# incident

plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.10.252.119
country_id: 1643084
description:
Jan  2 10:53:03 host2 sshd[4185130]: Disconnected from invalid user factorio 157.10.252.119 port 50562 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.12.41.6
country_id: 6252001
description:
Jan  2 10:55:42 host2 sshd[4188616]: Disconnected from invalid user devops 20.12.41.6 port 40566 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.124.23.196
country_id: 3996063
description:
Jan  2 10:55:24 host2 sshd[4188341]: Disconnected from invalid user ts3server 201.124.23.196 port 59966 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.16
country_id: 241170
description:
Jan  2 11:00:23 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.16, lip=66.85.158.91, session=<yZxTAWFHVNzE+2YQ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.48.78.29
country_id: 3469034
description:
Jan  2 11:09:48 host2 sshd[11575]: Disconnected from invalid user admin1 201.48.78.29 port 55002 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.48.78.29
country_id: 3469034
description:
Jan  2 11:10:10 host2 sshd[12123]: Disconnected from invalid user noaccess 201.48.78.29 port 58878 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.48.78.29
country_id: 3469034
description:
Jan  2 11:10:24 host2 sshd[12474]: Disconnected from invalid user pepper 201.48.78.29 port 33098 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  2 11:10:53 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<Ekr6JmFH9GBo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 11:11:48 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<MmdAKmFHHNov/AU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.145.163
country_id: 6252001
description:
Jan  2 11:11:59 host2 sshd[14172]: Disconnected from invalid user ftp_user 137.184.145.163 port 44314 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 11:12:16 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<ocPqK2FH4OqeRdY+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 137.184.145.163
country_id: 6252001
description:
Jan  2 11:12:55 host2 sshd[15197]: Disconnected from invalid user user33 137.184.145.163 port 35728 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.156.67.18
country_id: 6252001
description:
Jan  2 11:14:28 host2 sshd[17157]: Disconnected from invalid user ubuntu 12.156.67.18 port 52784 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 12.156.67.18
country_id: 6252001
description:
Jan  2 11:16:33 host2 sshd[19623]: Received disconnect from 12.156.67.18 port 38506:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 12.156.67.18
country_id: 6252001
description:
Jan  2 11:16:01 host2 sshd[19109]: Disconnected from invalid user ubuntu 12.156.67.18 port 59306 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.18.161.165
country_id: 1269750
description:
Jan  2 11:17:39 host2 sshd[20687]: Disconnected from invalid user cisco 182.18.161.165 port 50306 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.3.179.41
country_id: 6252001
description:
Jan  2 11:18:13 host2 sshd[21442]: Disconnected from invalid user ansible 192.3.179.41 port 46078 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.3.179.41
country_id: 6252001
description:
Jan  2 11:19:18 host2 sshd[22673]: Disconnected from invalid user user2 192.3.179.41 port 54840 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 192.3.179.41
country_id: 6252001
description:
Jan  2 11:20:24 host2 sshd[23904]: Disconnected from invalid user user33 192.3.179.41 port 37528 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.95
country_id: 6252001
description:
Jan  2 11:20:29 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 10 secs): user=<>, rip=162.216.150.95, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<IiVtSWFHXc+i2JZf>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 192.3.179.41
country_id: 6252001
description:
Jan  2 11:21:32 host2 sshd[25058]: Received disconnect from 192.3.179.41 port 60064:11: Bye Bye [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.95
country_id: 6252001
description:
Jan  2 11:21:49 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 24 secs): user=<>, rip=162.216.150.95, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<v9UvTmFHZP+i2JZf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.3.179.41
country_id: 6252001
description:
Jan  2 11:22:05 host2 sshd[25610]: Disconnected from invalid user ubuntu 192.3.179.41 port 50324 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.95
country_id: 6252001
description:
Jan  2 11:21:56 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 29 secs): user=<>, rip=162.216.150.95, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<SeCcTmFHivOi2JZf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.3.179.41
country_id: 6252001
description:
Jan  2 11:23:11 host2 sshd[26761]: Disconnected from invalid user ubuntu 192.3.179.41 port 36098 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.59.5.36
country_id: 1269750
description:
2026-01-02 11:25:49 dovecot_plain authenticator failed for H=(LE7AQH53ZALJ4) [152.59.5.36]:57610: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2026-01-02 11:25:59 dovecot_login authenticator failed for H=bb121-6-81-59.singnet.com.sg [121.6.81.59]:42379: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.38.0.39
country_id: 6252001
description:
2026-01-02 11:26:08 dovecot_login authenticator failed for H=([45.38.0.39]) [45.38.0.39]:2151: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.208.171
country_id: 798544
description:
Jan  2 11:27:20 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<charanaw>, method=PLAIN, rip=109.125.208.171, lip=66.85.158.91, TLS, session=<2bXtYGFHPrRtfdCr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  2 11:27:28 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<1NAnYmFHnIp100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.75.167.248
country_id: 3077311
description:
Jan  2 11:27:02 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=188.75.167.248, lip=66.85.158.91, TLS, session=<Zz/hX2FHZ6S8S6f4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  2 11:27:08 host2 dovecot[3680762]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<q+kwYWFHBuQDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  2 11:28:35 host2 dovecot[3680762]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<Vf1mZmFHgNsDhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 11:29:10 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<81JSaGFHmMkjupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.95
country_id: 6252001
description:
Jan  2 11:29:12 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.95, lip=66.85.158.92, TLS, session=<ARidaGFHxu+i2JZf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  2 11:29:46 host2 dovecot[3680762]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<FYujamFHss0DhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.95
country_id: 6252001
description:
Jan  2 11:30:28 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=162.216.150.95, lip=66.85.158.92, TLS, session=<1MEYbWFHVu6i2JZf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  2 11:31:01 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<X28cb2FHPMoDhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  2 11:31:25 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<F9ZYcGFHfCtniu0S>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  2 11:31:25 host2 dovecot[3680762]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<q+V/cGFHYN4DhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 11:32:00 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<qkR+cmFHPJWeRdY+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Jan  2 11:32:12 host2 dovecot[3680762]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<pHlYc2FHwpQDhpQ7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.195.221.26
country_id: 934292
description:
Jan  2 11:33:55 host2 sshd[36840]: Disconnected from invalid user user1 45.195.221.26 port 64790 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  2 11:35:49 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<u4kfgGFHrLNn9M4G>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.195.221.26
country_id: 934292
description:
Jan  2 11:35:53 host2 sshd[39108]: Disconnected from invalid user git 45.195.221.26 port 19444 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.76.120.69
country_id: 1643084
description:
Jan  2 11:37:19 host2 sshd[40707]: Disconnected from invalid user dev 103.76.120.69 port 44440 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  2 11:38:22 host2 sshd[42101]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.76.120.69
country_id: 1643084
description:
Jan  2 11:38:01 host2 sshd[41634]: Disconnected from invalid user git 103.76.120.69 port 58014 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  2 11:38:14 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<fKLGiGFHlI2i8Jp9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.195.221.26
country_id: 934292
description:
Jan  2 11:38:29 host2 sshd[42185]: Disconnected from invalid user ubuntu 45.195.221.26 port 19640 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.195.221.26
country_id: 934292
description:
Jan  2 11:39:23 host2 sshd[43599]: Disconnected from invalid user max 45.195.221.26 port 55772 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.39.159
country_id: 953987
description:
Jan  2 11:40:24 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=102.64.39.159, lip=66.85.158.91, TLS, session=<Dwxjj2FHnpRmQCef>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.236.85.34
country_id: 3469034
description:
Jan  2 11:40:44 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=45.236.85.34, lip=66.85.158.91, TLS, session=<OWnAkGFH0bMt7FUi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.76.120.69
country_id: 1643084
description:
Jan  2 11:40:13 host2 sshd[44682]: Disconnected from invalid user paulo 103.76.120.69 port 51964 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  2 11:40:20 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<iPM9kGFHbulCdMzo>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.225
country_id: 6252001
description:
Jan  2 11:41:45 host2 pure-ftpd[46847]: (?@198.235.24.225) [INFO] New connection from 198.235.24.225


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Jan  2 11:45:21 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<NywvomFHgL2YNcU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 11:46:19 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<sVGppWFHGk8jupN+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  2 11:48:28 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<N2FXrWFH5IOi8GQy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2026-01-02 11:48:55 dovecot_login authenticator failed for H=([210.177.143.61]) [210.177.143.61]:53168: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.144.14.204
country_id: 1210997
description:
2026-01-02 11:49:21 dovecot_login authenticator failed for H=(14.204.bol-online.com) [122.144.14.204]:59072: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  2 11:51:36 host2 sshd[58869]: Disconnected from invalid user user 2.57.121.25 port 30727 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  2 11:53:00 host2 pure-ftpd[60582]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 11:58:24 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<GaPe0GFHHIIv/AU1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.64.98.14
country_id: 1655842
description:
Jan  2 12:01:15 host2 dovecot[3680762]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=64.64.98.14, lip=66.85.158.91, session=<oEcz22FHYMJAQGIO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 43.250.207.105
country_id: 2186224
description:
Jan  2 12:01:15 host2 dovecot[3680762]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=43.250.207.105, lip=66.85.158.91, session=<LRU222FHYNor+s9p>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.90.122.132
country_id: 3042058
description:
Jan  2 12:01:15 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.90.122.132, lip=66.85.158.91, session=<RbY222FHWMJbWnqE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.244.58.12
country_id: 2029969
description:
Jan  2 12:01:15 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=173.244.58.12, lip=66.85.158.91, session=<2B8922FHUtqt9DoM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.187.30
country_id: 1269750
description:
2026-01-02 12:03:47 dovecot_login authenticator failed for H=(nsg-corporate-81.166.185.122.airtel.in) [122.185.187.30]:50970: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.243.234.23
country_id: 6252001
description:
2026-01-02 12:03:59 dovecot_login authenticator failed for H=c-73-243-234-23.hsd1.co.comcast.net [73.243.234.23]:58476: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  2 12:05:53 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<cAmg62FH7Nhnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  2 12:05:23 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<webmaster@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<lJTY6WFHpNIFhXlo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.26.25
country_id: 6252001
description:
Jan  2 12:10:38 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=18.97.26.25, lip=66.85.158.91, TLS handshaking: Connection closed, session=<9UnC/GFHZs4SYRoZ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  2 12:12:43 host2 sshd[82889]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 12:15:50 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<ptNBD2JH4MaeRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.149
country_id: 3996063
description:
2026-01-02 12:17:42 dovecot_login authenticator failed for H=([177.236.146.149]) [177.236.146.149]:46697: 535 Incorrect authentication data (set_id=postmaster@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.199.118.234
country_id: 1880251
description:
2026-01-02 12:18:00 dovecot_login authenticator failed for H=(448990.cloudwaysapps.com) [128.199.118.234]:58920: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.248.30.205
country_id: 1269750
description:
2026-01-02 12:20:58 dovecot_login authenticator failed for H=([103.248.30.205]) [103.248.30.205]:57039: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.98.28.43
country_id: 1269750
description:
2026-01-02 12:20:41 dovecot_login authenticator failed for H=([14.98.28.43]) [14.98.28.43]:57960: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 12:21:59 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<bHRBJWJHHJ0v/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.88.19.82
country_id: 6252001
description:
Jan  2 12:22:15 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=47.88.19.82, lip=66.85.158.91, session=<XfcrJmJHRs0vWBNS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.70.12.9
country_id: 1168579
description:
Jan  2 12:22:52 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=146.70.12.9, lip=66.85.158.91, session=<YyaKKGJHoomSRgwJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.225.28.9
country_id: 718075
description:
Jan  2 12:22:52 host2 dovecot[3680762]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=185.225.28.9, lip=66.85.158.91, session=<4U6FKGJHhOG54RwJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  2 12:29:00 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<Y4dWPmJHzQ1niu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  2 12:30:13 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<zea2QmJHro4yBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  2 12:30:14 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<hki5QmJHCZp100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  2 12:34:08 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<test@venee.lk>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<UE5/UGJHkNmeRdGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 12:35:14 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<dnqcVGJHkL4jupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.146
country_id: 6252001
description:
Jan  2 12:35:47 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.146, lip=66.85.158.91, session=<M6O3VmJHiu7N0h+S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 12:35:52 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<v97mVmJHkIKeRdY+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.128.110
country_id: 690791
description:
Jan  2 12:37:00 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 25 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=37.221.128.110, lip=66.85.158.91, TLS, session=<AmCaWWJH7aol3YBu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  2 12:37:08 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<L8JjW2JHdK5n9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.54.150
country_id: 953987
description:
Jan  2 12:37:50 host2 dovecot[3680762]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 25 secs): user=<env_eng>, method=PLAIN, rip=102.129.54.150, lip=66.85.158.91, TLS, session=<cGSWXGJHrLJmgTaW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.178.191.5
country_id: 2661886
description:
Jan  2 12:42:28 host2 sshd[113722]: Disconnected from invalid user lars 195.178.191.5 port 47538 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  2 12:43:40 host2 dovecot[3680762]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<nHfCcmJHlkto7MS0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  2 12:43:53 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<2uSRc2JHCjCi8Jp9>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 195.178.191.5
country_id: 2661886
description:
Jan  2 12:44:03 host2 sshd[115085]: Disconnected from invalid user public 195.178.191.5 port 53978 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.178.191.5
country_id: 2661886
description:
Jan  2 12:46:17 host2 sshd[117823]: Disconnected from invalid user justin 195.178.191.5 port 54298 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 194.164.107.5
country_id: 6252001
description:
Jan  2 12:47:13 host2 dovecot[114824]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=194.164.107.5, lip=66.85.158.92, TLS, session=<mMubf2JHqJDCpGsF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.204.219
country_id: 1643084
description:
Jan  2 12:47:35 host2 sshd[119103]: Disconnected from invalid user userftp 103.172.204.219 port 33064 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.68.9.182
country_id: 6252001
description:
Jan  2 12:48:29 host2 sshd[120077]: Disconnected from invalid user xudong 138.68.9.182 port 54928 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.172.204.219
country_id: 1643084
description:
Jan  2 12:48:34 host2 sshd[120124]: Disconnected from invalid user library 103.172.204.219 port 52568 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.17
country_id: 241170
description:
Jan  2 12:47:50 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.17, lip=66.85.158.91, session=<cx6sgWJHyu3E+2YR>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.68.9.182
country_id: 6252001
description:
Jan  2 12:48:58 host2 sshd[120526]: Disconnected from invalid user test123 138.68.9.182 port 34674 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.69
country_id: 3865483
description:
Jan  2 12:49:01 host2 dovecot[114824]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<charanaw@ksoft.lk>, method=PLAIN, rip=179.0.250.69, lip=66.85.158.91, TLS, session=<JW/dhGJH0rSzAPpF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.59.125
country_id: 953987
description:
Jan  2 12:49:22 host2 dovecot[114824]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<charanaw>, method=PLAIN, rip=102.129.59.125, lip=66.85.158.91, TLS, session=<aBcphmJHZexmgTt9>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.68.9.182
country_id: 6252001
description:
Jan  2 12:49:57 host2 sshd[121737]: Disconnected from invalid user ubuntu 138.68.9.182 port 48364 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.190.155.43
country_id: 6252001
description:
2026-01-02 12:49:43 dovecot_plain authenticator failed for H=(vatmelized) [76.190.155.43]:48765: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  2 12:49:51 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<VkrliGJHRJOi8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 12:52:46 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<EsRMk2JHltEjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.91.186.116
country_id: 6252001
description:
2026-01-02 12:53:59 dovecot_login authenticator failed for H=([107.91.186.116]) [107.91.186.116]:7440: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.98
country_id: 6252001
description:
2026-01-02 12:54:19 dovecot_login authenticator failed for H=syn-035-130-111-098.biz.spectrum.com [35.130.111.98]:47296: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.65.172.46
country_id: 6252001
description:
[2026-01-02 12:55:17 +0530] info [cpaneld] 159.65.172.46 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  2 12:55:53 host2 pure-ftpd[129355]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
country_id: 2510769
description:
2026-01-02 12:58:19 dovecot_login authenticator failed for H=(90.pool90-173-78.static.orange.es) [90.173.78.90]:46889: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.158.51.102
country_id: 1694008
description:
2026-01-02 12:58:40 dovecot_plain authenticator failed for H=(LF21D45A3WC8) [136.158.51.102]:26185: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.158.51.102
country_id: 1694008
description:
2026-01-02 12:58:47 dovecot_login authenticator failed for H=(LF21D45A3WC8) [136.158.51.102]:26185: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.71
country_id: 2635167
description:
Jan  2 13:00:09 host2 dovecot[114824]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.71, lip=66.85.158.92, TLS, session=<o0XZrWJH9di594lH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.234
country_id: 2635167
description:
Jan  2 13:00:10 host2 dovecot[114824]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.234, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<e1/krWJHW7lX7LDq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.209.171
country_id: 6251999
description:
Jan  2 13:00:37 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<test@bostonlanka.com>, method=PLAIN, rip=158.69.209.171, lip=66.85.158.91, session=<AzlZr2JHBISeRdGr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-02 13:00:54 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:64843: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.212.194
country_id: 1269750
description:
2026-01-02 13:01:12 dovecot_login authenticator failed for H=([61.2.212.194]) [61.2.212.194]:59803: 535 Incorrect authentication data


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.239
country_id: 2635167
description:
Jan  2 13:01:16 host2 dovecot[114824]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.239, lip=66.85.158.92, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<nTvbsWJHp45X7LDv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.238
country_id: 2635167
description:
Jan  2 13:00:43 host2 dovecot[114824]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.238, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<4brfr2JHneRX7LDu>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  2 13:02:36 host2 sshd[136215]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.251
country_id: 2635167
description:
Jan  2 13:01:49 host2 dovecot[114824]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.251, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<83zWs2JHO+tX7LD7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.66
country_id: 1733045
description:
2026-01-02 13:02:00 dovecot_login authenticator failed for H=([49.124.151.66]) [49.124.151.66]:37560: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.226
country_id: 2635167
description:
Jan  2 13:02:23 host2 dovecot[114824]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.226, lip=66.85.158.92, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<rODRtWJHw+a594ni>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.242
country_id: 2635167
description:
Jan  2 13:02:56 host2 dovecot[114824]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.242, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<c0zLt2JHk+ZX7LDy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.210.73.33
country_id: 3469034
description:
2026-01-02 13:03:18 dovecot_login authenticator failed for H=(189-108-224-67.customer.tdatabrasil.net.br) [191.210.73.33]:33953: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.230
country_id: 2635167
description:
Jan  2 13:03:29 host2 dovecot[114824]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.230, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<GpPIuWJHT5K594nm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.14.36
country_id: 3144096
description:
2026-01-02 13:03:48 dovecot_login authenticator failed for H=(cm-84.211.14.36.get.no) [84.211.14.36]:39616: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.236
country_id: 2635167
description:
Jan  2 13:04:02 host2 dovecot[114824]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.236, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<x8/Du2JHaclX7LDs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.226
country_id: 2635167
description:
Jan  2 13:04:35 host2 dovecot[114824]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.226, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<a0C9vWJHvdhX7LDi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.222
country_id: 2635167
description:
Jan  2 13:05:09 host2 dovecot[114824]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.222, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<Npi4v2JHN5hX7LDe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.114
country_id: 1269750
description:
2026-01-02 13:06:18 dovecot_login authenticator failed for H=([152.52.238.86]) [182.95.184.114]:43008: 535 Incorrect authentication data (set_id=postmaster@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.54
country_id: 1149361
description:
2026-01-02 13:06:31 dovecot_login authenticator failed for H=([149.54.62.54]) [149.54.62.54]:44351: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-01-02 13:06:07 dovecot_login authenticator failed for H=([197.219.228.242]) [197.219.228.242]:37070: 535 Incorrect authentication data (set_id=postmaster@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.72.184.60
country_id: 6252001
description:
2026-01-02 13:07:55 dovecot_login authenticator failed for H=24-72-184-24-72-184-60.cpe.sparklight.net [24.72.184.60]:33016: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.90.94
country_id: 1269750
description:
2026-01-02 13:08:11 dovecot_login authenticator failed for H=([182.95.85.106]) [27.123.90.94]:41674: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 13:08:48 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<HrGlzGJHMrQv/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.5.63.166
country_id: 1694008
description:
2026-01-02 13:10:05 dovecot_login authenticator failed for H=([103.5.63.166]) [103.5.63.166]:45078: 535 Incorrect authentication data (set_id=office@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.251
country_id: 6252001
description:
Jan  2 13:10:24 host2 dovecot[114824]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.251, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<rtOB0mJHe9DG6xj7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  2 13:12:11 host2 sshd[145671]: Disconnected from invalid user user 2.57.121.25 port 6559 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  2 13:16:10 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<IKj/5mJHMNpCdMzo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 13:20:44 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<wL1f92JHirOeRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.243.234.23
country_id: 6252001
description:
2026-01-02 13:23:21 dovecot_login authenticator failed for H=c-73-243-234-23.hsd1.co.comcast.net [73.243.234.23]:49318: 535 Incorrect authentication data (set_id=contact@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  2 13:22:45 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<6DqE/mJH/o5nmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  2 13:27:07 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<g9cqDmNHGDpniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.104
country_id: 3865483
description:
Jan  2 13:32:22 host2 dovecot[114824]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=179.0.250.104, lip=66.85.158.91, TLS, session=<Qu7wH2NHDdizAPpo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.30.113.241
country_id: 3175395
description:
Jan  2 13:32:01 host2 dovecot[114824]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=185.30.113.241, lip=66.85.158.91, TLS, session=<RJ2kHmNHcJC5HnHx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 13:32:15 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<ueyHIGNHDq8v/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  2 13:34:08 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<76pCJ2NH7od100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  2 13:34:22 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<uTMaKGNH7toFhXlo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.203
country_id: 3144096
description:
2026-01-02 13:34:35 dovecot_login authenticator failed for H=(cm-84.211.13.203.get.no) [84.211.13.203]:52887: 535 Incorrect authentication data (set_id=office@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.5.63.166
country_id: 1694008
description:
2026-01-02 13:34:39 dovecot_login authenticator failed for H=([103.5.63.166]) [103.5.63.166]:58065: 535 Incorrect authentication data (set_id=sales@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.254.91
country_id: 3865483
description:
2026-01-02 13:35:13 dovecot_login authenticator failed for H=(static.92.254.104.190.cps.com.ar) [190.104.254.91]:50930: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.98.8
country_id: 3144096
description:
2026-01-02 13:35:25 dovecot_login authenticator failed for H=(cm-84.215.98.8.get.no) [84.215.98.8]:50399: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2026-01-02 13:36:10 dovecot_plain authenticator failed for H=(pared) [65.20.129.28]:45006: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.15
country_id: 798549
description:
Jan  2 13:38:10 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.15, lip=66.85.158.91, session=<KW3RNWNHEKNV2ZUP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  2 13:38:26 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<VuGfNmNHWMpn9M4G>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.168.139.28
country_id: 2264397
description:
Jan  2 13:39:35 host2 sshd[173839]: Disconnected from invalid user postgres 79.168.139.28 port 50012 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 13:41:07 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<l3JAQGNHOrueRdY+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 79.168.139.28
country_id: 2264397
description:
Jan  2 13:41:10 host2 sshd[175802]: Disconnected from invalid user ubuntu 79.168.139.28 port 41930 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.14.237.154
country_id: 6252001
description:
Jan  2 13:40:52 host2 sshd[175477]: Disconnected from invalid user game 128.14.237.154 port 39586 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.108.174.4
country_id: 3469034
description:
Jan  2 13:42:03 host2 sshd[176687]: Disconnected from invalid user admin1 200.108.174.4 port 58328 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.242.226.85
country_id: 6252001
description:
Jan  2 13:42:22 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.242.226.85, lip=66.85.158.92, session=<VKLURGNHDr258uJV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.157.20
country_id: 1819730
description:
Jan  2 13:42:40 host2 sshd[177379]: Disconnected from invalid user es 150.5.157.20 port 56728 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.27.76.210
country_id: 3469034
description:
2026-01-02 13:42:08 dovecot_login authenticator failed for H=(187-8-89-120.customer.tdatabrasil.net.br) [177.27.76.210]:57069: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 13:42:24 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<fv7WRGNHOoYjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.162.102
country_id: 1269750
description:
2026-01-02 13:42:32 dovecot_login authenticator failed for H=([125.19.164.187]) [125.19.162.102]:46520: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.19.250.18
country_id: 3017382
description:
Jan  2 13:43:06 host2 sshd[177836]: Disconnected from invalid user postgres 162.19.250.18 port 43280 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 150.5.157.20
country_id: 1819730
description:
Jan  2 13:44:38 host2 sshd[179290]: Disconnected from invalid user postgres 150.5.157.20 port 41534 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 79.168.139.28
country_id: 2264397
description:
Jan  2 13:43:49 host2 sshd[178500]: Received disconnect from 79.168.139.28 port 37880:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.157.20
country_id: 1819730
description:
Jan  2 13:44:00 host2 sshd[178633]: Disconnected from invalid user devops 150.5.157.20 port 39002 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.123
country_id: 1819730
description:
Jan  2 13:44:24 host2 sshd[179069]: Disconnected from invalid user ubuntu 154.83.15.123 port 58934 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.168.139.28
country_id: 2264397
description:
Jan  2 13:44:53 host2 sshd[179540]: Disconnected from invalid user deployer 79.168.139.28 port 44282 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.52.18
country_id: 798544
description:
Jan  2 13:45:05 host2 sshd[179890]: Disconnected from invalid user eva 54.38.52.18 port 37812 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.157.20
country_id: 1819730
description:
Jan  2 13:45:56 host2 sshd[180896]: Disconnected from invalid user test 150.5.157.20 port 41164 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.243
country_id: 6252001
description:
Jan  2 13:46:33 host2 dovecot[114824]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.243, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<1pnOU2NH2tDN0h/z>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 54.38.52.18
country_id: 798544
description:
Jan  2 13:47:23 host2 sshd[182471]: Disconnected from invalid user devops 54.38.52.18 port 43602 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.238.157
country_id: 6252001
description:
Jan  2 13:46:45 host2 sshd[181738]: Disconnected from invalid user ubuntu 167.99.238.157 port 56780 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.52.18
country_id: 798544
description:
Jan  2 13:46:48 host2 sshd[181802]: Disconnected from invalid user rafael 54.38.52.18 port 38194 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 210.79.142.221
country_id: 1643084
description:
Jan  2 13:46:51 host2 sshd[181832]: Disconnected from invalid user github 210.79.142.221 port 33060 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.108.174.4
country_id: 3469034
description:
Jan  2 13:47:45 host2 sshd[182888]: Disconnected from invalid user ec2-user 200.108.174.4 port 33582 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.123
country_id: 1819730
description:
Jan  2 13:47:50 host2 sshd[183011]: Disconnected from invalid user yaroslav 154.83.15.123 port 46358 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 210.79.142.221
country_id: 1643084
description:
Jan  2 13:48:12 host2 sshd[183667]: Disconnected from invalid user nokia 210.79.142.221 port 43852 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.238.157
country_id: 6252001
description:
Jan  2 13:48:25 host2 sshd[183984]: Disconnected from invalid user deploy 167.99.238.157 port 58100 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.197.53
country_id: 2921044
description:
Jan  2 13:49:14 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@nsteeleng.com>, method=PLAIN, rip=152.53.197.53, lip=66.85.158.91, session=<TF48XWNH5MqYNcU1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.19.250.18
country_id: 3017382
description:
Jan  2 13:49:03 host2 sshd[184685]: Disconnected from invalid user ubuntu 162.19.250.18 port 51398 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.238.157
country_id: 6252001
description:
Jan  2 13:49:29 host2 sshd[185525]: Disconnected from invalid user ai 167.99.238.157 port 46176 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 79.168.139.28
country_id: 2264397
description:
Jan  2 13:48:56 host2 sshd[184541]: Received disconnect from 79.168.139.28 port 60436:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.52.18
country_id: 798544
description:
Jan  2 13:49:02 host2 sshd[184619]: Disconnected from invalid user ai 54.38.52.18 port 52058 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  2 13:49:27 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<tkITXmNH6sKi8Jp9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.108.174.4
country_id: 3469034
description:
Jan  2 13:50:10 host2 sshd[186443]: Disconnected from invalid user est 200.108.174.4 port 50740 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 210.79.142.221
country_id: 1643084
description:
Jan  2 13:50:40 host2 sshd[187030]: Disconnected from invalid user adam 210.79.142.221 port 47752 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.19.250.18
country_id: 3017382
description:
Jan  2 13:49:44 host2 sshd[185778]: Disconnected from invalid user deployer 162.19.250.18 port 34298 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.108.174.4
country_id: 3469034
description:
Jan  2 13:51:01 host2 sshd[187417]: Disconnected from invalid user postgres 200.108.174.4 port 45468 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.52.18
country_id: 798544
description:
Jan  2 13:50:42 host2 sshd[187080]: Disconnected from invalid user coin 54.38.52.18 port 53670 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  2 13:51:53 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<06m+ZmNHlpWi8GQy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.70.59.165
country_id: 2264397
description:
Jan  2 13:54:49 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=146.70.59.165, lip=66.85.158.91, TLS handshaking: Connection closed, session=<MfdfcWNHqtGSRjul>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.239.217.42
country_id: 3041565
description:
Jan  2 13:54:51 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=173.239.217.42, lip=66.85.158.91, session=<CwZ3cWNH0oCt79kq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 86.106.74.252
country_id: 719819
description:
Jan  2 13:54:49 host2 dovecot[114824]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=86.106.74.252, lip=66.85.158.91, TLS, session=<JVlfcWNHbKlWakr8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 98.159.40.153
country_id: 1210997
description:
Jan  2 13:54:49 host2 dovecot[114824]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=98.159.40.153, lip=66.85.158.91, session=<zDxgcWNHzotinyiZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 156.146.55.164
country_id: 732800
description:
Jan  2 13:54:49 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=156.146.55.164, lip=66.85.158.91, TLS, session=<TIRgcWNHutGckjek>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.120.50
country_id: 1269750
description:
2026-01-02 13:55:01 dovecot_login authenticator failed for H=(nsg-static-89.234.75.182-airtel.com) [182.95.120.50]:41334: 535 Incorrect authentication data (set_id=office@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2026-01-02 13:55:22 dovecot_login authenticator failed for H=([178.250.191.189]) [178.250.191.189]:58648: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 176.125.230.135
country_id: 2562770
description:
Jan  2 13:54:49 host2 dovecot[114824]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=176.125.230.135, lip=66.85.158.91, TLS handshaking: Connection closed, session=<jSxfcWNHXKmwfeaH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.233.160
country_id: 2993457
description:
Jan  2 13:54:49 host2 dovecot[114824]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=95.181.233.160, lip=66.85.158.91, session=<41RkcWNHwItftemg>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 170.64.227.24
country_id: 2077456
description:
Jan  2 13:56:29 host2 dovecot[114824]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 2 secs): user=<>, rip=170.64.227.24, lip=66.85.158.92, TLS, session=<RW1Yd2NHvs2qQOMY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.192.85.86
country_id: 3175395
description:
2026-01-02 13:56:14 dovecot_login authenticator failed for H=([2.192.85.86]) [2.192.85.86]:55752: 535 Incorrect authentication data (set_id=postmaster@kiriaswanu.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 134.122.45.192
country_id: 6251999
description:
Jan  2 13:56:27 host2 dovecot[114824]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=134.122.45.192, lip=66.85.158.91, TLS, session=<n3M3d2NH7MSGei3A>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.142.184.55
country_id: 1210997
description:
2026-01-02 13:56:28 dovecot_login authenticator failed for H=([103.133.175.82]) [103.142.184.55]:54047: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 155.117.98.117
country_id: 6252001
description:
Jan  2 13:56:03 host2 pure-ftpd[193837]: (?@155.117.98.117) [INFO] New connection from 155.117.98.117


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.122.45.192
country_id: 6251999
description:
Jan  2 13:56:26 host2 pure-ftpd[194373]: (?@134.122.45.192) [INFO] New connection from 134.122.45.192


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.122.45.192
country_id: 6251999
description:
Jan  2 13:56:27 host2 dovecot[114824]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=134.122.45.192, lip=66.85.158.91, TLS: Connection closed, session=<Z+Uwd2NH4n2Gei3A>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 170.64.227.24
country_id: 2077456
description:
Jan  2 13:56:27 host2 dovecot[114824]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=170.64.227.24, lip=66.85.158.92, session=<P6M6d2NHuM2qQOMY>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  2 13:58:59 host2 pure-ftpd[197109]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.11
country_id: 3017382
description:
Jan  2 13:59:00 host2 dovecot[114824]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.231.89.11, lip=66.85.158.91, session=<GTROgGNH4eFb51kL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.9
country_id: 3017382
description:
Jan  2 13:59:10 host2 dovecot[114824]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.231.89.9, lip=66.85.158.91, session=<9OLsgGNHW9lb51kJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.129
country_id: 3017382
description:
Jan  2 13:59:24 host2 dovecot[114824]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=91.231.89.129, lip=66.85.158.91, session=<UmXDgWNHYehb51mB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 14:00:08 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<5qpAhGNHANAjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.226.182
country_id: 3469034
description:
2026-01-02 14:02:26 dovecot_login authenticator failed for H=(189-108-192-66.customer.tdatabrasil.net.br) [187.50.226.182]:46234: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  2 14:03:39 host2 sshd[202087]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.248.47.114
country_id: 6252001
description:
2026-01-02 14:02:43 dovecot_login authenticator failed for H=(syn-172-248-047-114.res.spectrum.com) [172.248.47.114]:53518: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.242.226.85
country_id: 6252001
description:
Jan  2 14:02:45 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.242.226.85, lip=66.85.158.91, session=</1nBjWNHtuy58uJV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.23.68
country_id: 3144096
description:
2026-01-02 14:03:04 dovecot_login authenticator failed for H=([178.232.23.68]) [178.232.23.68]:49730: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 155.117.98.117
country_id: 6252001
description:
Jan  2 14:04:47 host2 pure-ftpd[203244]: (?@155.117.98.117) [INFO] New connection from 155.117.98.117


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.172
country_id: 6252001
description:
Jan  2 14:07:10 host2 dovecot[114824]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.172, lip=66.85.158.92, TLS handshaking: Connection closed, session=<3sWDnWNHpNRAPpys>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.172
country_id: 6252001
description:
Jan  2 14:07:43 host2 dovecot[114824]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=64.62.156.172, lip=66.85.158.92, TLS: Connection closed, session=<h4J7n2NHRkBAPpys>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.63.103
country_id: 3144096
description:
2026-01-02 14:08:18 dovecot_login authenticator failed for H=([84.215.63.103]) [84.215.63.103]:39154: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.175.201.167
country_id: 3469034
description:
2026-01-02 14:15:56 dovecot_login authenticator failed for H=200.175.201.167.dynamic.dialup.gvt.net.br (corporate.static.gvt.net.br) [200.175.201.167]:43876: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.218
country_id: 337996
description:
2026-01-02 14:16:52 dovecot_login authenticator failed for H=([196.189.124.218]) [196.189.124.218]:40178: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.218.247.234
country_id: 1522867
description:
2026-01-02 14:16:37 dovecot_login authenticator failed for H=([89.218.247.234]) [89.218.247.234]:37650: 535 Incorrect authentication data (set_id=postmaster@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  2 14:19:29 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<ZBlPyWNHQpcyBsPO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 14:19:50 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<rXawymNHMJsv/AU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  2 14:19:49 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<qFGcymNHAIBo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2026-01-02 14:21:21 dovecot_login authenticator failed for H=([103.50.5.94]) [103.50.5.94]:35979: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.40.215.162
country_id: 3469034
description:
2026-01-02 14:21:33 dovecot_login authenticator failed for H=187-40-215-162.user.veloxzone.com.br [187.40.215.162]:53278: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.24
country_id: 2186224
description:
2026-01-02 14:23:58 dovecot_login authenticator failed for H=([121.73.169.24]) [121.73.169.24]:45202: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Jan  2 14:24:02 host2 sshd[223081]: Disconnected from invalid user admin 2.57.121.112 port 8249 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  2 14:24:58 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<IqMT3WNHGBtniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 14:26:34 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<uJHM4mNHlo+eRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.219.68.189
country_id: 3865483
description:
2026-01-02 14:30:42 dovecot_login authenticator failed for H=([201.219.68.189]) [201.219.68.189]:46398: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.155.55.174
country_id: 1880251
description:
Jan  2 14:35:35 host2 sshd[236022]: Disconnected from invalid user arma3server 107.155.55.174 port 36188 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2026-01-02 14:36:44 dovecot_plain authenticator failed for H=c-73-213-237-28.hsd1.va.comcast.net (facutroic) [73.213.237.28]:50926: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.155.55.174
country_id: 1880251
description:
Jan  2 14:36:57 host2 sshd[237422]: Disconnected from invalid user lia 107.155.55.174 port 55980 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.190
country_id: 1269750
description:
2026-01-02 14:37:12 dovecot_login authenticator failed for H=([27.123.98.190]) [27.123.98.190]:47116: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.26.194.79
country_id: 3017382
description:
2026-01-02 14:37:18 dovecot_login authenticator failed for H=([217.26.194.79]) [217.26.194.79]:39391: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.185.37.239
country_id: 1269750
description:
2026-01-02 14:37:30 dovecot_login authenticator failed for H=([136.185.37.239]) [136.185.37.239]:37545: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.155.55.174
country_id: 1880251
description:
Jan  2 14:37:38 host2 sshd[238109]: Disconnected from invalid user opc 107.155.55.174 port 39762 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.155.55.174
country_id: 1880251
description:
Jan  2 14:38:49 host2 sshd[239205]: Disconnected from invalid user cosmos 107.155.55.174 port 35540 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  2 14:39:32 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<DioiEWRHEtJn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  2 14:39:32 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<Jh4lEWRHmpZ100Db>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  2 14:40:46 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<jj2TFWRHUItnmud6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 14:43:52 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<WoSjIGRHJLgv/AU1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.59.26
country_id: 1269750
description:
2026-01-02 14:44:38 dovecot_login authenticator failed for H=([125.23.125.209]) [122.187.59.26]:35486: 535 Incorrect authentication data (set_id=test@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.228.146
country_id: 1269750
description:
2026-01-02 14:44:54 dovecot_login authenticator failed for H=([125.16.32.137]) [125.20.228.146]:52098: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan  2 14:45:28 host2 sshd[246647]: Disconnected from invalid user user 2.57.121.25 port 24857 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 158.69.214.62
country_id: 6251999
description:
Jan  2 14:46:49 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=158.69.214.62, lip=66.85.158.91, session=<Qmw0K2RHFOaeRdY+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.237
country_id: 2186224
description:
2026-01-02 14:46:50 dovecot_login authenticator failed for H=([121.73.169.237]) [121.73.169.237]:46746: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 14:49:37 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<Mps+NWRHmpojupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.220.188.88
country_id: 6252001
description:
Jan  2 14:52:06 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=44.220.188.88, lip=66.85.158.92, TLS handshaking: Connection closed, session=<hjg9PmRHKKEs3LxY>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  2 14:53:29 host2 sshd[254728]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.241.132.152
country_id: 1269750
description:
2026-01-02 14:54:06 dovecot_login authenticator failed for H=(static.ill.117.248.107.130.bsnl.co.in) [43.241.132.152]:39602: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  2 14:54:19 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<no-reply@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<DMv7RWRHxsqi8GQy>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 87.236.176.185
country_id: 2635167
description:
Jan  2 14:53:56 host2 pure-ftpd[255134]: (?@87.236.176.185) [INFO] New connection from 87.236.176.185


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.170.50.2
country_id: 3932488
description:
2026-01-02 14:54:38 dovecot_login authenticator failed for H=([45.170.50.2]) [45.170.50.2]:48510: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  2 14:54:47 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<VjSuR2RHHq9CdMzo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.50
country_id: 6252001
description:
Jan  2 14:54:52 host2 dovecot[114824]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.50, lip=66.85.158.91, TLS, session=<qGchSGRHkOzN0h8y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.156
country_id: 1269750
description:
2026-01-02 14:54:25 dovecot_login authenticator failed for H=([103.146.233.156]) [103.146.233.156]:34957: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  2 14:55:47 host2 dovecot[114824]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<postfix@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<RBY8S2RHPhmi8Jp9>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  2 15:01:56 host2 pure-ftpd[262838]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.122
country_id: 1269750
description:
2026-01-02 15:01:59 dovecot_login authenticator failed for H=([128.185.253.122]) [128.185.253.122]:34032: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.33.112
country_id: 3144096
description:
2026-01-02 15:02:16 dovecot_login authenticator failed for H=([178.232.33.112]) [178.232.33.112]:40446: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2026-01-02 15:01:45 dovecot_login authenticator failed for H=([189.59.210.1]) [186.215.245.175]:50687: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.69.161.7
country_id: 6252001
description:
2026-01-02 15:02:01 dovecot_login authenticator failed for H=([208.69.161.7]) [208.69.161.7]:50021: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.37.179.83
country_id: 3932488
description:
2026-01-02 15:02:11 dovecot_login authenticator failed for H=([200.37.179.83]) [200.37.179.83]:51794: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 11009
name: WHM login success
abuser: 112.134.166.125
country_id: 1227603
description:
[2025-12-26 17:26:14 +0530] info [whostmgrd] 112.134.166.125 NEW root:V7jHYG51wx5QRs62 address=112.134.166.125,app=whostmgrd,creator=root,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.6.195.206
country_id: 6252001
description:
Jan  2 16:08:32 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 6 secs): user=<admin@sivagnanamfoundation.com>, method=PLAIN, rip=50.6.195.206, lip=66.85.158.91, session=<ebEzT2VHhMEyBsPO>


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 112.134.166.125
country_id: 1227603
description:
Jan  2 16:09:26 host2 sshd[5286]: Accepted publickey for root from 112.134.166.125 port 54561 ssh2: RSA SHA256:C0En+cJtfOiiBlRxct5LWBK/MIchNWIDnkBuPMzsR+o


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.219.237.113
country_id: 6252001
description:
Jan  2 16:11:02 host2 pure-ftpd[6706]: (?@104.219.237.113) [INFO] New connection from 104.219.237.113


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 104.219.237.113
country_id: 6252001
description:
Jan  2 16:11:09 host2 pure-ftpd[6706]: (?@104.219.237.113) [WARNING] Authentication failed for user [neotechlk]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.131.83
country_id: 690791
description:
Jan  2 16:19:03 host2 dovecot[1870]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=37.221.131.83, lip=66.85.158.91, TLS, session=<pGMvdGVHwo8l3YNT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  2 16:18:18 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<V2phcmVHQARniu0S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.202.100.196
country_id: 798544
description:
Jan  2 16:19:21 host2 dovecot[1870]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=85.202.100.196, lip=66.85.158.91, TLS, session=<N7dGdWVH4YxVymTE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.239.160.152
country_id: 3996063
description:
2026-01-02 16:19:36 dovecot_login authenticator failed for H=([177.239.160.152]) [177.239.160.152]:60710: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.57
country_id: 1168579
description:
2026-01-02 16:19:44 dovecot_login authenticator failed for H=(57.92.zcomnetworks.com.pk) [103.148.92.57]:34327: 535 Incorrect authentication data (set_id=test@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2026-01-02 16:20:21 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:64217: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.133.121.104
country_id: 1512440
description:
Jan  2 16:30:35 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=5.133.121.104, lip=66.85.158.91, session=<DOpTnmVHWqMFhXlo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.74.41
country_id: 1527747
description:
2026-01-02 16:31:38 dovecot_login authenticator failed for H=(92-62-74-41.saimanet.kg) [92.62.74.41]:52349: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.81
country_id: 1733045
description:
2026-01-02 16:31:19 dovecot_login authenticator failed for H=([49.124.151.81]) [49.124.151.81]:39226: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.116.204.232
country_id: 1269750
description:
Jan  2 16:33:46 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=66.116.204.232, lip=66.85.158.91, session=<xz63qWVHDL9CdMzo>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 140.245.98.125
country_id: 1880251
description:
Jan  2 16:39:11 host2 pure-ftpd[30405]: (?@140.245.98.125) [INFO] New connection from 140.245.98.125


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 140.245.98.125
country_id: 1880251
description:
Jan  2 16:39:17 host2 pure-ftpd[30496]: (?@140.245.98.125) [INFO] New connection from 140.245.98.125


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 140.245.98.125
country_id: 1880251
description:
Jan  2 16:40:06 host2 pure-ftpd[31543]: (?@140.245.98.125) [INFO] New connection from 140.245.98.125


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 140.245.98.125
country_id: 1880251
description:
Jan  2 16:40:11 host2 pure-ftpd[31698]: (?@140.245.98.125) [INFO] New connection from 140.245.98.125


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
country_id: 290557
description:
2026-01-02 16:40:18 dovecot_plain authenticator failed for H=(fetahs) [80.227.147.94]:38900: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.23.172.153
country_id: 6252001
description:
Jan  2 16:41:17 host2 sshd[32840]: Disconnected from invalid user pms 154.23.172.153 port 48460 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.0.19
country_id: 3469034
description:
2026-01-02 16:42:18 dovecot_login authenticator failed for H=(177-215-153-215.user.vivozap.com.br) [189.56.0.19]:41293: 535 Incorrect authentication data (set_id=office@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  2 16:42:19 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<McxLyGVHmuhn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.228
country_id: 99237
description:
2026-01-02 16:42:32 dovecot_login authenticator failed for H=([65.20.205.228]) [65.20.205.228]:46590: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.30.51
country_id: 6251999
description:
Jan  2 16:43:16 host2 sshd[34663]: Disconnected from invalid user alexis 51.222.30.51 port 37800 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.222.30.51
country_id: 6251999
description:
Jan  2 16:43:47 host2 sshd[35157]: Disconnected from invalid user sam 51.222.30.51 port 44966 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 16:43:53 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<webmaster@lankaherbalsolutions.com>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<zT/kzWVHoOAv/AU1>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  2 16:44:25 host2 sshd[35825]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.30.51
country_id: 6251999
description:
Jan  2 16:44:16 host2 sshd[35698]: Disconnected from invalid user rushi 51.222.30.51 port 42824 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.75.27.166
country_id: 3017382
description:
Jan  2 16:45:13 host2 sshd[36823]: Disconnected from invalid user alberto 51.75.27.166 port 39966 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.38.169
country_id: 1880251
description:
Jan  2 16:45:34 host2 sshd[37161]: Disconnected from invalid user nextcloud 128.1.38.169 port 42680 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.75.27.166
country_id: 3017382
description:
Jan  2 16:45:46 host2 sshd[37505]: Disconnected from invalid user guest1 51.75.27.166 port 56156 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.75.27.166
country_id: 3017382
description:
Jan  2 16:46:21 host2 sshd[38542]: Disconnected from invalid user michele 51.75.27.166 port 54036 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.102.57
country_id: 6252001
description:
Jan  2 16:47:21 host2 sshd[39445]: Disconnected from invalid user user 64.227.102.57 port 55878 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.48.243.18
country_id: 1819730
description:
Jan  2 16:47:31 host2 sshd[39563]: Disconnected from invalid user git 144.48.243.18 port 60282 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 128.1.38.169
country_id: 1880251
description:
Jan  2 16:48:40 host2 sshd[40605]: Disconnected from invalid user sam 128.1.38.169 port 33092 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.102.57
country_id: 6252001
description:
Jan  2 16:48:08 host2 sshd[40184]: Disconnected from invalid user sagar 64.227.102.57 port 56994 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.38.169
country_id: 1880251
description:
Jan  2 16:49:14 host2 sshd[41115]: Disconnected from invalid user elly 128.1.38.169 port 44940 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.102.57
country_id: 6252001
description:
Jan  2 16:50:24 host2 sshd[42570]: Disconnected from invalid user tempftp 64.227.102.57 port 47772 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.48.243.18
country_id: 1819730
description:
Jan  2 16:50:38 host2 sshd[42826]: Disconnected from invalid user username 144.48.243.18 port 45740 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.62
country_id: 1269750
description:
2026-01-02 16:51:47 dovecot_login authenticator failed for H=([182.95.58.62]) [182.95.58.62]:60966: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.156.1.127
country_id: 3469034
description:
2026-01-02 16:52:44 dovecot_login authenticator failed for H=([38.156.1.127]) [38.156.1.127]:41881: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.211.64.219
country_id: 1269750
description:
Jan  2 16:52:50 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@mathsmotorcysle.xyz>, method=PLAIN, rip=117.211.64.219, lip=66.85.158.91, session=<d7fa7WVHdbR100Db>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 144.48.243.18
country_id: 1819730
description:
Jan  2 16:53:42 host2 sshd[45687]: Disconnected from invalid user usr01 144.48.243.18 port 56328 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.240.100.50
country_id: 6252001
description:
Jan  2 16:57:54 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<test@sobaherbal.com>, method=PLAIN, rip=162.240.100.50, lip=66.85.158.91, session=<SKL+/2VH/r6i8GQy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 17:00:53 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@anandaobauae.org>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<G9ewCmZHXkYjupN+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.170
country_id: 1733045
description:
2026-01-02 17:02:51 dovecot_login authenticator failed for H=([49.124.154.170]) [49.124.154.170]:42782: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.70
country_id: 1269750
description:
2026-01-02 17:03:06 dovecot_login authenticator failed for H=([125.17.70.25]) [125.20.251.70]:45634: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.252.5.53
country_id: 6252001
description:
Jan  2 17:07:56 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@dataesite.lk>, method=PLAIN, rip=47.252.5.53, lip=66.85.158.91, session=<GeTaI2ZHxNsv/AU1>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  2 17:07:31 host2 pure-ftpd[61404]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.65.172.46
country_id: 6252001
description:
[2026-01-02 17:07:33 +0530] info [cpaneld] 159.65.172.46 - cloudtourssrilan_travel "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.123
country_id: 6252001
description:
Jan  2 17:07:41 host2 pure-ftpd[61596]: (?@66.132.153.123) [INFO] New connection from 66.132.153.123


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.240.154.125
country_id: 6252001
description:
Jan  2 17:07:52 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=162.240.154.125, lip=66.85.158.91, session=<MyiqI2ZHnFSi8Jp9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2026-01-02 17:12:33 dovecot_login authenticator failed for H=([182.95.228.194]) [182.95.228.194]:38822: 535 Incorrect authentication data (set_id=postmaster@kiriaswanu.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.240.219.146
country_id: 6252001
description:
Jan  2 17:12:42 host2 dovecot[1870]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=66.240.219.146, lip=66.85.158.92, session=<2nAPNWZHwt5C8NuS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.111.136.21
country_id: 294640
description:
2026-01-02 17:12:26 dovecot_login authenticator failed for H=([84.111.136.21]) [84.111.136.21]:37079: 535 Incorrect authentication data (set_id=postmaster@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.190.155.43
country_id: 6252001
description:
2026-01-02 17:13:59 dovecot_plain authenticator failed for H=(frentef) [76.190.155.43]:49409: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.138.237.18
country_id: 1269750
description:
Jan  2 17:14:13 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@essenceceylontea.com>, method=PLAIN, rip=103.138.237.18, lip=66.85.158.91, session=<EUhXOmZHrzRniu0S>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.240.219.146
country_id: 6252001
description:
Jan  2 17:15:40 host2 dovecot[1870]: pop3-login: Disconnected: Inactivity (no auth attempts in 180 secs): user=<>, rip=66.240.219.146, lip=66.85.158.92, TLS, session=<Lv2sP2ZHBt1C8NuS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.154.231.122
country_id: 1643084
description:
Jan  2 17:16:51 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=103.154.231.122, lip=66.85.158.91, session=<4NrFQ2ZH9sZnmud6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.250.51.2
country_id: 1168579
description:
2026-01-02 17:16:56 dovecot_login authenticator failed for H=([160.250.51.2]) [160.250.51.2]:36439: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.70.157.25
country_id: 6252001
description:
2026-01-02 17:17:11 dovecot_login authenticator failed for H=([152.70.157.25]) [152.70.157.25]:57452: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.186.147.126
country_id: 1880251
description:
Jan  2 17:17:20 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<postfix@melanifinefood.com>, method=PLAIN, rip=35.186.147.126, lip=66.85.158.91, session=<1emCRWZH0kMjupN+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.10
country_id: 6252001
description:
Jan  2 17:19:28 host2 dovecot[1870]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.10, lip=66.85.158.91, TLS handshaking: Connection closed, session=<c4M+TWZHuthAPpwK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.195.4.247
country_id: 6252001
description:
2026-01-02 17:21:15 dovecot_login authenticator failed for H=(mobile-166-195-004-247.mycingular.net) [166.195.4.247]:46446: 535 Incorrect authentication data (set_id=contacto@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2026-01-02 17:21:15 dovecot_login authenticator failed for H=([193.46.192.20]) [193.46.192.20]:33756: 535 Incorrect authentication data (set_id=contacto@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.111.140
country_id: 1269750
description:
2026-01-02 17:21:25 dovecot_login authenticator failed for H=(abts-mum-static-140.111.170.122.airtelbroadband.in) [122.170.111.140]:35390: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.245.38
country_id: 1269750
description:
2026-01-02 17:21:29 dovecot_login authenticator failed for H=([152.52.12.201]) [152.52.245.38]:33266: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 140.245.98.125
country_id: 1880251
description:
Jan  2 17:24:45 host2 pure-ftpd[81398]: (?@140.245.98.125) [INFO] New connection from 140.245.98.125


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 140.245.98.125
country_id: 1880251
description:
Jan  2 17:24:50 host2 pure-ftpd[81504]: (?@140.245.98.125) [INFO] New connection from 140.245.98.125


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Jan  2 17:26:05 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@mathsmotorcysle.xyz>, method=PLAIN, rip=104.236.196.180, lip=66.85.158.91, session=<XYfJZGZHxhdo7MS0>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 140.245.98.125
country_id: 1880251
description:
Jan  2 17:25:06 host2 pure-ftpd[81970]: (?@140.245.98.125) [INFO] New connection from 140.245.98.125


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 140.245.98.125
country_id: 1880251
description:
Jan  2 17:25:08 host2 pure-ftpd[82024]: (?@140.245.98.125) [INFO] New connection from 140.245.98.125


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.246.166
country_id: 798544
description:
2026-01-02 17:29:45 dovecot_login authenticator failed for H=89-67-246-166.dynamic.play.pl [89.67.246.166]:34620: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.123.45.2
country_id: 1269750
description:
2026-01-02 17:29:52 dovecot_login authenticator failed for H=([103.123.45.2]) [103.123.45.2]:57750: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.250.1
country_id: 3469034
description:
2026-01-02 17:30:06 dovecot_login authenticator failed for H=(ticons.static.gvt.net.br) [177.207.250.1]:50174: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.13.139.61
country_id: 2510769
description:
2026-01-02 17:38:37 dovecot_login authenticator failed for H=61.red-88-13-139.dynamicip.rima-tde.net [88.13.139.61]:38499: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.219.54
country_id: 1269750
description:
2026-01-02 17:38:49 dovecot_login authenticator failed for H=([128.185.219.54]) [128.185.219.54]:43768: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2026-01-02 17:38:48 dovecot_login authenticator failed for H=([125.19.175.94]) [122.184.120.98]:60798: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2026-01-02 17:41:25 dovecot_plain authenticator failed for H=c-174-166-153-20.hsd1.nj.comcast.net (hogef) [174.166.153.20]:45212: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.169.105.44
country_id: 6252001
description:
Jan  2 17:42:00 host2 dovecot[1870]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.169.105.44, lip=66.85.158.92, session=<YdHanWZHsJYUqWks>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.127.155.221
country_id: 6252001
description:
Jan  2 17:43:39 host2 dovecot[1870]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.127.155.221, lip=66.85.158.91, session=<ORO4o2ZHeOEUf5vd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Jan  2 17:44:30 host2 dovecot[1870]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<no-reply@essenceceylontea.com>, method=PLAIN, rip=103.244.206.6, lip=66.85.158.91, session=<in+kpmZHgq9n9M4G>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.134.231
country_id: 6252001
description:
Jan  2 17:44:49 host2 dovecot[1870]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=71.6.134.231, lip=66.85.158.91, TLS, session=<LRLop2ZHVpBHBobn>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan  2 17:45:40 host2 sshd[104896]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.238.122
country_id: 2542007
description:
2026-01-02 17:45:34 dovecot_plain authenticator failed for H=(deambadies) [154.146.238.122]:33656: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.218.18
country_id: 1269750
description:
2026-01-02 17:47:27 dovecot_login authenticator failed for H=([128.185.217.27]) [128.185.218.18]:39372: 535 Incorrect authentication data (set_id=test@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.150
country_id: 1269750
description:
2026-01-02 17:47:35 dovecot_login authenticator failed for H=(nsg-corporate-177.246.185.122.airtel.in) [122.184.127.150]:50142: 535 Incorrect authentication data (set_id=test@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.9.247.58
country_id: 3469034
description:
2026-01-02 17:47:40 dovecot_login authenticator failed for H=([186.238.157.140]) [187.9.247.58]:39615: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2026-01-02 17:52:29 dovecot_plain authenticator failed for H=(herizatar) [176.113.155.132]:36835: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2026-01-02 17:52:24 dovecot_plain authenticator failed for H=c-24-15-216-41.hsd1.il.comcast.net (terry) [24.15.216.41]:48936: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.221.194
country_id: 3144096
description:
2026-01-02 17:56:11 dovecot_login authenticator failed for H=([178.232.221.194]) [178.232.221.194]:55576: 535 Incorrect authentication data (set_id=contact@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.80.73
country_id: 2077456
description:
2026-01-02 17:56:20 dovecot_login authenticator failed for H=([120.157.80.73]) [120.157.80.73]:39964: 535 Incorrect authentication data (set_id=contact@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.164.238.63
country_id: 6252001
description:
2026-01-02 17:56:25 dovecot_login authenticator failed for H=c-67-164-238-63.hsd1.il.comcast.net [67.164.238.63]:34690: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.229.14
country_id: 1269750
description:
2026-01-02 18:05:41 dovecot_login authenticator failed for H=([152.52.229.14]) [152.52.229.14]:60268: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.219.101.174
country_id: 1880251
description:
Jan  2 18:06:02 host2 sshd[127763]: Disconnected from invalid user design 8.219.101.174 port 51662 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.8.12
country_id: 614540
description:
2026-01-02 18:05:17 dovecot_login authenticator failed for H=([194.31.8.12]) [194.31.8.12]:64659: 535 Incorrect authentication data (set_id=office@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.170.150.178
country_id: 1605651
description:
2026-01-02 18:05:19 dovecot_login authenticator failed for H=([203.170.150.178]) [203.170.150.178]:56214: 535 Incorrect authentication data (set_id=office@kiriaswanu.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Jan  2 18:10:59 host2 pure-ftpd[133272]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


