@nsteeleng.com>, method=PLAIN, rip=31.220.56.98, lip=66.85.158.91, session=<JEX+pIBFlKcf3Dhi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  9 14:01:14 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<notify@kiriaswanu.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<mSIFvIBFIIS8putr>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.50.180.232
country_id: 2635167
description:
[2025-12-09 14:02:06 +0530] info [cpaneld] 209.50.180.232 - euroent3 "GET /login/?login_only=1&user=euroent3&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroent3 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.111.13.91
country_id: 6252001
description:
[2025-12-09 14:02:08 +0530] info [cpaneld] 65.111.13.91 - euroent5 "GET /login/?login_only=1&user=euroent5&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroent5 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.111.0.181
country_id: 6252001
description:
[2025-12-09 14:02:09 +0530] info [cpaneld] 65.111.0.181 - euroent6 "GET /login/?login_only=1&user=euroent6&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroent6 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.167.25.5
country_id: 6252001
description:
[2025-12-09 14:02:02 +0530] info [cpaneld] 104.167.25.5 - euroe "GET /login/?login_only=1&user=euroe&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroe (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.207.53.132
country_id: 2635167
description:
[2025-12-09 14:02:12 +0530] info [cpaneld] 104.207.53.132 - euroen10 "GET /login/?login_only=1&user=euroen10&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroen10 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.111.14.21
country_id: 6252001
description:
[2025-12-09 14:01:49 +0530] info [cpaneld] 65.111.14.21 - isuru "GET /login/?login_only=1&user=isuru&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user isuru (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.3.43.79
country_id: 2921044
description:
[2025-12-09 14:01:56 +0530] info [cpaneld] 45.3.43.79 - euroentertai "GET /login/?login_only=1&user=euroentertai&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroentertai (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.213.162.124
country_id: 3017382
description:
[2025-12-09 14:02:02 +0530] info [cpaneld] 154.213.162.124 - euro "GET /login/?login_only=1&user=euro&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euro (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.111.24.60
country_id: 2921044
description:
[2025-12-09 14:02:01 +0530] info [cpaneld] 65.111.24.60 - euroen "GET /login/?login_only=1&user=euroen&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroen (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.111.9.209
country_id: 6252001
description:
[2025-12-09 14:02:05 +0530] info [cpaneld] 65.111.9.209 - euroent2 "GET /login/?login_only=1&user=euroent2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroent2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.50.173.248
country_id: 6252001
description:
[2025-12-09 14:02:07 +0530] info [cpaneld] 209.50.173.248 - euroent4 "GET /login/?login_only=1&user=euroent4&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroent4 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.26.236.241
country_id: 6252001
description:
[2025-12-09 14:02:13 +0530] info [cpaneld] 216.26.236.241 - euroen11 "GET /login/?login_only=1&user=euroen11&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroen11 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.3.51.162
country_id: 6252001
description:
[2025-12-09 14:01:55 +0530] info [cpaneld] 45.3.51.162 - euroentertain "GET /login/?login_only=1&user=euroentertain&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroentertain (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.50.161.226
country_id: 6252001
description:
[2025-12-09 14:01:57 +0530] info [cpaneld] 209.50.161.226 - euroenterta "GET /login/?login_only=1&user=euroenterta&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroenterta (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.3.38.125
country_id: 6252001
description:
[2025-12-09 14:02:00 +0530] info [cpaneld] 45.3.38.125 - euroent "GET /login/?login_only=1&user=euroent&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroent (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.207.62.218
country_id: 3017382
description:
[2025-12-09 14:01:58 +0530] info [cpaneld] 104.207.62.218 - euroentert "GET /login/?login_only=1&user=euroentert&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroentert (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.26.255.155
country_id: 3017382
description:
[2025-12-09 14:01:59 +0530] info [cpaneld] 216.26.255.155 - euroente "GET /login/?login_only=1&user=euroente&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroente (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.207.34.120
country_id: 6252001
description:
[2025-12-09 14:02:09 +0530] info [cpaneld] 104.207.34.120 - euroent7 "GET /login/?login_only=1&user=euroent7&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroent7 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.207.39.127
country_id: 6252001
description:
[2025-12-09 14:01:51 +0530] info [cpaneld] 104.207.39.127 - euroentertainmentlk "GET /login/?login_only=1&user=euroentertainmentlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroentertainmentlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.3.34.162
country_id: 6252001
description:
[2025-12-09 14:01:52 +0530] info [cpaneld] 45.3.34.162 - euroentertainmentlkcom "GET /login/?login_only=1&user=euroentertainmentlkcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroentertainmentlkcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.50.189.26
country_id: 3017382
description:
[2025-12-09 14:01:54 +0530] info [cpaneld] 209.50.189.26 - euroentertainm "GET /login/?login_only=1&user=euroentertainm&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroentertainm (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.207.41.42
country_id: 6252001
description:
[2025-12-09 14:01:59 +0530] info [cpaneld] 104.207.41.42 - euroenter "GET /login/?login_only=1&user=euroenter&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroenter (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.111.24.163
country_id: 2921044
description:
[2025-12-09 14:02:03 +0530] info [cpaneld] 65.111.24.163 - eur "GET /login/?login_only=1&user=eur&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user eur (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.207.56.97
country_id: 2921044
description:
[2025-12-09 14:02:04 +0530] info [cpaneld] 104.207.56.97 - eu "GET /login/?login_only=1&user=eu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user eu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.3.42.121
country_id: 2635167
description:
[2025-12-09 14:02:05 +0530] info [cpaneld] 45.3.42.121 - euroent1 "GET /login/?login_only=1&user=euroent1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroent1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.111.25.101
country_id: 2921044
description:
[2025-12-09 14:02:11 +0530] info [cpaneld] 65.111.25.101 - euroent9 "GET /login/?login_only=1&user=euroent9&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroent9 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.167.19.66
country_id: 6252001
description:
[2025-12-09 14:01:50 +0530] info [cpaneld] 104.167.19.66 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.207.51.135
country_id: 2635167
description:
[2025-12-09 14:01:53 +0530] info [cpaneld] 104.207.51.135 - euroentertainme "GET /login/?login_only=1&user=euroentertainme&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroentertainme (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.137
country_id: 6252001
description:
Dec  9 14:02:06 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.137, lip=66.85.158.91, TLS: Connection closed, session=<VSc7v4BFxEpChJmJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.88.196.91
country_id: 6252001
description:
2025-12-09 14:02:24 dovecot_plain authenticator failed for c-73-88-196-91.hsd1.ky.comcast.net (besse) [73.88.196.91]:56286: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.192.123.12
country_id: 6252001
description:
2025-12-09 14:02:34 dovecot_plain authenticator failed for (rater) [199.192.123.12]:49948: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2025-12-09 14:06:14 dovecot_plain authenticator failed for c-73-208-81-125.hsd1.in.comcast.net (cidia) [73.208.81.125]:32774: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.189.167.215
country_id: 3017382
description:
[2025-12-09 14:06:11 +0530] info [cpaneld] 5.189.167.215 - lezzarotech "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.142.126.37
country_id: 6252001
description:
2025-12-09 14:08:03 dovecot_plain authenticator failed for c-69-142-126-37.hsd1.nj.comcast.net (desom) [69.142.126.37]:39466: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 14:11:32 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@sobaherbal.com>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<RmjO4IBFHI6qQMFo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  9 14:16:38 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<B4gW84BF/o8v/lVz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Dec  9 14:19:53 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@dataesite.lk>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<xcqu/oBFwqx100Db>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.18
country_id: 6252001
description:
Dec  9 14:20:56 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.18, lip=66.85.158.92, TLS handshaking: Connection closed, session=<T7iNAoFFM7vDuEwS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.20
country_id: 6252001
description:
Dec  9 14:21:06 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=195.184.76.20, lip=66.85.158.92, TLS: Connection closed, session=<OeYrA4FFL5zDuEwU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.21
country_id: 6252001
description:
Dec  9 14:21:19 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=195.184.76.21, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<WT30A4FFm4vDuEwV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.18
country_id: 6252001
description:
Dec  9 14:21:22 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.18, lip=66.85.158.92, TLS: Connection closed, session=<eyAjBIFFq9bDuEwS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.185.91
country_id: 6252001
description:
Dec  9 14:23:07 host2 dovecot[802051]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=44.220.185.91, lip=66.85.158.91, session=<m21hCoFFbKEs3Llb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-09 14:24:30 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:58339: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2025-12-09 14:24:39 dovecot_plain authenticator failed for (razon) [24.104.225.201]:45475: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.200
country_id: 3175395
description:
Dec  9 14:25:35 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@v-deploy.com>, method=PLAIN, rip=185.15.171.200, lip=66.85.158.91, TLS, session=<ZgIYEoFFktO5D6vI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.154.255
country_id: 1269750
description:
Dec  9 14:25:48 host2 sshd[898392]: Disconnected from invalid user john 103.172.154.255 port 59784 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.209.37
country_id: 933860
description:
Dec  9 14:25:57 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=41.216.209.37, lip=66.85.158.91, TLS, session=<WtdUE4FFZasp2NEl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2025-12-09 14:27:04 dovecot_plain authenticator failed for (catrauple) [90.160.139.163]:42403: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.172.154.255
country_id: 1269750
description:
Dec  9 14:27:13 host2 sshd[899402]: Disconnected from invalid user admin 103.172.154.255 port 38636 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 103.172.154.255
country_id: 1269750
description:
Dec  9 14:28:11 host2 sshd[900048]: Received disconnect from 103.172.154.255 port 37076:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-09 14:27:51 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (frilly) [196.47.172.253]:40605: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.154.255
country_id: 1269750
description:
Dec  9 14:27:51 host2 sshd[899789]: Disconnected from invalid user botuser 103.172.154.255 port 59286 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.154.255
country_id: 1269750
description:
Dec  9 14:28:34 host2 sshd[900346]: Disconnected from invalid user user4 103.172.154.255 port 41826 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  9 14:30:32 host2 sshd[902586]: Disconnected from invalid user admin 2.57.121.112 port 20770 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.183
country_id: 3144096
description:
2025-12-09 14:33:20 dovecot_login authenticator failed for ([84.213.189.183]) [84.213.189.183]:51036: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.173.254.153
country_id: 3469034
description:
2025-12-09 14:33:25 dovecot_login authenticator failed for ([45.173.254.224]) [45.173.254.153]:57076: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.18
country_id: 1269750
description:
2025-12-09 14:33:24 dovecot_login authenticator failed for ([152.52.234.33]) [182.95.174.18]:50670: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.70.122.245
country_id: 1269750
description:
2025-12-09 14:33:54 dovecot_login authenticator failed for (abts-mum-static-245.122.70.182.airtelbroadband.in) [182.70.122.245]:54698: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.42
country_id: 3996063
description:
2025-12-09 14:33:57 dovecot_login authenticator failed for (201.173.250.42-clientes-izzi.mx) [201.173.250.42]:38962: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.206
country_id: 1269750
description:
2025-12-09 14:34:04 dovecot_login authenticator failed for ([125.20.154.97]) [182.95.178.206]:54544: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.110.248.40
country_id: 1269750
description:
Dec  9 14:36:32 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=143.110.248.40, lip=66.85.158.91, session=<FIRBOoFF7s6Pbvgo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-09 14:38:40 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (docaret) [87.103.126.54]:33836: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.152.155
country_id: 690791
description:
Dec  9 14:41:26 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=37.221.152.155, lip=66.85.158.91, TLS, session=<kSHhSoFFk7Yl3Zib>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.86.18.50
country_id: 3469034
description:
Dec  9 14:41:47 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<accounts>, method=PLAIN, rip=177.86.18.50, lip=66.85.158.91, TLS, session=<v6EFTIFFAKyxVhIy>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2921044
description:
[2025-12-09 14:42:20 +0530] info [cpaneld] 213.209.143.251 - 2str "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-12-09 14:43:02 dovecot_plain authenticator failed for c-174-169-224-27.hsd1.vt.comcast.net (nomarmist) [174.169.224.27]:51270: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2025-12-09 14:45:57 dovecot_plain authenticator failed for c-73-145-107-251.hsd1.mi.comcast.net (laser) [73.145.107.251]:42126: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.46
country_id: 1036973
description:
2025-12-09 14:46:12 dovecot_login authenticator failed for (dynamic-adsl.movitel.co.mz) [197.219.210.46]:53242: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.145.54
country_id: 1269750
description:
2025-12-09 14:46:35 dovecot_login authenticator failed for ([128.185.135.33]) [122.185.145.54]:49350: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2025-12-09 14:48:02 dovecot_plain authenticator failed for c-24-1-200-187.hsd1.il.comcast.net (deffier) [24.1.200.187]:50598: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.147.45
country_id: 99237
description:
2025-12-09 14:48:27 dovecot_plain authenticator failed for (unizablega) [65.20.147.45]:43021: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.254.85.115
country_id: 6252001
description:
Dec  9 14:50:16 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@seyawin.com>, method=PLAIN, rip=47.254.85.115, lip=66.85.158.91, session=<3sFWa4FFUoEv/lVz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-12-09 14:51:25 dovecot_plain authenticator failed for (ligater) [102.53.15.17]:52417: 535 Incorrect authentication data (set_id=ruwini@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 14:51:28 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<Bw+lb4FFUsaKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.208.106.68
country_id: 3175395
description:
Dec  9 14:51:55 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=185.208.106.68, lip=66.85.158.91, TLS, session=<fkBtcIFFwsu50GpE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.178.47
country_id: 3175395
description:
Dec  9 14:52:13 host2 dovecot[802051]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=217.26.178.47, lip=66.85.158.91, TLS, session=<miV6cYFF3Z7ZGrIv>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  9 14:52:30 host2 sshd[921876]: Disconnected from invalid user user 2.57.121.25 port 39196 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.205.253
country_id: 3469034
description:
Dec  9 14:54:15 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=179.189.205.253, lip=66.85.158.91, TLS, session=<4JKDeIFF95mzvc39>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Dec  9 14:54:28 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@rehanseo.online>, method=PLAIN, rip=138.197.125.55, lip=66.85.158.91, session=<h69meoFF9M2KxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 131.255.183.114
country_id: 3865483
description:
Dec  9 14:54:36 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt>, method=PLAIN, rip=131.255.183.114, lip=66.85.158.91, TLS, session=<5tHXeYFF87CD/7dy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.24.76.30
country_id: 6252001
description:
2025-12-09 14:57:13 dovecot_login authenticator failed for (syn-047-024-076-030.res.spectrum.com) [47.24.76.30]:40022: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.211.60
country_id: 2077456
description:
2025-12-09 14:57:44 dovecot_login authenticator failed for ([123.209.211.60]) [123.209.211.60]:47528: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.121.76.190
country_id: 732800
description:
2025-12-09 14:58:09 dovecot_plain authenticator failed for (parahenter) [87.121.76.190]:33311: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.235.107
country_id: 1880251
description:
Dec  9 14:59:15 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@kiriaswanu.com>, method=PLAIN, rip=188.166.235.107, lip=66.85.158.91, session=<mgR7i4FFDL28putr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Dec  9 14:58:32 host2 dovecot[802051]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=170.64.193.104, lip=66.85.158.91, session=<bhLpiIFFLsyqQMFo>


